* [PATCH v2] mtd: phram: Prevent divide by zero bug in phram_setup()
@ 2022-01-21 11:55 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2022-01-21 11:55 UTC (permalink / raw)
To: Joern Engel, yangerkun
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
linux-mtd, kernel-janitors
The problem is that "erasesize" is a uint64_t type so it might be
non-zero but the lower 32 bits are zero so when it's truncated,
"(uint32_t)erasesize", then that value is zero. This leads to a
divide by zero bug.
Avoid the bug by delaying the divide until after we have validated
that "erasesize" is non-zero and within the uint32_t range.
Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: edit the commit message
drivers/mtd/devices/phram.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 6ed6c51fac69..d503821a3e60 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -264,16 +264,20 @@ static int phram_setup(const char *val)
}
}
- if (erasesize)
- div_u64_rem(len, (uint32_t)erasesize, &rem);
-
if (len == 0 || erasesize == 0 || erasesize > len
- || erasesize > UINT_MAX || rem) {
+ || erasesize > UINT_MAX) {
parse_err("illegal erasesize or len\n");
ret = -EINVAL;
goto error;
}
+ div_u64_rem(len, (uint32_t)erasesize, &rem);
+ if (rem) {
+ parse_err("len is not multiple of erasesize\n");
+ ret = -EINVAL;
+ goto error;
+ }
+
ret = register_device(name, start, len, (uint32_t)erasesize);
if (ret)
goto error;
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v2] mtd: phram: Prevent divide by zero bug in phram_setup()
@ 2022-01-21 11:55 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2022-01-21 11:55 UTC (permalink / raw)
To: Joern Engel, yangerkun
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
linux-mtd, kernel-janitors
The problem is that "erasesize" is a uint64_t type so it might be
non-zero but the lower 32 bits are zero so when it's truncated,
"(uint32_t)erasesize", then that value is zero. This leads to a
divide by zero bug.
Avoid the bug by delaying the divide until after we have validated
that "erasesize" is non-zero and within the uint32_t range.
Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: edit the commit message
drivers/mtd/devices/phram.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 6ed6c51fac69..d503821a3e60 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -264,16 +264,20 @@ static int phram_setup(const char *val)
}
}
- if (erasesize)
- div_u64_rem(len, (uint32_t)erasesize, &rem);
-
if (len == 0 || erasesize == 0 || erasesize > len
- || erasesize > UINT_MAX || rem) {
+ || erasesize > UINT_MAX) {
parse_err("illegal erasesize or len\n");
ret = -EINVAL;
goto error;
}
+ div_u64_rem(len, (uint32_t)erasesize, &rem);
+ if (rem) {
+ parse_err("len is not multiple of erasesize\n");
+ ret = -EINVAL;
+ goto error;
+ }
+
ret = register_device(name, start, len, (uint32_t)erasesize);
if (ret)
goto error;
--
2.20.1
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] mtd: phram: Prevent divide by zero bug in phram_setup()
2022-01-21 11:55 ` Dan Carpenter
@ 2022-01-23 15:22 ` Miquel Raynal
-1 siblings, 0 replies; 6+ messages in thread
From: Miquel Raynal @ 2022-01-23 15:22 UTC (permalink / raw)
To: Dan Carpenter, Joern Engel, yangerkun
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
linux-mtd, kernel-janitors
On Fri, 2022-01-21 at 11:55:05 UTC, Dan Carpenter wrote:
> The problem is that "erasesize" is a uint64_t type so it might be
> non-zero but the lower 32 bits are zero so when it's truncated,
> "(uint32_t)erasesize", then that value is zero. This leads to a
> divide by zero bug.
>
> Avoid the bug by delaying the divide until after we have validated
> that "erasesize" is non-zero and within the uint32_t range.
>
> Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.
Miquel
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] mtd: phram: Prevent divide by zero bug in phram_setup()
@ 2022-01-23 15:22 ` Miquel Raynal
0 siblings, 0 replies; 6+ messages in thread
From: Miquel Raynal @ 2022-01-23 15:22 UTC (permalink / raw)
To: Dan Carpenter, Joern Engel, yangerkun
Cc: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
linux-mtd, kernel-janitors
On Fri, 2022-01-21 at 11:55:05 UTC, Dan Carpenter wrote:
> The problem is that "erasesize" is a uint64_t type so it might be
> non-zero but the lower 32 bits are zero so when it's truncated,
> "(uint32_t)erasesize", then that value is zero. This leads to a
> divide by zero bug.
>
> Avoid the bug by delaying the divide until after we have validated
> that "erasesize" is non-zero and within the uint32_t range.
>
> Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.
Miquel
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] mtd: phram: Prevent divide by zero bug in phram_setup()
2022-01-23 15:22 ` Miquel Raynal
@ 2022-01-23 15:33 ` Miquel Raynal
-1 siblings, 0 replies; 6+ messages in thread
From: Miquel Raynal @ 2022-01-23 15:33 UTC (permalink / raw)
To: Dan Carpenter, Joern Engel, yangerkun
Cc: Richard Weinberger, Vignesh Raghavendra, linux-mtd, kernel-janitors
miquel.raynal@bootlin.com wrote on Sun, 23 Jan 2022 16:22:56 +0100:
> On Fri, 2022-01-21 at 11:55:05 UTC, Dan Carpenter wrote:
> > The problem is that "erasesize" is a uint64_t type so it might be
> > non-zero but the lower 32 bits are zero so when it's truncated,
> > "(uint32_t)erasesize", then that value is zero. This leads to a
> > divide by zero bug.
> >
> > Avoid the bug by delaying the divide until after we have validated
> > that "erasesize" is non-zero and within the uint32_t range.
> >
> > Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.
Pushed on mtd/fixes, actually.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] mtd: phram: Prevent divide by zero bug in phram_setup()
@ 2022-01-23 15:33 ` Miquel Raynal
0 siblings, 0 replies; 6+ messages in thread
From: Miquel Raynal @ 2022-01-23 15:33 UTC (permalink / raw)
To: Dan Carpenter, Joern Engel, yangerkun
Cc: Richard Weinberger, Vignesh Raghavendra, linux-mtd, kernel-janitors
miquel.raynal@bootlin.com wrote on Sun, 23 Jan 2022 16:22:56 +0100:
> On Fri, 2022-01-21 at 11:55:05 UTC, Dan Carpenter wrote:
> > The problem is that "erasesize" is a uint64_t type so it might be
> > non-zero but the lower 32 bits are zero so when it's truncated,
> > "(uint32_t)erasesize", then that value is zero. This leads to a
> > divide by zero bug.
> >
> > Avoid the bug by delaying the divide until after we have validated
> > that "erasesize" is non-zero and within the uint32_t range.
> >
> > Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git mtd/next, thanks.
Pushed on mtd/fixes, actually.
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-01-23 15:39 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-21 11:55 [PATCH v2] mtd: phram: Prevent divide by zero bug in phram_setup() Dan Carpenter
2022-01-21 11:55 ` Dan Carpenter
2022-01-23 15:22 ` Miquel Raynal
2022-01-23 15:22 ` Miquel Raynal
2022-01-23 15:33 ` Miquel Raynal
2022-01-23 15:33 ` Miquel Raynal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.