Re: [PATCH 3/7] usb: storage: ene_ub6250: fix write to unmapped MS block

[sashiko-bot@kernel.org]

> From: Josef Bacik <josef@toxicpanda.com>
> 
> Writing to a logical block of a Memory Stick that has no physical block
> assigned yet makes the ENE UB6250 driver write two bytes far past the
> end of its Phy2LogMap allocation.
> 
> ms_scsi_write() looks up the current physical block of each logical
> block with ms_libconv_to_physical().  For a logical block that no
> physical block claimed during the scan, Log2PhyMap holds MS_LB_NOT_USED
> (0xffff), and for a logical block beyond NumberOfLogBlock the macro
> returns MS_STATUS_ERROR (0xfffe).  After copying the data to the new
> block, the old one is marked as erased without any check:
> 
>     info->MS_Lib.Phy2LogMap[oldphy] = MS_LB_NOT_USED_ERASED;
> 
> which, for those values, stores 0xfff5 about 128KiB past the start of
> an array that holds only NumberOfPhyBlock entries.  Unassigned logical
> blocks are normal on a card that has not been completely written, and
> the card contents are under the control of whoever supplies the card
> or the reader.
> 
> The bug was found by code inspection and has not been reproduced.
> 
> Fix by only marking the old physical block as erased when it is a valid
> physical block number.
> 
> Fixes: 33842cedfc33 ("Staging: Merge ENE UB6250 MS card codes from keucr to drivers/usb/storage/ene_ub6250.c")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-llm-usb-storage-v1-0-d1655e94ed10@linuxfoundation.org?part=3