[PATCH] usb: storage: alauda: check return value of alauda_ensure_map_for_zone()

[Rohinthan P]

In alauda_read_data() and alauda_write_lba(), the driver calls
alauda_ensure_map_for_zone() to initialize the LBA-to-PBA block mapping
for a zone before accessing MEDIA_INFO(us).lba_to_pba[zone][lba_offset].

However, alauda_ensure_map_for_zone() returns void and ignores the
return value of alauda_read_map(). If reading the block map fails (e.g.
due to I/O error or device disconnection),
MEDIA_INFO(us).lba_to_pba[zone] remains NULL. The caller then
dereferences MEDIA_INFO(us).lba_to_pba[zone], causing a general
protection fault / NULL pointer dereference:

    Oops: general protection fault
    KASAN: null-ptr-deref in range
    [0x0000000000000000-0x0000000000000007]
    RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:972

In addition, alauda_read_data() checked lba >= max_lba after calling
alauda_ensure_map_for_zone(), which could compute an out-of-bounds zone
index.

Make alauda_ensure_map_for_zone() return an error code and verify that
the zone mapping pointers are non-NULL. Check its return value in both
alauda_read_data() and alauda_write_lba(), and move the capacity
overflow check in alauda_read_data() before calling
alauda_ensure_map_for_zone().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+ccc9a7cb39fa1af827ea@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=ccc9a7cb39fa1af827ea
Signed-off-by: Rohinthan P <rokinthanp03@xxxxxxxxx>
---
 drivers/usb/storage/alauda.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 691fe47..da4964e 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -689,11 +689,25 @@ static int alauda_read_map(struct us_data *us, unsigned int zone)
  * Checks to see whether we have already mapped a certain zone
  * If we haven't, the map is generated
  */
-static void alauda_ensure_map_for_zone(struct us_data *us, unsigned int zone)
+static int alauda_ensure_map_for_zone(struct us_data *us, unsigned int zone)
 {
+	int rc = USB_STOR_TRANSPORT_GOOD;
+
+	if (!MEDIA_INFO(us).lba_to_pba || !MEDIA_INFO(us).pba_to_lba)
+		return USB_STOR_TRANSPORT_ERROR;
+
+	if (MEDIA_INFO(us).lba_to_pba[zone] == NULL
+		|| MEDIA_INFO(us).pba_to_lba[zone] == NULL) {
+		rc = alauda_read_map(us, zone);
+		if (rc != USB_STOR_TRANSPORT_GOOD)
+			return rc;
+	}
+
 	if (MEDIA_INFO(us).lba_to_pba[zone] == NULL
 		|| MEDIA_INFO(us).pba_to_lba[zone] == NULL)
-		alauda_read_map(us, zone);
+		return USB_STOR_TRANSPORT_ERROR;
+
+	return USB_STOR_TRANSPORT_GOOD;
 }
 
 /*
@@ -823,7 +837,9 @@ static int alauda_write_lba(struct us_data *us, u16 lba,
 	unsigned int new_pba_offset;
 	unsigned int zone = lba / uzonesize;
 
-	alauda_ensure_map_for_zone(us, zone);
+	result = alauda_ensure_map_for_zone(us, zone);
+	if (result != USB_STOR_TRANSPORT_GOOD)
+		return result;
 
 	pba = MEDIA_INFO(us).lba_to_pba[zone][lba_offset];
 	if (pba == 1) {
@@ -954,8 +970,6 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
 		unsigned int lba_offset = lba - (zone * uzonesize);
 		unsigned int pages;
 		u16 pba;
-		alauda_ensure_map_for_zone(us, zone);
-
 		/* Not overflowing capacity? */
 		if (lba >= max_lba) {
 			usb_stor_dbg(us, "Error: Requested lba %u exceeds maximum %u\n",
@@ -964,6 +978,10 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
 			break;
 		}
 
+		result = alauda_ensure_map_for_zone(us, zone);
+		if (result != USB_STOR_TRANSPORT_GOOD)
+			break;
+
 		/* Find number of pages we can read in this block */
 		pages = min(sectors, blocksize - page);
 		len = pages << pageshift;
-- 
2.53.0