* [PATCH] usb: storage: sddr55: Fix a possible null-pointer dereference in sddr55_transport()
@ 2019-07-29 10:05 Jia-Ju Bai
2019-07-29 11:15 ` Oliver Neukum
2019-07-29 14:51 ` kbuild test robot
0 siblings, 2 replies; 4+ messages in thread
From: Jia-Ju Bai @ 2019-07-29 10:05 UTC (permalink / raw)
To: stern, gregkh; +Cc: linux-usb, usb-storage, linux-kernel, Jia-Ju Bai
In sddr55_transport(), there is an if statement on line 836 to check
whether info->lba_to_pba is NULL:
if (info->lba_to_pba == NULL || ...)
When info->lba_to_pba is NULL, it is used on line 948:
pba = info->lba_to_pba[lba];
Thus, a possible null-pointer dereference may occur.
To fix this bug, info->lba_to_pba is checked before being used.
This bug is found by a static analysis tool STCheck written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
---
drivers/usb/storage/sddr55.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
index b8527c55335b..50afc39aa21d 100644
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -945,7 +945,8 @@ static int sddr55_transport(struct scsi_cmnd *srb, struct us_data *us)
return USB_STOR_TRANSPORT_FAILED;
}
- pba = info->lba_to_pba[lba];
+ if (info->lba_to_pba)
+ pba = info->lba_to_pba[lba];
if (srb->cmnd[0] == WRITE_10) {
usb_stor_dbg(us, "WRITE_10: write block %04X (LBA %04X) page %01X pages %d\n",
--
2.17.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: storage: sddr55: Fix a possible null-pointer dereference in sddr55_transport()
2019-07-29 10:05 [PATCH] usb: storage: sddr55: Fix a possible null-pointer dereference in sddr55_transport() Jia-Ju Bai
@ 2019-07-29 11:15 ` Oliver Neukum
2019-07-29 11:44 ` Jia-Ju Bai
2019-07-29 14:51 ` kbuild test robot
1 sibling, 1 reply; 4+ messages in thread
From: Oliver Neukum @ 2019-07-29 11:15 UTC (permalink / raw)
To: Jia-Ju Bai, gregkh, stern; +Cc: usb-storage, linux-kernel, linux-usb
Am Montag, den 29.07.2019, 18:05 +0800 schrieb Jia-Ju Bai:
Hi,
> In sddr55_transport(), there is an if statement on line 836 to check
> whether info->lba_to_pba is NULL:
> if (info->lba_to_pba == NULL || ...)
>
> When info->lba_to_pba is NULL, it is used on line 948:
> pba = info->lba_to_pba[lba];
>
> Thus, a possible null-pointer dereference may occur.
Yes, in practice READ_CAPACITY will always be called and set
up the correct translation table, but you can probably exploit
this.
> To fix this bug, info->lba_to_pba is checked before being used.
>
> This bug is found by a static analysis tool STCheck written by us.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
> ---
> drivers/usb/storage/sddr55.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
> index b8527c55335b..50afc39aa21d 100644
> --- a/drivers/usb/storage/sddr55.c
> +++ b/drivers/usb/storage/sddr55.c
> @@ -945,7 +945,8 @@ static int sddr55_transport(struct scsi_cmnd *srb, struct us_data *us)
> return USB_STOR_TRANSPORT_FAILED;
> }
>
> - pba = info->lba_to_pba[lba];
> + if (info->lba_to_pba)
> + pba = info->lba_to_pba[lba];
If you use that fix, pba will be uninitialized when used. It should be
something like:
pba = info->lba_to_pba ? info->lba_to_pba[lba] : 0;
Regards
Oliver
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: storage: sddr55: Fix a possible null-pointer dereference in sddr55_transport()
2019-07-29 11:15 ` Oliver Neukum
@ 2019-07-29 11:44 ` Jia-Ju Bai
0 siblings, 0 replies; 4+ messages in thread
From: Jia-Ju Bai @ 2019-07-29 11:44 UTC (permalink / raw)
To: Oliver Neukum, gregkh, stern; +Cc: usb-storage, linux-kernel, linux-usb
On 2019/7/29 19:15, Oliver Neukum wrote:
> Am Montag, den 29.07.2019, 18:05 +0800 schrieb Jia-Ju Bai:
>
> Hi,
>
>> In sddr55_transport(), there is an if statement on line 836 to check
>> whether info->lba_to_pba is NULL:
>> if (info->lba_to_pba == NULL || ...)
>>
>> When info->lba_to_pba is NULL, it is used on line 948:
>> pba = info->lba_to_pba[lba];
>>
>> Thus, a possible null-pointer dereference may occur.
> Yes, in practice READ_CAPACITY will always be called and set
> up the correct translation table, but you can probably exploit
> this.
>
>> To fix this bug, info->lba_to_pba is checked before being used.
>>
>> This bug is found by a static analysis tool STCheck written by us.
>>
>> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
>> ---
>> drivers/usb/storage/sddr55.c | 3 ++-
>> 1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c
>> index b8527c55335b..50afc39aa21d 100644
>> --- a/drivers/usb/storage/sddr55.c
>> +++ b/drivers/usb/storage/sddr55.c
>> @@ -945,7 +945,8 @@ static int sddr55_transport(struct scsi_cmnd *srb, struct us_data *us)
>> return USB_STOR_TRANSPORT_FAILED;
>> }
>>
>> - pba = info->lba_to_pba[lba];
>> + if (info->lba_to_pba)
>> + pba = info->lba_to_pba[lba];
> If you use that fix, pba will be uninitialized when used. It should be
> something like:
>
> pba = info->lba_to_pba ? info->lba_to_pba[lba] : 0;
Thanks for the advice.
I will send a v2 patch.
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] usb: storage: sddr55: Fix a possible null-pointer dereference in sddr55_transport()
2019-07-29 10:05 [PATCH] usb: storage: sddr55: Fix a possible null-pointer dereference in sddr55_transport() Jia-Ju Bai
2019-07-29 11:15 ` Oliver Neukum
@ 2019-07-29 14:51 ` kbuild test robot
1 sibling, 0 replies; 4+ messages in thread
From: kbuild test robot @ 2019-07-29 14:51 UTC (permalink / raw)
To: Jia-Ju Bai
Cc: kbuild-all, stern, gregkh, linux-usb, usb-storage, linux-kernel,
Jia-Ju Bai
[-- Attachment #1: Type: text/plain, Size: 20159 bytes --]
Hi Jia-Ju,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on linus/master]
[cannot apply to v5.3-rc2 next-20190729]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url: https://github.com/0day-ci/linux/commits/Jia-Ju-Bai/usb-storage-sddr55-Fix-a-possible-null-pointer-dereference-in-sddr55_transport/20190729-204126
config: x86_64-randconfig-s0-07291935 (attached as .config)
compiler: gcc-7 (Debian 7.4.0-10) 7.4.0
reproduce:
# save the attached .config to linux build tree
make ARCH=x86_64
If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>
Note: it may well be a FALSE warning. FWIW you are at least aware of it now.
http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings
All warnings (new ones prefixed by >>):
drivers/usb/storage/sddr55.c: In function 'sddr55_transport':
>> drivers/usb/storage/sddr55.c:952:4: warning: 'pba' may be used uninitialized in this function [-Wmaybe-uninitialized]
usb_stor_dbg(us, "WRITE_10: write block %04X (LBA %04X) page %01X pages %d\n",
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
pba, lba, page, pages);
~~~~~~~~~~~~~~~~~~~~~~
vim +/pba +952 drivers/usb/storage/sddr55.c
^1da177e4c3f415 Linus Torvalds 2005-04-16 769
^1da177e4c3f415 Linus Torvalds 2005-04-16 770
^1da177e4c3f415 Linus Torvalds 2005-04-16 771 /*
^1da177e4c3f415 Linus Torvalds 2005-04-16 772 * Transport for the Sandisk SDDR-55
^1da177e4c3f415 Linus Torvalds 2005-04-16 773 */
70fcc0050733a7c Alan Stern 2009-02-12 774 static int sddr55_transport(struct scsi_cmnd *srb, struct us_data *us)
^1da177e4c3f415 Linus Torvalds 2005-04-16 775 {
^1da177e4c3f415 Linus Torvalds 2005-04-16 776 int result;
^1da177e4c3f415 Linus Torvalds 2005-04-16 777 static unsigned char inquiry_response[8] = {
^1da177e4c3f415 Linus Torvalds 2005-04-16 778 0x00, 0x80, 0x00, 0x02, 0x1F, 0x00, 0x00, 0x00
^1da177e4c3f415 Linus Torvalds 2005-04-16 779 };
^1da177e4c3f415 Linus Torvalds 2005-04-16 780 // write-protected for now, no block descriptor support
^1da177e4c3f415 Linus Torvalds 2005-04-16 781 static unsigned char mode_page_01[20] = {
^1da177e4c3f415 Linus Torvalds 2005-04-16 782 0x0, 0x12, 0x00, 0x80, 0x0, 0x0, 0x0, 0x0,
^1da177e4c3f415 Linus Torvalds 2005-04-16 783 0x01, 0x0A,
^1da177e4c3f415 Linus Torvalds 2005-04-16 784 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
^1da177e4c3f415 Linus Torvalds 2005-04-16 785 };
^1da177e4c3f415 Linus Torvalds 2005-04-16 786 unsigned char *ptr = us->iobuf;
^1da177e4c3f415 Linus Torvalds 2005-04-16 787 unsigned long capacity;
^1da177e4c3f415 Linus Torvalds 2005-04-16 788 unsigned int lba;
^1da177e4c3f415 Linus Torvalds 2005-04-16 789 unsigned int pba;
^1da177e4c3f415 Linus Torvalds 2005-04-16 790 unsigned int page;
^1da177e4c3f415 Linus Torvalds 2005-04-16 791 unsigned short pages;
^1da177e4c3f415 Linus Torvalds 2005-04-16 792 struct sddr55_card_info *info;
^1da177e4c3f415 Linus Torvalds 2005-04-16 793
^1da177e4c3f415 Linus Torvalds 2005-04-16 794 if (!us->extra) {
887c2560b6ceb5f Oliver Neukum 2006-01-08 795 us->extra = kzalloc(
^1da177e4c3f415 Linus Torvalds 2005-04-16 796 sizeof(struct sddr55_card_info), GFP_NOIO);
^1da177e4c3f415 Linus Torvalds 2005-04-16 797 if (!us->extra)
^1da177e4c3f415 Linus Torvalds 2005-04-16 798 return USB_STOR_TRANSPORT_ERROR;
^1da177e4c3f415 Linus Torvalds 2005-04-16 799 us->extra_destructor = sddr55_card_info_destructor;
^1da177e4c3f415 Linus Torvalds 2005-04-16 800 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 801
^1da177e4c3f415 Linus Torvalds 2005-04-16 802 info = (struct sddr55_card_info *)(us->extra);
^1da177e4c3f415 Linus Torvalds 2005-04-16 803
^1da177e4c3f415 Linus Torvalds 2005-04-16 804 if (srb->cmnd[0] == REQUEST_SENSE) {
191648d03d20229 Joe Perches 2013-04-19 805 usb_stor_dbg(us, "request sense %02x/%02x/%02x\n",
191648d03d20229 Joe Perches 2013-04-19 806 info->sense_data[2],
191648d03d20229 Joe Perches 2013-04-19 807 info->sense_data[12],
191648d03d20229 Joe Perches 2013-04-19 808 info->sense_data[13]);
^1da177e4c3f415 Linus Torvalds 2005-04-16 809
^1da177e4c3f415 Linus Torvalds 2005-04-16 810 memcpy (ptr, info->sense_data, sizeof info->sense_data);
^1da177e4c3f415 Linus Torvalds 2005-04-16 811 ptr[0] = 0x70;
^1da177e4c3f415 Linus Torvalds 2005-04-16 812 ptr[7] = 11;
^1da177e4c3f415 Linus Torvalds 2005-04-16 813 usb_stor_set_xfer_buf (ptr, sizeof info->sense_data, srb);
^1da177e4c3f415 Linus Torvalds 2005-04-16 814 memset (info->sense_data, 0, sizeof info->sense_data);
^1da177e4c3f415 Linus Torvalds 2005-04-16 815
^1da177e4c3f415 Linus Torvalds 2005-04-16 816 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 817 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 818
^1da177e4c3f415 Linus Torvalds 2005-04-16 819 memset (info->sense_data, 0, sizeof info->sense_data);
^1da177e4c3f415 Linus Torvalds 2005-04-16 820
f0183a338e4f90e Felipe Balbi 2016-04-18 821 /*
f0183a338e4f90e Felipe Balbi 2016-04-18 822 * Dummy up a response for INQUIRY since SDDR55 doesn't
f0183a338e4f90e Felipe Balbi 2016-04-18 823 * respond to INQUIRY commands
f0183a338e4f90e Felipe Balbi 2016-04-18 824 */
^1da177e4c3f415 Linus Torvalds 2005-04-16 825
^1da177e4c3f415 Linus Torvalds 2005-04-16 826 if (srb->cmnd[0] == INQUIRY) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 827 memcpy(ptr, inquiry_response, 8);
^1da177e4c3f415 Linus Torvalds 2005-04-16 828 fill_inquiry_response(us, ptr, 36);
^1da177e4c3f415 Linus Torvalds 2005-04-16 829 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 830 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 831
f0183a338e4f90e Felipe Balbi 2016-04-18 832 /*
f0183a338e4f90e Felipe Balbi 2016-04-18 833 * only check card status if the map isn't allocated, ie no card seen yet
^1da177e4c3f415 Linus Torvalds 2005-04-16 834 * or if it's been over half a second since we last accessed it
^1da177e4c3f415 Linus Torvalds 2005-04-16 835 */
^1da177e4c3f415 Linus Torvalds 2005-04-16 836 if (info->lba_to_pba == NULL || time_after(jiffies, info->last_access + HZ/2)) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 837
^1da177e4c3f415 Linus Torvalds 2005-04-16 838 /* check to see if a card is fitted */
^1da177e4c3f415 Linus Torvalds 2005-04-16 839 result = sddr55_status (us);
^1da177e4c3f415 Linus Torvalds 2005-04-16 840 if (result) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 841 result = sddr55_status (us);
^1da177e4c3f415 Linus Torvalds 2005-04-16 842 if (!result) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 843 set_sense_info (6, 0x28, 0); /* new media, set unit attention, not ready to ready */
^1da177e4c3f415 Linus Torvalds 2005-04-16 844 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 845 return USB_STOR_TRANSPORT_FAILED;
^1da177e4c3f415 Linus Torvalds 2005-04-16 846 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 847 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 848
f0183a338e4f90e Felipe Balbi 2016-04-18 849 /*
f0183a338e4f90e Felipe Balbi 2016-04-18 850 * if we detected a problem with the map when writing,
f0183a338e4f90e Felipe Balbi 2016-04-18 851 * don't allow any more access
f0183a338e4f90e Felipe Balbi 2016-04-18 852 */
^1da177e4c3f415 Linus Torvalds 2005-04-16 853 if (info->fatal_error) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 854
^1da177e4c3f415 Linus Torvalds 2005-04-16 855 set_sense_info (3, 0x31, 0);
^1da177e4c3f415 Linus Torvalds 2005-04-16 856 return USB_STOR_TRANSPORT_FAILED;
^1da177e4c3f415 Linus Torvalds 2005-04-16 857 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 858
^1da177e4c3f415 Linus Torvalds 2005-04-16 859 if (srb->cmnd[0] == READ_CAPACITY) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 860
^1da177e4c3f415 Linus Torvalds 2005-04-16 861 capacity = sddr55_get_capacity(us);
^1da177e4c3f415 Linus Torvalds 2005-04-16 862
^1da177e4c3f415 Linus Torvalds 2005-04-16 863 if (!capacity) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 864 set_sense_info (3, 0x30, 0); /* incompatible medium */
^1da177e4c3f415 Linus Torvalds 2005-04-16 865 return USB_STOR_TRANSPORT_FAILED;
^1da177e4c3f415 Linus Torvalds 2005-04-16 866 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 867
^1da177e4c3f415 Linus Torvalds 2005-04-16 868 info->capacity = capacity;
^1da177e4c3f415 Linus Torvalds 2005-04-16 869
f0183a338e4f90e Felipe Balbi 2016-04-18 870 /*
f0183a338e4f90e Felipe Balbi 2016-04-18 871 * figure out the maximum logical block number, allowing for
f0183a338e4f90e Felipe Balbi 2016-04-18 872 * the fact that only 250 out of every 256 are used
f0183a338e4f90e Felipe Balbi 2016-04-18 873 */
^1da177e4c3f415 Linus Torvalds 2005-04-16 874 info->max_log_blks = ((info->capacity >> (info->pageshift + info->blockshift)) / 256) * 250;
^1da177e4c3f415 Linus Torvalds 2005-04-16 875
f0183a338e4f90e Felipe Balbi 2016-04-18 876 /*
f0183a338e4f90e Felipe Balbi 2016-04-18 877 * Last page in the card, adjust as we only use 250 out of
f0183a338e4f90e Felipe Balbi 2016-04-18 878 * every 256 pages
f0183a338e4f90e Felipe Balbi 2016-04-18 879 */
^1da177e4c3f415 Linus Torvalds 2005-04-16 880 capacity = (capacity / 256) * 250;
^1da177e4c3f415 Linus Torvalds 2005-04-16 881
^1da177e4c3f415 Linus Torvalds 2005-04-16 882 capacity /= PAGESIZE;
^1da177e4c3f415 Linus Torvalds 2005-04-16 883 capacity--;
^1da177e4c3f415 Linus Torvalds 2005-04-16 884
^1da177e4c3f415 Linus Torvalds 2005-04-16 885 ((__be32 *) ptr)[0] = cpu_to_be32(capacity);
^1da177e4c3f415 Linus Torvalds 2005-04-16 886 ((__be32 *) ptr)[1] = cpu_to_be32(PAGESIZE);
^1da177e4c3f415 Linus Torvalds 2005-04-16 887 usb_stor_set_xfer_buf(ptr, 8, srb);
^1da177e4c3f415 Linus Torvalds 2005-04-16 888
^1da177e4c3f415 Linus Torvalds 2005-04-16 889 sddr55_read_map(us);
^1da177e4c3f415 Linus Torvalds 2005-04-16 890
^1da177e4c3f415 Linus Torvalds 2005-04-16 891 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 892 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 893
^1da177e4c3f415 Linus Torvalds 2005-04-16 894 if (srb->cmnd[0] == MODE_SENSE_10) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 895
^1da177e4c3f415 Linus Torvalds 2005-04-16 896 memcpy(ptr, mode_page_01, sizeof mode_page_01);
^1da177e4c3f415 Linus Torvalds 2005-04-16 897 ptr[3] = (info->read_only || info->force_read_only) ? 0x80 : 0;
^1da177e4c3f415 Linus Torvalds 2005-04-16 898 usb_stor_set_xfer_buf(ptr, sizeof(mode_page_01), srb);
^1da177e4c3f415 Linus Torvalds 2005-04-16 899
^1da177e4c3f415 Linus Torvalds 2005-04-16 900 if ( (srb->cmnd[2] & 0x3F) == 0x01 ) {
191648d03d20229 Joe Perches 2013-04-19 901 usb_stor_dbg(us, "Dummy up request for mode page 1\n");
^1da177e4c3f415 Linus Torvalds 2005-04-16 902 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 903
^1da177e4c3f415 Linus Torvalds 2005-04-16 904 } else if ( (srb->cmnd[2] & 0x3F) == 0x3F ) {
191648d03d20229 Joe Perches 2013-04-19 905 usb_stor_dbg(us, "Dummy up request for all mode pages\n");
^1da177e4c3f415 Linus Torvalds 2005-04-16 906 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 907 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 908
^1da177e4c3f415 Linus Torvalds 2005-04-16 909 set_sense_info (5, 0x24, 0); /* invalid field in command */
^1da177e4c3f415 Linus Torvalds 2005-04-16 910 return USB_STOR_TRANSPORT_FAILED;
^1da177e4c3f415 Linus Torvalds 2005-04-16 911 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 912
^1da177e4c3f415 Linus Torvalds 2005-04-16 913 if (srb->cmnd[0] == ALLOW_MEDIUM_REMOVAL) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 914
191648d03d20229 Joe Perches 2013-04-19 915 usb_stor_dbg(us, "%s medium removal. Not that I can do anything about it...\n",
^1da177e4c3f415 Linus Torvalds 2005-04-16 916 (srb->cmnd[4]&0x03) ? "Prevent" : "Allow");
^1da177e4c3f415 Linus Torvalds 2005-04-16 917
^1da177e4c3f415 Linus Torvalds 2005-04-16 918 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 919
^1da177e4c3f415 Linus Torvalds 2005-04-16 920 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 921
^1da177e4c3f415 Linus Torvalds 2005-04-16 922 if (srb->cmnd[0] == READ_10 || srb->cmnd[0] == WRITE_10) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 923
^1da177e4c3f415 Linus Torvalds 2005-04-16 924 page = short_pack(srb->cmnd[3], srb->cmnd[2]);
^1da177e4c3f415 Linus Torvalds 2005-04-16 925 page <<= 16;
^1da177e4c3f415 Linus Torvalds 2005-04-16 926 page |= short_pack(srb->cmnd[5], srb->cmnd[4]);
^1da177e4c3f415 Linus Torvalds 2005-04-16 927 pages = short_pack(srb->cmnd[8], srb->cmnd[7]);
^1da177e4c3f415 Linus Torvalds 2005-04-16 928
^1da177e4c3f415 Linus Torvalds 2005-04-16 929 page <<= info->smallpageshift;
^1da177e4c3f415 Linus Torvalds 2005-04-16 930
^1da177e4c3f415 Linus Torvalds 2005-04-16 931 // convert page to block and page-within-block
^1da177e4c3f415 Linus Torvalds 2005-04-16 932
^1da177e4c3f415 Linus Torvalds 2005-04-16 933 lba = page >> info->blockshift;
^1da177e4c3f415 Linus Torvalds 2005-04-16 934 page = page & info->blockmask;
^1da177e4c3f415 Linus Torvalds 2005-04-16 935
^1da177e4c3f415 Linus Torvalds 2005-04-16 936 // locate physical block corresponding to logical block
^1da177e4c3f415 Linus Torvalds 2005-04-16 937
^1da177e4c3f415 Linus Torvalds 2005-04-16 938 if (lba >= info->max_log_blks) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 939
191648d03d20229 Joe Perches 2013-04-19 940 usb_stor_dbg(us, "Error: Requested LBA %04X exceeds maximum block %04X\n",
191648d03d20229 Joe Perches 2013-04-19 941 lba, info->max_log_blks - 1);
^1da177e4c3f415 Linus Torvalds 2005-04-16 942
^1da177e4c3f415 Linus Torvalds 2005-04-16 943 set_sense_info (5, 0x24, 0); /* invalid field in command */
^1da177e4c3f415 Linus Torvalds 2005-04-16 944
^1da177e4c3f415 Linus Torvalds 2005-04-16 945 return USB_STOR_TRANSPORT_FAILED;
^1da177e4c3f415 Linus Torvalds 2005-04-16 946 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 947
09c020225d3b3bd Jia-Ju Bai 2019-07-29 948 if (info->lba_to_pba)
^1da177e4c3f415 Linus Torvalds 2005-04-16 949 pba = info->lba_to_pba[lba];
^1da177e4c3f415 Linus Torvalds 2005-04-16 950
^1da177e4c3f415 Linus Torvalds 2005-04-16 951 if (srb->cmnd[0] == WRITE_10) {
191648d03d20229 Joe Perches 2013-04-19 @952 usb_stor_dbg(us, "WRITE_10: write block %04X (LBA %04X) page %01X pages %d\n",
^1da177e4c3f415 Linus Torvalds 2005-04-16 953 pba, lba, page, pages);
^1da177e4c3f415 Linus Torvalds 2005-04-16 954
^1da177e4c3f415 Linus Torvalds 2005-04-16 955 return sddr55_write_data(us, lba, page, pages);
^1da177e4c3f415 Linus Torvalds 2005-04-16 956 } else {
191648d03d20229 Joe Perches 2013-04-19 957 usb_stor_dbg(us, "READ_10: read block %04X (LBA %04X) page %01X pages %d\n",
^1da177e4c3f415 Linus Torvalds 2005-04-16 958 pba, lba, page, pages);
^1da177e4c3f415 Linus Torvalds 2005-04-16 959
^1da177e4c3f415 Linus Torvalds 2005-04-16 960 return sddr55_read_data(us, lba, page, pages);
^1da177e4c3f415 Linus Torvalds 2005-04-16 961 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 962 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 963
^1da177e4c3f415 Linus Torvalds 2005-04-16 964
^1da177e4c3f415 Linus Torvalds 2005-04-16 965 if (srb->cmnd[0] == TEST_UNIT_READY) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 966 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 967 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 968
^1da177e4c3f415 Linus Torvalds 2005-04-16 969 if (srb->cmnd[0] == START_STOP) {
^1da177e4c3f415 Linus Torvalds 2005-04-16 970 return USB_STOR_TRANSPORT_GOOD;
^1da177e4c3f415 Linus Torvalds 2005-04-16 971 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 972
^1da177e4c3f415 Linus Torvalds 2005-04-16 973 set_sense_info (5, 0x20, 0); /* illegal command */
^1da177e4c3f415 Linus Torvalds 2005-04-16 974
^1da177e4c3f415 Linus Torvalds 2005-04-16 975 return USB_STOR_TRANSPORT_FAILED; // FIXME: sense buffer?
^1da177e4c3f415 Linus Torvalds 2005-04-16 976 }
^1da177e4c3f415 Linus Torvalds 2005-04-16 977
aa519be34f45954 Akinobu Mita 2015-05-06 978 static struct scsi_host_template sddr55_host_template;
70fcc0050733a7c Alan Stern 2009-02-12 979
70fcc0050733a7c Alan Stern 2009-02-12 980 static int sddr55_probe(struct usb_interface *intf,
70fcc0050733a7c Alan Stern 2009-02-12 981 const struct usb_device_id *id)
70fcc0050733a7c Alan Stern 2009-02-12 982 {
70fcc0050733a7c Alan Stern 2009-02-12 983 struct us_data *us;
70fcc0050733a7c Alan Stern 2009-02-12 984 int result;
70fcc0050733a7c Alan Stern 2009-02-12 985
70fcc0050733a7c Alan Stern 2009-02-12 986 result = usb_stor_probe1(&us, intf, id,
aa519be34f45954 Akinobu Mita 2015-05-06 987 (id - sddr55_usb_ids) + sddr55_unusual_dev_list,
aa519be34f45954 Akinobu Mita 2015-05-06 988 &sddr55_host_template);
70fcc0050733a7c Alan Stern 2009-02-12 989 if (result)
70fcc0050733a7c Alan Stern 2009-02-12 990 return result;
70fcc0050733a7c Alan Stern 2009-02-12 991
70fcc0050733a7c Alan Stern 2009-02-12 992 us->transport_name = "SDDR55";
70fcc0050733a7c Alan Stern 2009-02-12 993 us->transport = sddr55_transport;
70fcc0050733a7c Alan Stern 2009-02-12 994 us->transport_reset = sddr55_reset;
70fcc0050733a7c Alan Stern 2009-02-12 995 us->max_lun = 0;
70fcc0050733a7c Alan Stern 2009-02-12 996
70fcc0050733a7c Alan Stern 2009-02-12 997 result = usb_stor_probe2(us);
70fcc0050733a7c Alan Stern 2009-02-12 998 return result;
70fcc0050733a7c Alan Stern 2009-02-12 999 }
70fcc0050733a7c Alan Stern 2009-02-12 1000
70fcc0050733a7c Alan Stern 2009-02-12 1001 static struct usb_driver sddr55_driver = {
aa519be34f45954 Akinobu Mita 2015-05-06 1002 .name = DRV_NAME,
70fcc0050733a7c Alan Stern 2009-02-12 1003 .probe = sddr55_probe,
70fcc0050733a7c Alan Stern 2009-02-12 1004 .disconnect = usb_stor_disconnect,
70fcc0050733a7c Alan Stern 2009-02-12 1005 .suspend = usb_stor_suspend,
70fcc0050733a7c Alan Stern 2009-02-12 1006 .resume = usb_stor_resume,
70fcc0050733a7c Alan Stern 2009-02-12 1007 .reset_resume = usb_stor_reset_resume,
70fcc0050733a7c Alan Stern 2009-02-12 1008 .pre_reset = usb_stor_pre_reset,
70fcc0050733a7c Alan Stern 2009-02-12 1009 .post_reset = usb_stor_post_reset,
70fcc0050733a7c Alan Stern 2009-02-12 1010 .id_table = sddr55_usb_ids,
70fcc0050733a7c Alan Stern 2009-02-12 1011 .soft_unbind = 1,
e73b2db6c9bc5bd Huajun Li 2012-01-14 1012 .no_dynamic_id = 1,
70fcc0050733a7c Alan Stern 2009-02-12 1013 };
70fcc0050733a7c Alan Stern 2009-02-12 1014
aa519be34f45954 Akinobu Mita 2015-05-06 1015 module_usb_stor_driver(sddr55_driver, sddr55_host_template, DRV_NAME);
:::::: The code at line 952 was first introduced by commit
:::::: 191648d03d20229523d9a75b8abef56421298d28 usb: storage: Convert US_DEBUGP to usb_stor_dbg
:::::: TO: Joe Perches <joe@perches.com>
:::::: CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
0-DAY kernel test infrastructure Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all Intel Corporation
[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 36087 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-07-29 15:59 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-07-29 10:05 [PATCH] usb: storage: sddr55: Fix a possible null-pointer dereference in sddr55_transport() Jia-Ju Bai
2019-07-29 11:15 ` Oliver Neukum
2019-07-29 11:44 ` Jia-Ju Bai
2019-07-29 14:51 ` kbuild test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).