[PATCH 7/7] usb: storage: shuttle_usbat: bound the READ chunk size

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Josef Bacik <josef@toxicpanda.com>

An SG_IO READ(10) of 64KiB or more to an HP 8200e CD-RW behind a USBAT
bridge never makes progress: the usb-storage thread keeps issuing
zero-length reads until the SCSI command times out and is aborted.

usbat_hp8200e_handle_read10() splits reads of 64KiB or more into chunks
of whole sectors, using srb->transfersize as the sector size:

    len = (65535/srb->transfersize) * srb->transfersize;

For passthrough requests scsi_setup_scsi_cmnd() sets transfersize to
the whole request size, and the READ CD path can likewise compute a
value above 65535, so len becomes 0.  The loop then sends commands with
a zero length and adds 0 to the transferred count on every pass.

The bug was found by code inspection and has not been reproduced.

Fix by falling back to the existing 2048-byte sector size guess when
transfersize is larger than the maximum read size, so that every chunk
holds at least one sector.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/shuttle_usbat.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index a1b64b10bbe0..080799029643 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -1328,7 +1328,12 @@ static int usbat_hp8200e_handle_read10(struct us_data *us,
 		srb->transfersize = len ? scsi_bufflen(srb) / len : 0;
 	}
 
-	if (!srb->transfersize)  {
+	/*
+	 * Passthrough requests set transfersize to the whole request size,
+	 * which can exceed the 64k-1 maximum read and leave no whole sector
+	 * to read per chunk.
+	 */
+	if (!srb->transfersize || srb->transfersize > 65535) {
 		srb->transfersize = 2048; /* A guess */
 		usb_stor_dbg(us, "transfersize 0, forcing %d\n",
 			     srb->transfersize);

-- 
2.56.0