Commit 3e376587 authored by Dan Carpenter's avatar Dan Carpenter Committed by Miquel Raynal
Browse files

mtd: phram: Prevent divide by zero bug in phram_setup() 



The problem is that "erasesize" is a uint64_t type so it might be
non-zero but the lower 32 bits are zero so when it's truncated,
"(uint32_t)erasesize", then that value is zero. This leads to a
divide by zero bug.

Avoid the bug by delaying the divide until after we have validated
that "erasesize" is non-zero and within the uint32_t range.

Fixes: dc2b3e5c ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220121115505.GI1978@kadam
parent 4cd335da

drivers/mtd/devices/phram.c

+8 −4
Original line number Diff line number Diff line
@@ -264,16 +264,20 @@ static int phram_setup(const char *val) 
		}

	}



	if (erasesize)

		div_u64_rem(len, (uint32_t)erasesize, &rem);



	if (len == 0 || erasesize == 0 || erasesize > len

	    || erasesize > UINT_MAX || rem) {

	    || erasesize > UINT_MAX) {

		parse_err("illegal erasesize or len\n");

		ret = -EINVAL;

		goto error;

	}



	div_u64_rem(len, (uint32_t)erasesize, &rem);

	if (rem) {

		parse_err("len is not multiple of erasesize\n");

		ret = -EINVAL;

		goto error;

	}



	ret = register_device(name, start, len, (uint32_t)erasesize);

	if (ret)

		goto error;