Re: [PATCH 5/7] usb: storage: sddr09: bound the unused PBA search

[sashiko-bot@kernel.org]

> From: Josef Bacik <josef@toxicpanda.com>
> 
> sddr09_find_unused_pba() can read past the end of pba_to_lba[] and hand
> out a physical block that does not exist on the card, which is then
> recorded in pba_to_lba[] past its end and written to.
> 
> The search resumes from lastpba, a function-local static shared by all
> SDDR-09 readers and kept across card changes.  The first loop is bounded
> by end, the number of blocks in the zone, but the wrap-around loop only
> by lastpba:
> 
>     for (i = 0; i <= lastpba; i++) {
>             if (info->pba_to_lba[zonestart+i] == UNDEF) {
> 
> After a write to a card with 1024 blocks per zone has left lastpba at,
> say, 700, writing to a 1MB card (256 blocks) whose blocks are all in use
> walks pba_to_lba[] from index 256 to 700.  If any of those out-of-bounds
> words reads as UNDEF, sddr09_write_lba() stores into pba_to_lba[pba]
> and goes on to program that bogus block.
> 
> The bug was found by code inspection and has not been reproduced.
> 
> Fix by also stopping the wrap-around loop at the end of the zone.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-llm-usb-storage-v1-0-d1655e94ed10@linuxfoundation.org?part=5