[PATCH 5/7] usb: storage: sddr09: bound the unused PBA search

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

sddr09_find_unused_pba() can read past the end of pba_to_lba[] and hand
out a physical block that does not exist on the card, which is then
recorded in pba_to_lba[] past its end and written to.

The search resumes from lastpba, a function-local static shared by all
SDDR-09 readers and kept across card changes.  The first loop is bounded
by end, the number of blocks in the zone, but the wrap-around loop only
by lastpba:

    for (i = 0; i <= lastpba; i++) {
            if (info->pba_to_lba[zonestart+i] == UNDEF) {

After a write to a card with 1024 blocks per zone has left lastpba at,
say, 700, writing to a 1MB card (256 blocks) whose blocks are all in use
walks pba_to_lba[] from index 256 to 700.  If any of those out-of-bounds
words reads as UNDEF, sddr09_write_lba() stores into pba_to_lba[pba]
and goes on to program that bogus block.

The bug was found by code inspection and has not been reproduced.

Fix by also stopping the wrap-around loop at the end of the zone.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/storage/sddr09.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/sddr09.c b/drivers/usb/storage/sddr09.c
index 313313508bde..44197a3a545b 100644
--- a/drivers/usb/storage/sddr09.c
+++ b/drivers/usb/storage/sddr09.c
@@ -838,7 +838,7 @@ sddr09_find_unused_pba(struct sddr09_card_info *info, unsigned int lba) {
 			return zonestart+i;
 		}
 	}
-	for (i = 0; i <= lastpba; i++) {
+	for (i = 0; i <= lastpba && i < end; i++) {
 		if (info->pba_to_lba[zonestart+i] == UNDEF) {
 			lastpba = i;
 			return zonestart+i;

-- 
2.56.0