shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 10:58:48 +09:00
Code Issues Packages Projects Releases Wiki Activity

mtd: phram: Prevent divide by zero bug in phram_setup()

Browse Source 
commit 3e3765875b upstream.

The problem is that "erasesize" is a uint64_t type so it might be
non-zero but the lower 32 bits are zero so when it's truncated,
"(uint32_t)erasesize", then that value is zero. This leads to a
divide by zero bug.

Avoid the bug by delaying the divide until after we have validated
that "erasesize" is non-zero and within the uint32_t range.

Fixes: dc2b3e5cbc ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220121115505.GI1978@kadam
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter
2022-01-21 14:55:05 +03:00
committed by Greg Kroah-Hartman
parent 3eb5185896
commit 9fd00a5686
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/mtd/devices/phram.c
View File

@@ -264,16 +264,20 @@ static int phram_setup(const char *val)
}
}
if (erasesize)
div_u64_rem(len, (uint32_t)erasesize, &rem);
if (len == 0 || erasesize == 0 || erasesize > len
|| erasesize > UINT_MAX || rem) {
|| erasesize > UINT_MAX) {
parse_err("illegal erasesize or len\n");
ret = -EINVAL;
goto error;
}
div_u64_rem(len, (uint32_t)erasesize, &rem);
if (rem) {
parse_err("len is not multiple of erasesize\n");
ret = -EINVAL;
goto error;
}
ret = register_device(name, start, len, (uint32_t)erasesize);
if (ret)
goto error;