mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
014bcf41d9
The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values
in the ATA ID information to calculate cylinder and head values when
creating a CDB for READ or WRITE commands. The calculation involves
division and modulus operations, which will cause a crash if either of
these values is 0. While this never happens with a genuine device, it
could happen with a flawed or subversive emulation, as reported by the
syzbot fuzzer.
Protect against this possibility by refusing to bind to the device if
either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID
information is 0. This requires isd200_Initialization() to return a
negative error code when initialization fails; currently it always
returns 0 (even when there is an error).
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+28748250ab47a8f04100@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-usb/0000000000003eb868061245ba7f@google.com/
Fixes:
|
||
|---|---|---|
| .. | ||
| alauda.c | ||
| cypress_atacb.c | ||
| datafab.c | ||
| debug.c | ||
| debug.h | ||
| ene_ub6250.c | ||
| freecom.c | ||
| initializers.c | ||
| initializers.h | ||
| isd200.c | ||
| jumpshot.c | ||
| karma.c | ||
| Kconfig | ||
| Makefile | ||
| onetouch.c | ||
| option_ms.c | ||
| option_ms.h | ||
| protocol.c | ||
| protocol.h | ||
| realtek_cr.c | ||
| scsiglue.c | ||
| scsiglue.h | ||
| sddr09.c | ||
| sddr55.c | ||
| shuttle_usbat.c | ||
| sierra_ms.c | ||
| sierra_ms.h | ||
| transport.c | ||
| transport.h | ||
| uas-detect.h | ||
| uas.c | ||
| unusual_alauda.h | ||
| unusual_cypress.h | ||
| unusual_datafab.h | ||
| unusual_devs.h | ||
| unusual_ene_ub6250.h | ||
| unusual_freecom.h | ||
| unusual_isd200.h | ||
| unusual_jumpshot.h | ||
| unusual_karma.h | ||
| unusual_onetouch.h | ||
| unusual_realtek.h | ||
| unusual_sddr09.h | ||
| unusual_sddr55.h | ||
| unusual_uas.h | ||
| unusual_usbat.h | ||
| usb.c | ||
| usb.h | ||
| usual-tables.c | ||