diff options
| author | Tianchu Chen <flynnnchen@tencent.com> | 2025-11-16 12:46:18 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-12-07 06:09:35 +0900 |
| commit | 26e9b5da3231da7dc357b363883b5b7b51a64092 (patch) | |
| tree | 7db7dd9005cfe353798fcded1176e9e813a3bc12 /drivers/usb | |
| parent | 4aa7426f5326c198d3e5faf65003336b2403c34b (diff) | |
| download | linux-26e9b5da3231da7dc357b363883b5b7b51a64092.tar.gz linux-26e9b5da3231da7dc357b363883b5b7b51a64092.tar.bz2 linux-26e9b5da3231da7dc357b363883b5b7b51a64092.zip | |
usb: storage: sddr55: Reject out-of-bound new_pba
commit b59d4fda7e7d0aff1043a7f742487cb829f5aac1 upstream.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
new_pba comes from the status packet returned after each write.
A bogus device could report values beyond the block count derived
from info->capacity, letting the driver walk off the end of
pba_to_lba[] and corrupt heap memory.
Reject PBAs that exceed the computed block count and fail the
transfer so we avoid touching out-of-range mapping entries.
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/B2DC73A3EE1E3A1D+202511161322001664687@tencent.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/storage/sddr55.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/usb/storage/sddr55.c b/drivers/usb/storage/sddr55.c index 15dc25801cdc..f53b2471a21c 100644 --- a/drivers/usb/storage/sddr55.c +++ b/drivers/usb/storage/sddr55.c @@ -469,6 +469,12 @@ static int sddr55_write_data(struct us_data *us, new_pba = (status[3] + (status[4] << 8) + (status[5] << 16)) >> info->blockshift; + /* check if device-reported new_pba is out of range */ + if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) { + result = USB_STOR_TRANSPORT_FAILED; + goto leave; + } + /* check status for error */ if (status[0] == 0xff && status[1] == 0x4) { info->pba_to_lba[new_pba] = BAD_BLOCK; |