[PATCH 3/7] usb: storage: ene_ub6250: fix write to unmapped MS block

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Josef Bacik <josef@toxicpanda.com>

Writing to a logical block of a Memory Stick that has no physical block
assigned yet makes the ENE UB6250 driver write two bytes far past the
end of its Phy2LogMap allocation.

ms_scsi_write() looks up the current physical block of each logical
block with ms_libconv_to_physical().  For a logical block that no
physical block claimed during the scan, Log2PhyMap holds MS_LB_NOT_USED
(0xffff), and for a logical block beyond NumberOfLogBlock the macro
returns MS_STATUS_ERROR (0xfffe).  After copying the data to the new
block, the old one is marked as erased without any check:

    info->MS_Lib.Phy2LogMap[oldphy] = MS_LB_NOT_USED_ERASED;

which, for those values, stores 0xfff5 about 128KiB past the start of
an array that holds only NumberOfPhyBlock entries.  Unassigned logical
blocks are normal on a card that has not been completely written, and
the card contents are under the control of whoever supplies the card
or the reader.

The bug was found by code inspection and has not been reproduced.

Fix by only marking the old physical block as erased when it is a valid
physical block number.

Fixes: 33842cedfc33 ("Staging: Merge ENE UB6250 MS card codes from keucr to drivers/usb/storage/ene_ub6250.c")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/ene_ub6250.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index a5ef1dcf0bc7..bce593730187 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -1805,7 +1805,8 @@ static int ms_scsi_write(struct us_data *us, struct scsi_cmnd *srb)
 				goto exit;
 			}
 
-			info->MS_Lib.Phy2LogMap[oldphy] = MS_LB_NOT_USED_ERASED;
+			if (oldphy < info->MS_Lib.NumberOfPhyBlock)
+				info->MS_Lib.Phy2LogMap[oldphy] = MS_LB_NOT_USED_ERASED;
 			ms_lib_force_setlogical_pair(us, PhyBlockAddr, newphy);
 
 			blen -= len;

-- 
2.56.0