[PATCH 1/7] usb: storage: ene_ub6250: fail MS init on card errors

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

Inserting a Memory Stick that has no usable boot block, for example a
blank or damaged card, into an ENE UB6250 reader oopses the kernel with
a divide error on the first READ(10).

ene_ms_init() ignores the return value of ms_card_init().  When
ms_card_init() finds no boot block it returns MS_STATUS_ERROR after
ms_lib_free_allocatedarea() has cleared the card geometry and freed the
logical maps, but MS_Status keeps the MS_Ready bit the reader reported,
so ene_transport() goes on to dispatch commands to ms_scsi_irp().  The
first READ(10) from the partition scan then reaches ms_scsi_read():

    logblk  = (u16)(bn / info->MS_Lib.PagesPerBlock);

with PagesPerBlock == 0.  With a non-zero PagesPerBlock the same path
would dereference the freed (NULL) Log2PhyMap instead.

The bug was found by code inspection and has not been reproduced.

Fix by clearing MS_Ready and returning USB_STOR_TRANSPORT_ERROR from
ene_ms_init() when ms_card_init() fails, as is already done when the
reader reports that the card is not ready.

Fixes: 33842cedfc33 ("Staging: Merge ENE UB6250 MS card codes from keucr to drivers/usb/storage/ene_ub6250.c")
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/storage/ene_ub6250.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index a9358e04ab4b..49276ac79402 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -2110,8 +2110,9 @@ static int ene_ms_init(struct us_data *us)
 			MSP_BlockSize      = (bbuf[6] << 8) | bbuf[7];
 			MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
 			info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
-		} else {
-			ms_card_init(us); /* Card is MS (to ms.c)*/
+		} else if (ms_card_init(us)) { /* Card is MS (to ms.c)*/
+			info->MS_Status &= ~MS_Ready;
+			return USB_STOR_TRANSPORT_ERROR;
 		}
 		usb_stor_dbg(us, "MS Init Code OK !!\n");
 	} else {

-- 
2.56.0