From c4542993c071fcafe7335698bf52650dee7e3555 Mon Sep 17 00:00:00 2001 From: Arka Mondal Date: Tue, 1 Sep 2026 15:58:31 +0900 Subject: [PATCH] usb-storage: alauda: fix out-of-bounds zone index MEDIA_INFO(us).lba_to_pba and .pba_to_lba are arrays of num_zones pointers, allocated by kcalloc() in alauda_init_media(). alauda_ensure_map_for_zone() reads lba_to_pba[zone] and pba_to_lba[zone], and when either is NULL alauda_read_map() writes a pointer back to both. Two separate errors let zone reach num_zones, one element past the end. max_lba is capacity >> (blockshift + pageshift), which counts physical blocks, but zone is lba / uzonesize and uzonesize is 125/128 of zonesize. On a 16 MB card (alauda_card_ids id 0x73) num_zones is 1 and uzonesize is 1000, so lba 1000 to 1023 pass the bounds check and index element 1 of a one-element array. alauda_read_data() also calls alauda_ensure_map_for_zone() before it compares lba against max_lba, so any larger lba is used as an index before the check rejects it. alauda_write_data() already checks first. Bound lba by num_zones * uzonesize on both paths and move the read side's call below the check. alauda_transport() reports num_zones * uzonesize * blocksize for READ_CAPACITY, so the new bound is exactly the range the device advertises and no block becomes unreachable. sd never issues an lba past the reported capacity; an SG_IO READ_10 can. Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support") Suggested-by: Alan Stern Signed-off-by: Arka Mondal Acked-by: Alan Stern Link: https://patch.msgid.link/20260901065831.43567-4-arka@arkamondal.net Signed-off-by: Greg Kroah-Hartman --- drivers/usb/storage/alauda.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c index d47ce01d519a..5e7f99ba8ac0 100644 --- a/drivers/usb/storage/alauda.c +++ b/drivers/usb/storage/alauda.c @@ -949,6 +949,7 @@ static int alauda_read_data(struct us_data *us, unsigned long address, unsigned char *buffer; u16 lba, max_lba; unsigned int page, len, offset; + unsigned int num_zones; unsigned int blockshift = MEDIA_INFO(us).blockshift; unsigned int pageshift = MEDIA_INFO(us).pageshift; unsigned int blocksize = MEDIA_INFO(us).blocksize; @@ -973,7 +974,9 @@ static int alauda_read_data(struct us_data *us, unsigned long address, /* Figure out the initial LBA and page */ lba = address >> blockshift; page = (address & MEDIA_INFO(us).blockmask); - max_lba = MEDIA_INFO(us).capacity >> (blockshift + pageshift); + num_zones = MEDIA_INFO(us).capacity >> (MEDIA_INFO(us).zoneshift + + blockshift + pageshift); + max_lba = num_zones * uzonesize; result = USB_STOR_TRANSPORT_GOOD; offset = 0; @@ -985,10 +988,6 @@ static int alauda_read_data(struct us_data *us, unsigned long address, unsigned int pages; u16 pba; - result = alauda_ensure_map_for_zone(us, zone); - if (result != USB_STOR_TRANSPORT_GOOD) - break; - /* Not overflowing capacity? */ if (lba >= max_lba) { usb_stor_dbg(us, "Error: Requested lba %u exceeds maximum %u\n", @@ -997,6 +996,10 @@ static int alauda_read_data(struct us_data *us, unsigned long address, break; } + result = alauda_ensure_map_for_zone(us, zone); + if (result != USB_STOR_TRANSPORT_GOOD) + break; + /* Find number of pages we can read in this block */ pages = min(sectors, blocksize - page); len = pages << pageshift; @@ -1052,6 +1055,7 @@ static int alauda_write_data(struct us_data *us, unsigned long address, unsigned int pagesize = MEDIA_INFO(us).pagesize; struct scatterlist *sg; u16 lba, max_lba; + unsigned int num_zones; int result; /* @@ -1078,7 +1082,9 @@ static int alauda_write_data(struct us_data *us, unsigned long address, /* Figure out the initial LBA and page */ lba = address >> blockshift; page = (address & MEDIA_INFO(us).blockmask); - max_lba = MEDIA_INFO(us).capacity >> (pageshift + blockshift); + num_zones = MEDIA_INFO(us).capacity >> (MEDIA_INFO(us).zoneshift + + blockshift + pageshift); + max_lba = num_zones * MEDIA_INFO(us).uzonesize; result = USB_STOR_TRANSPORT_GOOD; offset = 0;