Re: [PATCH 1/7] usb: storage: ene_ub6250: fail MS init on card errors

[sashiko-bot@kernel.org]

> From: Josef Bacik <josef@toxicpanda.com>
> 
> Inserting a Memory Stick that has no usable boot block, for example a
> blank or damaged card, into an ENE UB6250 reader oopses the kernel with
> a divide error on the first READ(10).
> 
> ene_ms_init() ignores the return value of ms_card_init().  When
> ms_card_init() finds no boot block it returns MS_STATUS_ERROR after
> ms_lib_free_allocatedarea() has cleared the card geometry and freed the
> logical maps, but MS_Status keeps the MS_Ready bit the reader reported,
> so ene_transport() goes on to dispatch commands to ms_scsi_irp().  The
> first READ(10) from the partition scan then reaches ms_scsi_read():
> 
>     logblk  = (u16)(bn / info->MS_Lib.PagesPerBlock);
> 
> with PagesPerBlock == 0.  With a non-zero PagesPerBlock the same path
> would dereference the freed (NULL) Log2PhyMap instead.
> 
> The bug was found by code inspection and has not been reproduced.
> 
> Fix by clearing MS_Ready and returning USB_STOR_TRANSPORT_ERROR from
> ene_ms_init() when ms_card_init() fails, as is already done when the
> reader reports that the card is not ready.
> 
> Fixes: 33842cedfc33 ("Staging: Merge ENE UB6250 MS card codes from keucr to drivers/usb/storage/ene_ub6250.c")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-llm-usb-storage-v1-0-d1655e94ed10@linuxfoundation.org?part=1