[PATCH 3/5] memstick: ms_block: don't erase the old block of an unmapped LBA

[Ho Jie Feng]

msb_update_block() checks for MS_BLOCK_INVALID before it sets the update
flag on the old block, but then erases the old block unconditionally. For
an LBA without a block, this tries to erase block 65535.

msb_erase_block() then calls msb_mark_block_unused() and sets the bit in
erased_blocks_bitmap with pba 65535, so used_blocks_bitmap,
free_block_count[] and erased_blocks_bitmap are accessed out of bounds.

UBSAN reported free_block_count[127] on the int[16] array.

Only erase the old block if there is one.

Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
Signed-off-by: Ho Jie Feng <hjf3108@xxxxxxxxx>
---
 drivers/memstick/core/ms_block.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index cd4ff1b79a6da..e373eaf92530f 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1149,8 +1149,10 @@ static int msb_update_block(struct msb_data *msb, u16 lba,
 		if (error)
 			goto out;
 
-		dbg_verbose("block update: erasing the old block");
-		msb_erase_block(msb, pba);
+		if (pba != MS_BLOCK_INVALID) {
+			dbg_verbose("block update: erasing the old block");
+			msb_erase_block(msb, pba);
+		}
 		msb->lba_to_pba_table[lba] = new_pba;
 		return 0;
 	}
-- 
2.56.0