Received-SPF: pass (google.com: domain of linux-kernel+bounces-85351-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <12b30393-0b4b-400e-828b-231901d8933b@suse.com>
Date: Wed, 28 Feb 2024 17:20:29 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [syzbot] [usb-storage?] divide error in isd200_ata_command
Content-Language: en-US
To: Alan Stern <stern@rowland.harvard.edu>, Oliver Neukum <oneukum@suse.com>
Cc: syzbot <syzbot+28748250ab47a8f04100@syzkaller.appspotmail.com>,
 bvanassche@acm.org, emilne@redhat.com, gregkh@linuxfoundation.org,
 linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
 martin.petersen@oracle.com, syzkaller-bugs@googlegroups.com,
 tasos@tasossah.com, usb-storage@lists.one-eyed-alien.net
References: <0000000000003eb868061245ba7f@google.com>
 <99b0fb1b-37b3-4da4-8129-e502ed8e479a@suse.com>
 <9bbc5b63-33e3-44de-8bce-4c59dcce5e92@rowland.harvard.edu>
From: Oliver Neukum <oneukum@suse.com>
In-Reply-To: <9bbc5b63-33e3-44de-8bce-4c59dcce5e92@rowland.harvard.edu>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 26.02.24 19:13, Alan Stern wrote:

>> It oopses here:
>>
>> 		} else {
>> 			if (!id[ATA_ID_SECTORS] || !id[ATA_ID_HEADS])
>> 				goto too_early;
> 
> Those two lines are debugging code you added, right?

Yes, sorry about that.

> 
>> 			sectnum = (u8)((lba % id[ATA_ID_SECTORS]) + 1);
>> 			cylinder = (u16)(lba / (id[ATA_ID_SECTORS] *
>> 					id[ATA_ID_HEADS]));
>>
>> in isd200_scsi_to_ata() because it must not be called before isd200_get_inquiry_data()
>> has completed.
> 
> It can't be; isd200_get_inquiry_data is called by isd200_Initialization
> during probe before any SCSI commands are transmitted.

So, you are concluding that the bisection is spurious because
without that patch the SCSI layer would see a capacity of zero
and not even try to read anything?

	Regards
		Oliver