[PATCH] usb: storage: alauda: check return value of alauda_ensure_map_for_zone()

[PATCH] usb: storage: alauda: check return value of alauda_ensure_map_for_zone()

[Rohinthan P]

In alauda_read_data() and alauda_write_lba(), the driver calls
alauda_ensure_map_for_zone() to initialize the LBA-to-PBA block mapping
for a zone before accessing MEDIA_INFO(us).lba_to_pba[zone][lba_offset].

However, alauda_ensure_map_for_zone() returns void and ignores the
return value of alauda_read_map(). If reading the block map fails (e.g.
due to I/O error or device disconnection),
MEDIA_INFO(us).lba_to_pba[zone] remains NULL. The caller then
dereferences MEDIA_INFO(us).lba_to_pba[zone], causing a general
protection fault / NULL pointer dereference:

    Oops: general protection fault
    KASAN: null-ptr-deref in range
    [0x0000000000000000-0x0000000000000007]
    RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:972

In addition, alauda_read_data() checked lba >= max_lba after calling
alauda_ensure_map_for_zone(), which could compute an out-of-bounds zone
index.

Make alauda_ensure_map_for_zone() return an error code and verify that
the zone mapping pointers are non-NULL. Check its return value in both
alauda_read_data() and alauda_write_lba(), and move the capacity
overflow check in alauda_read_data() before calling
alauda_ensure_map_for_zone().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+ccc9a7cb39fa1af827ea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ccc9a7cb39fa1af827ea
Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
---
 drivers/usb/storage/alauda.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
index 691fe47..da4964e 100644
--- a/drivers/usb/storage/alauda.c
+++ b/drivers/usb/storage/alauda.c
@@ -689,11 +689,25 @@ static int alauda_read_map(struct us_data *us, unsigned int zone)
  * Checks to see whether we have already mapped a certain zone
  * If we haven't, the map is generated
  */
-static void alauda_ensure_map_for_zone(struct us_data *us, unsigned int zone)
+static int alauda_ensure_map_for_zone(struct us_data *us, unsigned int zone)
 {
+	int rc = USB_STOR_TRANSPORT_GOOD;
+
+	if (!MEDIA_INFO(us).lba_to_pba || !MEDIA_INFO(us).pba_to_lba)
+		return USB_STOR_TRANSPORT_ERROR;
+
+	if (MEDIA_INFO(us).lba_to_pba[zone] == NULL
+		|| MEDIA_INFO(us).pba_to_lba[zone] == NULL) {
+		rc = alauda_read_map(us, zone);
+		if (rc != USB_STOR_TRANSPORT_GOOD)
+			return rc;
+	}
+
 	if (MEDIA_INFO(us).lba_to_pba[zone] == NULL
 		|| MEDIA_INFO(us).pba_to_lba[zone] == NULL)
-		alauda_read_map(us, zone);
+		return USB_STOR_TRANSPORT_ERROR;
+
+	return USB_STOR_TRANSPORT_GOOD;
 }
 
 /*
@@ -823,7 +837,9 @@ static int alauda_write_lba(struct us_data *us, u16 lba,
 	unsigned int new_pba_offset;
 	unsigned int zone = lba / uzonesize;
 
-	alauda_ensure_map_for_zone(us, zone);
+	result = alauda_ensure_map_for_zone(us, zone);
+	if (result != USB_STOR_TRANSPORT_GOOD)
+		return result;
 
 	pba = MEDIA_INFO(us).lba_to_pba[zone][lba_offset];
 	if (pba == 1) {
@@ -954,8 +970,6 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
 		unsigned int lba_offset = lba - (zone * uzonesize);
 		unsigned int pages;
 		u16 pba;
-		alauda_ensure_map_for_zone(us, zone);
-
 		/* Not overflowing capacity? */
 		if (lba >= max_lba) {
 			usb_stor_dbg(us, "Error: Requested lba %u exceeds maximum %u\n",
@@ -964,6 +978,10 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
 			break;
 		}
 
+		result = alauda_ensure_map_for_zone(us, zone);
+		if (result != USB_STOR_TRANSPORT_GOOD)
+			break;
+
 		/* Find number of pages we can read in this block */
 		pages = min(sectors, blocksize - page);
 		len = pages << pageshift;
-- 
2.53.0

Re: [PATCH] usb: storage: alauda: check return value of alauda_ensure_map_for_zone()

[Alan Stern]

On Wed, Sep 23, 2026 at 12:00:08PM +0530, Rohinthan P wrote:
> In alauda_read_data() and alauda_write_lba(), the driver calls
> alauda_ensure_map_for_zone() to initialize the LBA-to-PBA block mapping
> for a zone before accessing MEDIA_INFO(us).lba_to_pba[zone][lba_offset].
> 
> However, alauda_ensure_map_for_zone() returns void and ignores the
> return value of alauda_read_map(). If reading the block map fails (e.g.
> due to I/O error or device disconnection),
> MEDIA_INFO(us).lba_to_pba[zone] remains NULL. The caller then
> dereferences MEDIA_INFO(us).lba_to_pba[zone], causing a general
> protection fault / NULL pointer dereference:
> 
>     Oops: general protection fault
>     KASAN: null-ptr-deref in range
>     [0x0000000000000000-0x0000000000000007]
>     RIP: 0010:alauda_read_data drivers/usb/storage/alauda.c:972
> 
> In addition, alauda_read_data() checked lba >= max_lba after calling
> alauda_ensure_map_for_zone(), which could compute an out-of-bounds zone
> index.
> 
> Make alauda_ensure_map_for_zone() return an error code and verify that
> the zone mapping pointers are non-NULL. Check its return value in both
> alauda_read_data() and alauda_write_lba(), and move the capacity
> overflow check in alauda_read_data() before calling
> alauda_ensure_map_for_zone().
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+ccc9a7cb39fa1af827ea@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ccc9a7cb39fa1af827ea
> Signed-off-by: Rohinthan P <rokinthanp03@gmail.com>
> ---

Doesn't this do essentially the same thing as

https://lore.kernel.org/linux-usb/20260901065831.43567-3-arka@arkamondal.net/

which was posted three weeks ago?

Alan Stern

>  drivers/usb/storage/alauda.c | 28 +++++++++++++++++++++++-----
>  1 file changed, 23 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c
> index 691fe47..da4964e 100644
> --- a/drivers/usb/storage/alauda.c
> +++ b/drivers/usb/storage/alauda.c
> @@ -689,11 +689,25 @@ static int alauda_read_map(struct us_data *us, unsigned int zone)
>   * Checks to see whether we have already mapped a certain zone
>   * If we haven't, the map is generated
>   */
> -static void alauda_ensure_map_for_zone(struct us_data *us, unsigned int zone)
> +static int alauda_ensure_map_for_zone(struct us_data *us, unsigned int zone)
>  {
> +	int rc = USB_STOR_TRANSPORT_GOOD;
> +
> +	if (!MEDIA_INFO(us).lba_to_pba || !MEDIA_INFO(us).pba_to_lba)
> +		return USB_STOR_TRANSPORT_ERROR;
> +
> +	if (MEDIA_INFO(us).lba_to_pba[zone] == NULL
> +		|| MEDIA_INFO(us).pba_to_lba[zone] == NULL) {
> +		rc = alauda_read_map(us, zone);
> +		if (rc != USB_STOR_TRANSPORT_GOOD)
> +			return rc;
> +	}
> +
>  	if (MEDIA_INFO(us).lba_to_pba[zone] == NULL
>  		|| MEDIA_INFO(us).pba_to_lba[zone] == NULL)
> -		alauda_read_map(us, zone);
> +		return USB_STOR_TRANSPORT_ERROR;
> +
> +	return USB_STOR_TRANSPORT_GOOD;
>  }
>  
>  /*
> @@ -823,7 +837,9 @@ static int alauda_write_lba(struct us_data *us, u16 lba,
>  	unsigned int new_pba_offset;
>  	unsigned int zone = lba / uzonesize;
>  
> -	alauda_ensure_map_for_zone(us, zone);
> +	result = alauda_ensure_map_for_zone(us, zone);
> +	if (result != USB_STOR_TRANSPORT_GOOD)
> +		return result;
>  
>  	pba = MEDIA_INFO(us).lba_to_pba[zone][lba_offset];
>  	if (pba == 1) {
> @@ -954,8 +970,6 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
>  		unsigned int lba_offset = lba - (zone * uzonesize);
>  		unsigned int pages;
>  		u16 pba;
> -		alauda_ensure_map_for_zone(us, zone);
> -
>  		/* Not overflowing capacity? */
>  		if (lba >= max_lba) {
>  			usb_stor_dbg(us, "Error: Requested lba %u exceeds maximum %u\n",
> @@ -964,6 +978,10 @@ static int alauda_read_data(struct us_data *us, unsigned long address,
>  			break;
>  		}
>  
> +		result = alauda_ensure_map_for_zone(us, zone);
> +		if (result != USB_STOR_TRANSPORT_GOOD)
> +			break;
> +
>  		/* Find number of pages we can read in this block */
>  		pages = min(sectors, blocksize - page);
>  		len = pages << pageshift;
> -- 
> 2.53.0
>