[PATCH 1/3] usb: storage: Zero CDB out before sending it

[PATCH 1/3] usb: storage: Zero CDB out before sending it

[Andrey Smirnov]

Since cbw.Length can be less that sizeof(cbw.CDB), add code to zero
the whole struct out to avoid sending random stack data as a part of
payload. There's no known case where this causes a problem, but it's a
reasonable thing to do anyway.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
 drivers/usb/storage/transport.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 48ccee207..5186508ba 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -115,6 +115,7 @@ int usb_stor_Bulk_transport(struct us_blk_dev *usb_blkdev,
 	cbw.Length = cmdlen;
 
 	/* copy the command payload */
+	memset(cbw.CDB, 0, sizeof(cbw.CDB));
 	memcpy(cbw.CDB, cmd, cbw.Length);
 
 	/* send it to out endpoint */
-- 
2.21.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 2/3] usb: storage: Default to a single LUN

[Andrey Smirnov]

For loop below is:

	for (lun=0; lun<=us->max_lun; lun++)
	    ...

so we need to set max_lun to 0 in order to default to having only one
LUN. Otherwise, we end up assuming the device has 2 valid LUNs.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
 drivers/usb/storage/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index fda24d616..79561ee6f 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -439,7 +439,7 @@ static int usb_stor_scan(struct usb_device *usbdev, struct us_data *us)
 	int num_devs = 0;
 
 	/* obtain the max LUN */
-	us->max_lun = 1;
+	us->max_lun = 0;
 	if (us->protocol == US_PR_BULK)
 		us->max_lun = usb_stor_Bulk_max_lun(us);
 
-- 
2.21.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

[PATCH 3/3] usb: storage: Fix TEST_UNIT_READY command size

[Andrey Smirnov]

TEST_UNIT_READY is 6 bytes long instead of 12. Fix it.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
 drivers/usb/storage/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 79561ee6f..63d624e91 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -142,7 +142,7 @@ exit:
 
 static int usb_stor_test_unit_ready(struct us_blk_dev *usb_blkdev)
 {
-	u8 cmd[12];
+	u8 cmd[6];
 	int ret;
 
 	memset(cmd, 0, sizeof(cmd));
-- 
2.21.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH 1/3] usb: storage: Zero CDB out before sending it

[Sascha Hauer]

On Wed, May 22, 2019 at 12:33:47AM -0700, Andrey Smirnov wrote:
> Since cbw.Length can be less that sizeof(cbw.CDB), add code to zero
> the whole struct out to avoid sending random stack data as a part of
> payload. There's no known case where this causes a problem, but it's a
> reasonable thing to do anyway.
> 
> Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
> ---
>  drivers/usb/storage/transport.c | 1 +
>  1 file changed, 1 insertion(+)

Applied, thanks

Sascha

-- 
Pengutronix e.K.                           |                             |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox