Re: divide error in alauda_transport

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Thu, May 23, 2024 at 11:26:48AM +0800, Shichao Lai wrote:
> 在2024年5月23日星期四 UTC+8 03:59:30<Alan Stern> 写道：
> 
> > On Wed, May 22, 2024 at 06:01:57PM +0800, Shichao Lai wrote:
> > > Thanks for your patience. I am a beginner and initially attempted to
> > report
> > > errors to the community.
> > > However, I have just discovered that the issue mentioned above has
> > already
> > > been proposed in the previous three months of the article, and there is
> > an
> > > ongoing discussion.
> >
> > To call the discussion "ongoing" is optimistic. There hasn't been any
> > reply to my last post, which was made on March 17, more than two months
> > ago.
> >
> > Maybe you can carry out the tests I described in that post. That
> > would be a big help.
> >
> > Alan Stern
> >
> > > I think this post can be closed later.
> > >
> > > https://groups.google.com/g/syzkaller-bugs/c/m8CuxSpLKoQ/m/JfUy1xGnAwAJ
> > >
> > > Greg Kroah-Hartman <gre...@linuxfoundation.org
> > <https://groups.google.com/>> 于2024年5月22日周三 16:59写道：
> > >
> > > > On Wed, May 22, 2024 at 04:22:18PM +0800, Shichao Lai wrote:
> > > > > patch like this:
> > > > > ```c
> > > > > while (sectors > 0) {
> > > > > if (!uzonesize) {
> > > > > return USB_STOR_TRANSPORT_ERROR;
> > > > > }
> > > > > unsigned int zone = lba / uzonesize; /* integer division */
> > > > > unsigned int lba_offset = lba - (zone * uzonesize);
> > > > > unsigned int pages;
> > > > > ```
> > > >
> > > > Please submit this properly and we will be glad to review it.
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > > >
> 
> 
> 
> Hello Dear Maintainer!
> I found the same divide error yestoday as
> https://groups.google.com/g/syzkaller-bugs/c/m8CuxSpLKoQ
> And I add a patch before drivers/usb/storage/alauda.c:950 in
> alauda_read_data().
> The true cause of this error is that the variable uzonesize may be set to 0.
> Here is my patch:
> ===========
> 
> diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
> index 115f05a6201a..fb54af37efd5 100644
> --- a/drivers/usb/storage/alauda.c
> +++ b/drivers/usb/storage/alauda.c
> @@ -947,6 +947,9 @@ static int alauda_read_data(struct us_data *us,
> unsigned long address,
>         sg = NULL;
> 
>         while (sectors > 0) {
> +               if (!uzonesize) {
> +                       return USB_STOR_TRANSPORT_ERROR;
> +               }
>                 unsigned int zone = lba / uzonesize; /* integer division */
>                 unsigned int lba_offset = lba - (zone * uzonesize);
>                 unsigned int pages;
> 


Great! Can you turn this into a real patch and send it to us so that we
can apply it properly?  Directions for how to do so are in the
Documentation/process/submitting_patches file.

thanks,

greg k-h