linux-stable.git/drivers/usb/storage, branch v4.13.7

USB: uas: fix bug in handling of alternate settings

2017-10-12T09:56:09+00:00

commit 786de92b3cb26012d3d0f00ee37adf14527f35c4 upstream.

The uas driver has a subtle bug in the way it handles alternate
settings.  The uas_find_uas_alt_setting() routine returns an
altsetting value (the bAlternateSetting number in the descriptor), but
uas_use_uas_driver() then treats that value as an index to the
intf->altsetting array, which it isn't.

Normally this doesn't cause any problems because the various
alternate settings have bAlternateSetting values 0, 1, 2, ..., so the
value is equal to the index in the array.  But this is not guaranteed,
and Andrey Konovalov used the syzkaller fuzzer with KASAN to get a
slab-out-of-bounds error by violating this assumption.

This patch fixes the bug by making uas_find_uas_alt_setting() return a
pointer to the altsetting entry rather than either the value or the
index.  Pointers are less subject to misinterpretation.

Signed-off-by: Alan Stern 
Reported-by: Andrey Konovalov 
Tested-by: Andrey Konovalov 
CC: Oliver Neukum 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Greg Kroah-Hartman

usb-storage: fix bogus hardware error messages for ATA pass-thru devices

2017-10-12T09:56:08+00:00

commit a4fd4a724d6c30ad671046d83be2e9be2f11d275 upstream.

Ever since commit a621bac3044e ("scsi_lib: correctly retry failed zero
length REQ_TYPE_FS commands"), people have been getting bogus error
messages for USB disk drives using ATA pass-thru.  For example:

[ 1344.880193] sd 6:0:0:0: [sdb] Attached SCSI disk
[ 1345.069152] sd 6:0:0:0: [sdb] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_SENSE
[ 1345.069159] sd 6:0:0:0: [sdb] tag#0 Sense Key : Hardware Error [current] [descriptor]
[ 1345.069162] sd 6:0:0:0: [sdb] tag#0 Add. Sense: No additional sense information
[ 1345.069168] sd 6:0:0:0: [sdb] tag#0 CDB: ATA command pass through(16) 85 06 20 00 00 00 00 00 00 00 00 00 00 00 e5 00
[ 1345.172252] sd 6:0:0:0: [sdb] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_SENSE
[ 1345.172258] sd 6:0:0:0: [sdb] tag#0 Sense Key : Hardware Error [current] [descriptor]
[ 1345.172261] sd 6:0:0:0: [sdb] tag#0 Add. Sense: No additional sense information
[ 1345.172266] sd 6:0:0:0: [sdb] tag#0 CDB: ATA command pass through(12)/Blank a1 06 20 da 00 00 4f c2 00 b0 00 00

These messages can be quite annoying, because programs like udisks2
provoke them every 10 minutes or so.  Other programs can also have
this effect, such as those in smartmontools.

I don't fully understand how that commit induced the SCSI core to log
these error messages, but the underlying cause for them is code added
to usb-storage by commit f1a0743bc0e7 ("USB: storage: When a device
returns no sense data, call it a Hardware Error").  At the time it was
necessary to do this, in order to prevent an infinite retry loop with
some not-so-great mass storage devices.

However, the ATA pass-thru protocol uses SCSI sense data to return
command status values, and some devices always report Check Condition
status for ATA pass-thru commands to ensure that the host retrieves
the sense data, even if the command succeeded.  This violates the USB
mass-storage protocol (Check Condition status is supposed to mean the
command failed), but we can't help that.

This patch attempts to mitigate the problem of these bogus error
reports by changing usb-storage.  The HARDWARE ERROR sense key will be
inserted only for commands that aren't ATA pass-thru.

Thanks to Ewan Milne for pointing out that this mechanism was present
in usb-storage.  8 years after writing it, I had completely forgotten
its existence.

Signed-off-by: Alan Stern 
Tested-by: Kris Lindgren 
Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1351305
CC: Ewan D. Milne 
Signed-off-by: Greg Kroah-Hartman

usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives

2017-10-12T09:56:08+00:00

commit 113f6eb6d50cfa5e2a1cdcf1678b12661fa272ab upstream.

Kris Lindgren reports that without the NO_WP_DETECT flag, his Seagate
external disk drive fails all write accesses.  This regresssion dates
back approximately to the start of the 4.x kernel releases.

Signed-off-by: Alan Stern 
Reported-by: Kris Lindgren 
Signed-off-by: Greg Kroah-Hartman

usb-storage: fix deadlock involving host lock and scsi_done

2017-07-30T14:18:27+00:00

Christoph Hellwig says that since version 4.12, the kernel switched to
using blk-mq by default.  The old code used a softirq for handling
request completions, but blk-mq can handle completions in the caller's
context.  This may cause a problem for usb-storage, because it invokes
the ->scsi_done callback while holding the host lock, and the
completion routine sometimes tries to acquire the same lock (when
running the error handler, for example).

The consequence is that the existing code will sometimes deadlock upon
error completion of a SCSI command (with a lockdep warning).

This is easy enough to fix, since usb-storage doesn't really need to
hold the host lock while the callback runs.  It was simpler to write
it that way, but moving the call outside the locked region is pretty
easy and there's no downside.  That's what this patch does.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Arthur Marsh 
CC: Christoph Hellwig 
CC: 
Signed-off-by: Greg Kroah-Hartman

uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069

2017-07-30T14:18:27+00:00

Similar to commit d595259fbb7a ("usb-storage: Add ignore-residue quirk for
Initio INIC-3619") for INIC-3169 in unusual_devs.h but INIC-3069 already
present in unusual_uas.h. Both in same controller IC family.

Issue is that MakeMKV fails during key exchange with installed bluray drive
with following error:

002004:0000 Error 'Scsi error - ILLEGAL REQUEST:COPY PROTECTION KEY EXCHANGE FAILURE - KEY NOT ESTABLISHED'
occurred while issuing SCSI command AD010..080002400 to device 'SG:dev_11:0'

Signed-off-by: Alan Swanson 
Acked-by: Oliver Neukum 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

usb: storage: return on error to avoid a null pointer dereference

2017-07-17T11:11:57+00:00

When us->extra is null the driver is not initialized, however, a
later call to osd200_scsi_to_ata is made that dereferences
us->extra, causing a null pointer dereference.  The code
currently detects and reports that the driver is not initialized;
add a return to avoid the subsequent dereference issue in this
check.

Thanks to Alan Stern for pointing out that srb->result needs setting
to DID_ERROR << 16

Detected by CoverityScan, CID#100308 ("Dereference after null check")

Signed-off-by: Colin Ian King 
Cc: stable 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman

Merge 4.12-rc2 into usb-next

2017-05-22T07:00:23+00:00

We want the USB fixes in here as well to handle testing and merge
issues.

Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: turn off the Removable flag

2017-05-18T14:05:25+00:00

In the ene_usb6250 sub-driver for usb-storage, the INQUIRY data
returned by the driver indicates that the device has removable media.
While this is technically correct (memory cards can be removed from
the reader), it is not useful because the device automatically
disconnects itself from the USB bus when no media is present.

In addition, the driver does not support the PREVENT-ALLOW MEDIUM
REMOVAL and START STOP UNIT commands, and this can cause
user-interface frameworks to get confused when the user asks for the
card to be removed or ejected.

This patch fixes the problem by changing the INQUIRY data to specify
non-removable media; in practice this value works much better.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: remove subroutine duplication

2017-05-18T14:05:24+00:00

In the ene_usb6250 sub-driver for usb-storage, the sd_scsi_inquiry()
and ms_scsi_inquiry() subroutines (one meant for use with SD memory
cards and the other for use with MS memory cards) are exact
duplicates.  This patch removes the duplication by creating a single
do_scsi_inquiry() command and using it instead of the other two.

Signed-off-by: Alan Stern 
Tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman

USB: ene_usb6250: implement REQUEST SENSE

2017-05-18T14:05:24+00:00

In the ene_usb6250 sub-driver for usb-storage, there is no support for
the REQUEST SENSE command.  This command is issued whenever a failure
occurs, and without it the driver has no way to tell the SCSI core
what the reason for the failure was.

This patch adds a do_scsi_request_sense() routine to the driver.  The
new routine reports the error code stored by the previous command.

Signed-off-by: Alan Stern 
Reported-and-tested-by: Andreas Hartmann 
Signed-off-by: Greg Kroah-Hartman