MdeModulePkg: ScsiDiskDxe: cope with broken "Supported VPD Pages" VPD page

The USB flash drive with Vendor ID 0x1516 (CompUSA) and Product ID 0x6221
returns a broken "Supported VPD Pages" VPD page. In particular, the
PageLength field has the invalid value 0x0602 (decimal 1538).

This prevents the loop from terminating that scans for the Block Limits
VPD page code in ScsiDiskInquiryDevice():

        for (Index = 0; Index < PageLength; Index++) {

because the Index variable has type UINT8, and it wraps from 255 to 0,
without ever reaching PageLength (1538), and because
EFI_SCSI_PAGE_CODE_BLOCK_LIMITS_VPD does not occur at offsets 0 through
255.

* The fix is not to change the type of Index to UINT16 or a wider type.
  Namely, section

    7.8.14 Supported VPD Pages VPD page

  in the "SCSI Primary Commands - 4" (SPC-4) specification names the
  following requirement:

    The supported VPD page list shall contain a list of all VPD page codes
    (see 7.8) implemented by the logical unit in ascending order beginning
    with page code 00h.

  Since page codes are 8-bit unsigned quantities, it follows that the
  maximum size for the Supported VPD Pages VPD page is 0x100 bytes, in
  which every possible page code (0x00 through 0xFF) will be found, before
  the UINT8 offset wraps around.

  (EFI_SCSI_SUPPORTED_VPD_PAGES_VPD_PAGE.SupportedVpdPageList is correctly
  sized as well, in "MdePkg/Include/IndustryStandard/Scsi.h".)

* Instead, add sanity checks that enforce the above requirement. If the
  device breaks the spec, simply fall back to the "Block Limits page
  absent" case.

Cc: Feng Tian <feng.tian@intel.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1330955
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Feng Tian <feng.tian@intel.com>

diff --git a/MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c b/MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c
index dfa5fa32e6353a35ac92e7356d0b59e5532295f1..1b75d55231a6978806351b66af86faf2f8c02a8a 100644 (file)
--- a/MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c
+++ b/MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDisk.c
@@ -1493,7 +1493,44 @@ ScsiDiskInquiryDevice (
       if (!EFI_ERROR (Status)) {\r
         PageLength = (SupportedVpdPages->PageLength2 << 8)\r
                    |  SupportedVpdPages->PageLength1;\r
+\r
+        //\r
+        // Sanity checks for coping with broken devices\r
+        //\r
+        if (PageLength > sizeof SupportedVpdPages->SupportedVpdPageList) {\r
+          DEBUG ((EFI_D_WARN,\r
+            "%a: invalid PageLength (%u) in Supported VPD Pages page\n",\r
+            __FUNCTION__, (UINT32)PageLength));\r
+          PageLength = 0;\r
+        }\r
+\r
+        if ((PageLength > 0) &&\r
+            (SupportedVpdPages->SupportedVpdPageList[0] !=\r
+             EFI_SCSI_PAGE_CODE_SUPPORTED_VPD)) {\r
+          DEBUG ((EFI_D_WARN,\r
+            "%a: Supported VPD Pages page doesn't start with code 0x%02x\n",\r
+            __FUNCTION__, EFI_SCSI_PAGE_CODE_SUPPORTED_VPD));\r
+          PageLength = 0;\r
+        }\r
+\r
+        //\r
+        // Locate the code for the Block Limits VPD page\r
+        //\r
         for (Index = 0; Index < PageLength; Index++) {\r
+          //\r
+          // Sanity check\r
+          //\r
+          if ((Index > 0) &&\r
+              (SupportedVpdPages->SupportedVpdPageList[Index] <=\r
+               SupportedVpdPages->SupportedVpdPageList[Index - 1])) {\r
+            DEBUG ((EFI_D_WARN,\r
+              "%a: non-ascending code in Supported VPD Pages page @ %u\n",\r
+              __FUNCTION__, Index));\r
+            Index = 0;\r
+            PageLength = 0;\r
+            break;\r
+          }\r
+\r
           if (SupportedVpdPages->SupportedVpdPageList[Index] == EFI_SCSI_PAGE_CODE_BLOCK_LIMITS_VPD) {\r
             break;\r
           }\r