[PATCH 6/7] usb: storage: shuttle_usbat: fix READ CD divide by zero

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

A READ CD command of 64KiB or more with a zero transfer length, which
any user who can open the CD device node may send with SG_IO, oopses
the kernel with a divide error on an HP 8200e CD-RW behind a USBAT
bridge.

usbat_hp8200e_handle_read10() splits large reads into chunks of whole
sectors and, for READ CD, derives the sector size from the transfer
length taken from the CDB:

    srb->transfersize = scsi_bufflen(srb)/len;

Nothing guarantees that this length is non-zero.  The code right after
it already falls back to a 2048-byte guess when transfersize is 0.

The bug was found by code inspection and has not been reproduced.

Fix by only dividing by a non-zero transfer length and otherwise
leaving transfersize at 0 so that the existing fallback applies.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/storage/shuttle_usbat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index 7e5424268c73..a1b64b10bbe0 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -1325,7 +1325,7 @@ static int usbat_hp8200e_handle_read10(struct us_data *us,
 		len <<= 16;
 		len |= data[7+7];
 		usb_stor_dbg(us, "GPCMD_READ_CD: len %d\n", len);
-		srb->transfersize = scsi_bufflen(srb)/len;
+		srb->transfersize = len ? scsi_bufflen(srb) / len : 0;
 	}
 
 	if (!srb->transfersize)  {

-- 
2.56.0