linux-kernel - Re: [PATCH] memstick: fix unreachable state in h_msb_read_page() in ms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1383434908.15049.10.camel@maxim-laptop>
Date:	Sun, 03 Nov 2013 01:28:28 +0200
From:	Maxim Levitsky <maximlevitsky@...il.com>
To:	rogerable@...ltek.com
Cc:	devel@...uxdriverproject.org, linux-kernel@...r.kernel.org,
	gregkh@...uxfoundation.org, oakad@...oo.com,
	wei_wang@...lsil.com.cn, micky_ching@...lsil.com.cn
Subject: Re: [PATCH] memstick: fix unreachable state in h_msb_read_page() in
 ms_block.c

On Wed, 2013-10-30 at 15:54 +0800, rogerable@...ltek.com wrote: 
> From: Roger Tseng <rogerable@...ltek.com>
> 
> In h_msb_read_page() in ms_block.c, flow never reaches case
> MSB_RP_RECIVE_STATUS_REG. This causes error when MEMSTICK_INT_ERR is
> encountered and status error bits are going to be examined, but the status will
> never be copied back.
> 
> Fix it by transiting to MSB_RP_RECIVE_STATUS_REG right after
> MSB_RP_SEND_READ_STATUS_REG.
> 
> Signed-off-by: Roger Tseng <rogerable@...ltek.com>
> ---
>  drivers/memstick/core/ms_block.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
> index 08e7023..9188ef5 100644
> --- a/drivers/memstick/core/ms_block.c
> +++ b/drivers/memstick/core/ms_block.c
> @@ -401,7 +401,7 @@ again:
>  			sizeof(struct ms_status_register)))
>  			return 0;
>  
> -		msb->state = MSB_RP_RECEIVE_OOB_READ;
> +		msb->state = MSB_RP_RECIVE_STATUS_REG;
>  		return 0;
>  
>  	case MSB_RP_RECIVE_STATUS_REG:

This is indeed a bug here. Probably added when I converted to use
#defines for states.

So,

Signed-off-by: Maxim Levitsky <maximlevitsky@...il.com>


Btw, there is another  minor or major (pun inteded) bug out there in
this driver, which I still have no time to send patch for yet :-(

I accidentally didn't set the major and minor for the disk.
It happens to work as usually there is just one card reader out there,
and major is allocated dynamically.

The two lines in msb_init_disk,

msb->disk->major = major;
msb->disk->first_minor = disk_id << MS_BLOCK_PART_SHIFT;

Somehow fell through the cracks. I had this in older revision.

Feel free to add it, or maybe I find time to compile and test this and
send a patch.

You also welcome to write a driver for xD portion of the card reader
too.
I back then implemented all the generic support, and you only need to
expose an NAND driver (look at r852.c for my code).


-- 
Best regards,
        Maxim Levitsky


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/