Re: [PATCH] usb: storage: sddr55: Reject out-of-bound new_pba

[gregkh <gregkh@linuxfoundation.org>]

On Sun, Nov 16, 2025 at 01:22:01PM +0800, flynnnchen(陈天楚) wrote:
> From c63dc814b5e51713222462e6bf27d7956a933834 Mon Sep 17 00:00:00 2001
> From: Tianchu Chen <flynnnchen@tencent.com>
> Date: Sun, 16 Nov 2025 12:46:18 +0800
> Subject: [PATCH] usb: storage: sddr55: Reject out-of-bound new_pba

You can use git send-email to not have this show up in the body of the
email in the future :)

> Discovered by Atuin - Automated Vulnerability Discovery Engine.
> 
> new_pba comes from the status packet returned after each write.
> A bogus device could report values beyond the block count derived
> from info->capacity, letting the driver walk off the end of
> pba_to_lba[] and corrupt heap memory.
> 
> Reject PBAs that exceed the computed block count and fail the
> transfer so we avoid touching out-of-range mapping entries.
> 
> Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
> ---
>  drivers/usb/storage/sddr55.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
> index b323f0a36..9d813727e 100644
> --- a/drivers/usb/storage/sddr55.c
> +++ b/drivers/usb/storage/sddr55.c
> @@ -469,6 +469,12 @@ static int sddr55_write_data(struct us_data *us,
>  		new_pba = (status[3] + (status[4] << 8) + (status[5] << 16))
>  						  >> info->blockshift;
>  
> +		/* check if device-reported new_pba is out of range */
> +		if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) {
> +			result = USB_STOR_TRANSPORT_FAILED;
> +			goto leave;
> +		}

Any chance you tested this with real hardware?

thanks,

greg k-h