Re: [PATCH 6/7] usb: storage: shuttle_usbat: fix READ CD divide by zero

[sashiko-bot@kernel.org]

> From: Josef Bacik <josef@toxicpanda.com>
> 
> A READ CD command of 64KiB or more with a zero transfer length, which
> any user who can open the CD device node may send with SG_IO, oopses
> the kernel with a divide error on an HP 8200e CD-RW behind a USBAT
> bridge.
> 
> usbat_hp8200e_handle_read10() splits large reads into chunks of whole
> sectors and, for READ CD, derives the sector size from the transfer
> length taken from the CDB:
> 
>     srb->transfersize = scsi_bufflen(srb)/len;
> 
> Nothing guarantees that this length is non-zero.  The code right after
> it already falls back to a 2048-byte guess when transfersize is 0.
> 
> The bug was found by code inspection and has not been reproduced.
> 
> Fix by only dividing by a non-zero transfer length and otherwise
> leaving transfersize at 0 so that the existing fallback applies.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-llm-usb-storage-v1-0-d1655e94ed10@linuxfoundation.org?part=6