[PATCH 4/7] usb: storage: ene_ub6250: bound the disabled block walk

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Josef Bacik <josef@toxicpanda.com>

When two physical blocks of a Memory Stick both claim logical block 0,
which happens after an interrupted update of that block or on a crafted
card, the ENE UB6250 driver can spin forever in the usb-storage thread
while reading through 64KiB past a 512-byte buffer, over and over.

ms_lib_check_disableblock() reads page 1 of the boot block, which holds
the disabled block table: big-endian 16-bit block numbers terminated by
0xffff, the same table ms_lib_process_bootblock() parses with
be16_to_cpu() on 16-bit entries.  The walk, however, indexes the buffer
as unsigned char and has no upper bound:

    blk = be16_to_cpu(PageBuf[index]);
    if (blk == MS_LB_NOT_USED)
            break;

A byte converted this way can never equal 0xffff, so the loop only ends
if some byte happens to match Log2PhyMap[0].  Otherwise the u16 index
runs through the 64KiB following the kmalloc()ed page and wraps around,
forever.

The bug was found by code inspection and has not been reproduced.

Fix by walking the table as 16-bit big-endian entries and stopping at
the end of the page.

Fixes: 33842cedfc33 ("Staging: Merge ENE UB6250 MS card codes from keucr to drivers/usb/storage/ene_ub6250.c")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/ene_ub6250.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index bce593730187..e282ca9b5e16 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -1210,9 +1210,9 @@ static int ms_read_eraseblock(struct us_data *us, u32 PhyBlockAddr)
 
 static int ms_lib_check_disableblock(struct us_data *us, u16 PhyBlock)
 {
-	unsigned char *PageBuf = NULL;
+	__be16 *PageBuf = NULL;
 	u16 result = MS_STATUS_SUCCESS;
-	u16 blk, index = 0;
+	u16 blk, index;
 	struct ms_lib_type_extdat extdat;
 	struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
 
@@ -1223,7 +1223,7 @@ static int ms_lib_check_disableblock(struct us_data *us, u16 PhyBlock)
 	}
 
 	ms_read_readpage(us, PhyBlock, 1, (u32 *)PageBuf, &extdat);
-	do {
+	for (index = 0; index < MS_BYTES_PER_PAGE / sizeof(*PageBuf); index++) {
 		blk = be16_to_cpu(PageBuf[index]);
 		if (blk == MS_LB_NOT_USED)
 			break;
@@ -1231,8 +1231,7 @@ static int ms_lib_check_disableblock(struct us_data *us, u16 PhyBlock)
 			result = MS_ERROR_FLASH_READ;
 			break;
 		}
-		index++;
-	} while (1);
+	}
 
 exit:
 	kfree(PageBuf);

-- 
2.56.0