linux-stable.git/drivers/usb/storage, branch v3.18.78

USB: uas: fix bug in handling of alternate settings

2017-10-12T07:18:01+00:00

commit 786de92b3cb26012d3d0f00ee37adf14527f35c4 upstream.

The uas driver has a subtle bug in the way it handles alternate
settings.  The uas_find_uas_alt_setting() routine returns an
altsetting value (the bAlternateSetting number in the descriptor), but
uas_use_uas_driver() then treats that value as an index to the
intf->altsetting array, which it isn't.

Normally this doesn't cause any problems because the various
alternate settings have bAlternateSetting values 0, 1, 2, ..., so the
value is equal to the index in the array.  But this is not guaranteed,
and Andrey Konovalov used the syzkaller fuzzer with KASAN to get a
slab-out-of-bounds error by violating this assumption.

This patch fixes the bug by making uas_find_uas_alt_setting() return a
pointer to the altsetting entry rather than either the value or the
index.  Pointers are less subject to misinterpretation.

Signed-off-by: Alan Stern 
Reported-by: Andrey Konovalov 
Tested-by: Andrey Konovalov 
CC: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives

2017-10-12T07:18:01+00:00

commit 113f6eb6d50cfa5e2a1cdcf1678b12661fa272ab upstream.

Kris Lindgren reports that without the NO_WP_DETECT flag, his Seagate
external disk drive fails all write accesses.  This regresssion dates
back approximately to the start of the 4.x kernel releases.

Signed-off-by: Alan Stern 
Reported-by: Kris Lindgren 
Signed-off-by: Greg Kroah-Hartman

uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069

2017-08-16T20:35:31+00:00

commit 89f23d51defcb94a5026d4b5da13faf4e1150a6f upstream.

Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for
Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already
present in unusual_uas.h. Both in same controller IC family.

Issue is that MakeMKV fails during key exchange with installed bluray drive
with following error:

002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED'
occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'

Signed-off-by: Alan Swanson 
Acked-by: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman

usb: storage: return on error to avoid a null pointer dereference

2017-07-27T22:03:26+00:00

commit 446230f52a5bef593554510302465eabab45a372 upstream.

When us->extra is null the driver is not initialized, however, a
later call to osd200_scsi_to_ata is made that dereferences
us->extra, causing a null pointer dereference.  The code
currently detects and reports that the driver is not initialized;
add a return to avoid the subsequent dereference issue in this
check.

Thanks to Alan Stern for pointing out that srb->result needs setting
to DID_ERROR << 16

Detected by CoverityScan, CID#100308 ("Dereference after null check")

Signed-off-by: Colin Ian King 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: fix DMA to the stack

2017-05-25T12:17:56+00:00

commit 628c2893d44876ddd11602400c70606ade62e129 upstream.

The ene_usb6250 sub-driver in usb-storage does USB I/O to buffers on
the stack, which doesn't work with vmapped stacks.  This patch fixes
the problem by allocating a separate 512-byte buffer at probe time and
using it for all of the offending I/O operations.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: uas: Add a new NO_REPORT_LUNS quirk

2016-04-20T13:41:07+00:00

[ Upstream commit 1363074667a6b7d0507527742ccd7bbed5e3ceaa ]

Add a new NO_REPORT_LUNS quirk and set it for Seagate drives with
an usb-id of: 0bc2:331a, as these will fail to respond to a
REPORT_LUNS command.

Cc: stable@vger.kernel.org
Reported-and-tested-by: David Webb 
Signed-off-by: Hans de Goede 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

USB: uas: Reduce can_queue to MAX_CMNDS

2016-04-18T12:49:36+00:00

[ Upstream commit 55ff8cfbc4e12a7d2187df523938cc671fbebdd1 ]

The uas driver can never queue more then MAX_CMNDS (- 1) tags and tags
are shared between luns, so there is no need to claim that we can_queue
some random large number.

Not claiming that we can_queue 65536 commands, fixes the uas driver
failing to initialize while allocating the tag map with a "Page allocation
failure (order 7)" error on systems which have been running for a while
and thus have fragmented memory.

Cc: stable@vger.kernel.org
Reported-and-tested-by: Yves-Alexis Perez 
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb-storage: ignore ZTE MF 823 card reader in mode 0x1225

2015-08-27T17:25:47+00:00

[ Upstream commit 5fb2c782f451a4fb9c19c076e2c442839faf0f76 ]

This device automatically switches itself to another mode (0x1405)
unless the specific access pattern of Windows is followed in its
initial mode. That makes a dirty unmount of the internal storage
devices inevitable if they are mounted. So the card reader of
such a device should be ignored, lest an unclean removal become
inevitable.

This replaces an earlier patch that ignored all LUNs of this device.
That patch was overly broad.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Reviewed-by: Lars Melin 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

usb-storage: Add NO_WP_DETECT quirk for Lacie 059f:0651 devices

2015-06-10T17:42:20+00:00

[ Upstream commit 172115090f5e739660b97694618a2ba86457063a ]

Without this flag some versions of these enclosures do not work.

Cc: stable@vger.kernel.org
Reported-and-tested-by: Christian Schaller 
Signed-off-by: Hans de Goede 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

uas: Set max_sectors_240 quirk for ASM1053 devices

2015-05-17T23:12:40+00:00

[ Upstream commit 8e779c6c4a398763c21371fe40f649206041dc1e ]

Testing has shown that ASM1053 devices do not work properly with transfers
larger than 240 sectors, so set max_sectors to 240 on these.

Cc: stable@vger.kernel.org # 3.16
Reported-by: Steve Bangert 
Signed-off-by: Hans de Goede 
Tested-by: Steve Bangert 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin