USB: storage: Reject bogus max LUN values

Some mass storage devices return a bogus value in response to a Get Max LUN
request. The Iomega Jaz USB Adapter responds with 0x10, hence my recent
patch to use the US_FL_SINGLE_LUN quirk for it.

The USB MSC Bulk Only Transport document says "The device shall return one
byte of data that contains the maximum LUN supported by the device."

Since the LUN field in the command block wrapper is only 4 bits wide, it
might be helpful to report too-large LUN values in the kernel log, and
assume max LUN is actually 0. That could get some devices which currently
need the US_FL_SINGLE_LUN quirk to work.

Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 14 insertions, 3 deletions

diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 22c7d4360fa2..d614deeacd87 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -1035,9 +1035,20 @@ int usb_stor_Bulk_max_lun(struct us_data *us)
         usb_stor_dbg(us, "GetMaxLUN command result is %d, data is %d\n",
                      result, us->iobuf[0]);
 
-        /* if we have a successful request, return the result */
-        if (result > 0)
-                return us->iobuf[0];
+        /*
+         * If we have a successful request, return the result if valid. The
+         * CBW LUN field is 4 bits wide, so the value reported by the device
+         * should fit into that.
+         */
+        if (result > 0) {
+                if (us->iobuf[0] < 16) {
+                        return us->iobuf[0];
+                } else {
+                        dev_info(&us->pusb_intf->dev,
+                                 "Max LUN %d is not valid, using 0 instead",
+                                 us->iobuf[0]);
+                }
+        }
 
         /*
          * Some devices don't like GetMaxLUN.  They may STALL the control