Commit 24c031db authored by Shichao Lai's avatar Shichao Lai Committed by Jinjiang Tu
Browse files

usb-storage: alauda: Check whether the media is initialized 

mainline inclusion
from mainline-v6.10-rc4
commit 16637fea001ab3c8df528a8995b3211906165a30
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6YQV
CVE: CVE-2024-38619

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=16637fea001ab3c8df528a8995b3211906165a30



--------------------------------

The member "uzonesize" of struct alauda_info will remain 0
if alauda_init_media() fails, potentially causing divide errors
in alauda_read_data() and alauda_write_lba().
- Add a member "media_initialized" to struct alauda_info.
- Change a condition in alauda_check_media() to ensure the
  first initialization.
- Add an error check for the return value of alauda_init_media().

Fixes: e80b0fad ("[PATCH] USB Storage: add alauda support")
Reported-by: default avatarxingwei lee <xrivendell7@gmail.com>
Reported-by: default avataryue sun <samsun1006219@gmail.com>
Reviewed-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarShichao Lai <shichaorai@gmail.com>
Link: https://lore.kernel.org/r/20240526012745.2852061-1-shichaorai@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJinjiang Tu <tujinjiang@huawei.com>
parent f4f92ff0

drivers/usb/storage/alauda.c

+6 −3
Original line number Diff line number Diff line
@@ -105,6 +105,8 @@ struct alauda_info { 
	unsigned char sense_key;

	unsigned long sense_asc;	/* additional sense code */

	unsigned long sense_ascq;	/* additional sense code qualifier */



	bool media_initialized;

};



#define short_pack(lsb,msb) ( ((u16)(lsb)) | ( ((u16)(msb))<<8 ) )
@@ -476,11 +478,12 @@ static int alauda_check_media(struct us_data *us) 
	}



	/* Check for media change */

	if (status[0] & 0x08) {

	if (status[0] & 0x08 || !info->media_initialized) {

		usb_stor_dbg(us, "Media change detected\n");

		alauda_free_maps(&MEDIA_INFO(us));

		alauda_init_media(us);



		rc = alauda_init_media(us);

		if (rc == USB_STOR_TRANSPORT_GOOD)

			info->media_initialized = true;

		info->sense_key = UNIT_ATTENTION;

		info->sense_asc = 0x28;

		info->sense_ascq = 0x00;