[PATCH 2/7] usb: storage: ene_ub6250: report boot block errors

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

A Memory Stick whose boot block is rejected by the ENE UB6250 driver,
for instance a hybrid card or a card with an unexpected class, page size
or IDI configuration, crashes the kernel with a NULL pointer
write when it is inserted.

ms_lib_process_bootblock() unconditionally sets result to 0 just before
returning, so every failure is reported as success.  On those failures
the logical maps were either never allocated, or were freed again by
ms_lib_free_logicalmap() at its exit label, so ms_card_init() then
writes through a NULL Phy2LogMap:

    info->MS_Lib.Phy2LogMap[btBlk1st] = MS_LB_BOOT_BLOCK;

It also means the second boot block is never tried when the first one is
bad.

The bug was found by code inspection and has not been reproduced.

Fix by returning the real result from ms_lib_process_bootblock(), so
that ms_card_init() falls back to the second boot block and fails when
neither one is usable.

Fixes: 33842cedfc33 ("Staging: Merge ENE UB6250 MS card codes from keucr to drivers/usb/storage/ene_ub6250.c")
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/storage/ene_ub6250.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 49276ac79402..a5ef1dcf0bc7 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -1064,7 +1064,6 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa
 
 	kfree(PageBuffer);
 
-	result = 0;
 	return result;
 }
 

-- 
2.56.0