Skip to content

Commit 3e37658

Browse files
Dan Carpentermiquelraynal
authored andcommitted
mtd: phram: Prevent divide by zero bug in phram_setup()
The problem is that "erasesize" is a uint64_t type so it might be non-zero but the lower 32 bits are zero so when it's truncated, "(uint32_t)erasesize", then that value is zero. This leads to a divide by zero bug. Avoid the bug by delaying the divide until after we have validated that "erasesize" is non-zero and within the uint32_t range. Fixes: dc2b3e5 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/20220121115505.GI1978@kadam
1 parent 4cd335d commit 3e37658

1 file changed

Lines changed: 8 additions & 4 deletions

File tree

drivers/mtd/devices/phram.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -264,16 +264,20 @@ static int phram_setup(const char *val)
264264
}
265265
}
266266

267-
if (erasesize)
268-
div_u64_rem(len, (uint32_t)erasesize, &rem);
269-
270267
if (len == 0 || erasesize == 0 || erasesize > len
271-
|| erasesize > UINT_MAX || rem) {
268+
|| erasesize > UINT_MAX) {
272269
parse_err("illegal erasesize or len\n");
273270
ret = -EINVAL;
274271
goto error;
275272
}
276273

274+
div_u64_rem(len, (uint32_t)erasesize, &rem);
275+
if (rem) {
276+
parse_err("len is not multiple of erasesize\n");
277+
ret = -EINVAL;
278+
goto error;
279+
}
280+
277281
ret = register_device(name, start, len, (uint32_t)erasesize);
278282
if (ret)
279283
goto error;

0 commit comments

Comments
 (0)