Re: [PATCH 4/7] usb: storage: ene_ub6250: bound the disabled block walk

[sashiko-bot@kernel.org]

> From: Josef Bacik <josef@toxicpanda.com>
> 
> When two physical blocks of a Memory Stick both claim logical block 0,
> which happens after an interrupted update of that block or on a crafted
> card, the ENE UB6250 driver can spin forever in the usb-storage thread
> while reading through 64KiB past a 512-byte buffer, over and over.
> 
> ms_lib_check_disableblock() reads page 1 of the boot block, which holds
> the disabled block table: big-endian 16-bit block numbers terminated by
> 0xffff, the same table ms_lib_process_bootblock() parses with
> be16_to_cpu() on 16-bit entries.  The walk, however, indexes the buffer
> as unsigned char and has no upper bound:
> 
>     blk = be16_to_cpu(PageBuf[index]);
>     if (blk == MS_LB_NOT_USED)
>             break;
> 
> A byte converted this way can never equal 0xffff, so the loop only ends
> if some byte happens to match Log2PhyMap[0].  Otherwise the u16 index
> runs through the 64KiB following the kmalloc()ed page and wraps around,
> forever.
> 
> The bug was found by code inspection and has not been reproduced.
> 
> Fix by walking the table as 16-bit big-endian entries and stopping at
> the end of the page.
> 
> Fixes: 33842cedfc33 ("Staging: Merge ENE UB6250 MS card codes from keucr to drivers/usb/storage/ene_ub6250.c")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-llm-usb-storage-v1-0-d1655e94ed10@linuxfoundation.org?part=4