* FAILED: patch "[PATCH] mtd: block2mtd: Fix divide error when erase_size is zero" failed to apply to 6.6-stable tree
@ 2026-10-05 14:32 gregkh
2026-10-06 15:39 ` Sasha Levin
0 siblings, 1 reply; 5+ messages in thread
From: gregkh @ 2026-10-05 14:32 UTC (permalink / raw)
To: xiaopei01, joern, miquel.raynal; +Cc: stable
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x b5965c4221165045e19736794ca5f48ae3d67142
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026100520-kilogram-result-00fb@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From b5965c4221165045e19736794ca5f48ae3d67142 Mon Sep 17 00:00:00 2001
From: Pei Xiao <xiaopei01@kylinos.cn>
Date: Thu, 13 Aug 2026 10:48:12 +0800
Subject: [PATCH] mtd: block2mtd: Fix divide error when erase_size is zero
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The erase size is parsed from the "block2mtd" module parameter and can
be set to zero. add_device() then evaluates
if (size % erase_size)
with a zero divisor, which triggers a divide error:
divide error: 0000 [#1] PREEMPT SMP PTI
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Call Trace:
block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
param_attr_store+0x214/0x310 kernel/params.c:589
module_attr_store+0x65/0x90 kernel/params.c:904
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
...
Reject a zero erase size before performing the modulo operation so the
existing "erasesize must be a divisor of device size" error path
reports the invalid argument and frees the device.
Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size")
Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/6a7b58ba.ac361c09.22ff0a.0045.GAE@google.com/
Suggested-by: Jörn Engel <joern@barelysecure.org>
Cc: stable@vger.kernel.org
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index 03e80b2c4f5a..349fa07be314 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -293,7 +293,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size,
}
size = bdev_nr_bytes(bdev);
- if ((long)size % erase_size) {
+ if (!erase_size || (long)size % erase_size) {
pr_err("erasesize must be a divisor of device size\n");
goto err_free_block2mtd;
}
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 6.6.y 1/3] mtd: block2mtd: Convert to bdev_open_by_dev/path() 2026-10-05 14:32 FAILED: patch "[PATCH] mtd: block2mtd: Fix divide error when erase_size is zero" failed to apply to 6.6-stable tree gregkh @ 2026-10-06 15:39 ` Sasha Levin 0 siblings, 0 replies; 5+ messages in thread From: Sasha Levin @ 2026-10-06 15:39 UTC (permalink / raw) To: stable Cc: Jan Kara, Joern Engel, linux-mtd, Christoph Hellwig, Christian Brauner, Sasha Levin From: Jan Kara <jack@suse.cz> [ Upstream commit 3817d4b11212ca9d49d6e7141d41524aa48791c5 ] Convert block2mtd to use bdev_open_by_dev() and bdev_open_by_path() and pass the handle around. CC: Joern Engel <joern@lazybastard.org> CC: linux-mtd@lists.infradead.org Acked-by: Christoph Hellwig <hch@lst.de> Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230927093442.25915-12-jack@suse.cz Signed-off-by: Christian Brauner <brauner@kernel.org> Stable-dep-of: b5965c422116 ("mtd: block2mtd: Fix divide error when erase_size is zero") Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/mtd/devices/block2mtd.c | 51 +++++++++++++++++++-------------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c index be106dc20ff3c..aa44a23ec0451 100644 --- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -37,7 +37,7 @@ /* Info for the block device */ struct block2mtd_dev { struct list_head list; - struct block_device *blkdev; + struct bdev_handle *bdev_handle; struct mtd_info mtd; struct mutex write_mutex; }; @@ -55,7 +55,8 @@ static struct page *page_read(struct address_space *mapping, pgoff_t index) /* erase a specified part of the device */ static int _block2mtd_erase(struct block2mtd_dev *dev, loff_t to, size_t len) { - struct address_space *mapping = dev->blkdev->bd_inode->i_mapping; + struct address_space *mapping = + dev->bdev_handle->bdev->bd_inode->i_mapping; struct page *page; pgoff_t index = to >> PAGE_SHIFT; // page index int pages = len >> PAGE_SHIFT; @@ -105,6 +106,8 @@ static int block2mtd_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char *buf) { struct block2mtd_dev *dev = mtd->priv; + struct address_space *mapping = + dev->bdev_handle->bdev->bd_inode->i_mapping; struct page *page; pgoff_t index = from >> PAGE_SHIFT; int offset = from & (PAGE_SIZE-1); @@ -117,7 +120,7 @@ static int block2mtd_read(struct mtd_info *mtd, loff_t from, size_t len, cpylen = len; // this page len = len - cpylen; - page = page_read(dev->blkdev->bd_inode->i_mapping, index); + page = page_read(mapping, index); if (IS_ERR(page)) return PTR_ERR(page); @@ -139,7 +142,8 @@ static int _block2mtd_write(struct block2mtd_dev *dev, const u_char *buf, loff_t to, size_t len, size_t *retlen) { struct page *page; - struct address_space *mapping = dev->blkdev->bd_inode->i_mapping; + struct address_space *mapping = + dev->bdev_handle->bdev->bd_inode->i_mapping; pgoff_t index = to >> PAGE_SHIFT; // page index int offset = to & ~PAGE_MASK; // page offset int cpylen; @@ -194,7 +198,7 @@ static int block2mtd_write(struct mtd_info *mtd, loff_t to, size_t len, static void block2mtd_sync(struct mtd_info *mtd) { struct block2mtd_dev *dev = mtd->priv; - sync_blockdev(dev->blkdev); + sync_blockdev(dev->bdev_handle->bdev); return; } @@ -206,10 +210,10 @@ static void block2mtd_free_device(struct block2mtd_dev *dev) kfree(dev->mtd.name); - if (dev->blkdev) { - invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping, - 0, -1); - blkdev_put(dev->blkdev, NULL); + if (dev->bdev_handle) { + invalidate_mapping_pages( + dev->bdev_handle->bdev->bd_inode->i_mapping, 0, -1); + bdev_release(dev->bdev_handle); } kfree(dev); @@ -219,10 +223,10 @@ static void block2mtd_free_device(struct block2mtd_dev *dev) * This function is marked __ref because it calls the __init marked * early_lookup_bdev when called from the early boot code. */ -static struct block_device __ref *mdtblock_early_get_bdev(const char *devname, +static struct bdev_handle __ref *mdtblock_early_get_bdev(const char *devname, blk_mode_t mode, int timeout, struct block2mtd_dev *dev) { - struct block_device *bdev = ERR_PTR(-ENODEV); + struct bdev_handle *bdev_handle = ERR_PTR(-ENODEV); #ifndef MODULE int i; @@ -230,7 +234,7 @@ static struct block_device __ref *mdtblock_early_get_bdev(const char *devname, * We can't use early_lookup_bdev from a running system. */ if (system_state >= SYSTEM_RUNNING) - return bdev; + return bdev_handle; /* * We might not have the root device mounted at this point. @@ -249,19 +253,20 @@ static struct block_device __ref *mdtblock_early_get_bdev(const char *devname, wait_for_device_probe(); if (!early_lookup_bdev(devname, &devt)) { - bdev = blkdev_get_by_dev(devt, mode, dev, NULL); - if (!IS_ERR(bdev)) + bdev_handle = bdev_open_by_dev(devt, mode, dev, NULL); + if (!IS_ERR(bdev_handle)) break; } } #endif - return bdev; + return bdev_handle; } static struct block2mtd_dev *add_device(char *devname, int erase_size, char *label, int timeout) { const blk_mode_t mode = BLK_OPEN_READ | BLK_OPEN_WRITE; + struct bdev_handle *bdev_handle; struct block_device *bdev; struct block2mtd_dev *dev; char *name; @@ -274,21 +279,23 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, return NULL; /* Get a handle on the device */ - bdev = blkdev_get_by_path(devname, mode, dev, NULL); - if (IS_ERR(bdev)) - bdev = mdtblock_early_get_bdev(devname, mode, timeout, dev); - if (IS_ERR(bdev)) { + bdev_handle = bdev_open_by_path(devname, mode, dev, NULL); + if (IS_ERR(bdev_handle)) + bdev_handle = mdtblock_early_get_bdev(devname, mode, timeout, + dev); + if (IS_ERR(bdev_handle)) { pr_err("error: cannot open device %s\n", devname); goto err_free_block2mtd; } - dev->blkdev = bdev; + dev->bdev_handle = bdev_handle; + bdev = bdev_handle->bdev; if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) { pr_err("attempting to use an MTD device as a block device\n"); goto err_free_block2mtd; } - if ((long)dev->blkdev->bd_inode->i_size % erase_size) { + if ((long)bdev->bd_inode->i_size % erase_size) { pr_err("erasesize must be a divisor of device size\n"); goto err_free_block2mtd; } @@ -306,7 +313,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, dev->mtd.name = name; - dev->mtd.size = dev->blkdev->bd_inode->i_size & PAGE_MASK; + dev->mtd.size = bdev->bd_inode->i_size & PAGE_MASK; dev->mtd.erasesize = erase_size; dev->mtd.writesize = 1; dev->mtd.writebufsize = PAGE_SIZE; -- 2.53.0 ______________________________________________________ Linux MTD discussion mailing list http://lists.infradead.org/mailman/listinfo/linux-mtd/ ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 6.6.y 1/3] mtd: block2mtd: Convert to bdev_open_by_dev/path() @ 2026-10-06 15:39 ` Sasha Levin 0 siblings, 0 replies; 5+ messages in thread From: Sasha Levin @ 2026-10-06 15:39 UTC (permalink / raw) To: stable Cc: Jan Kara, Joern Engel, linux-mtd, Christoph Hellwig, Christian Brauner, Sasha Levin From: Jan Kara <jack@suse.cz> [ Upstream commit 3817d4b11212ca9d49d6e7141d41524aa48791c5 ] Convert block2mtd to use bdev_open_by_dev() and bdev_open_by_path() and pass the handle around. CC: Joern Engel <joern@lazybastard.org> CC: linux-mtd@lists.infradead.org Acked-by: Christoph Hellwig <hch@lst.de> Acked-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Jan Kara <jack@suse.cz> Link: https://lore.kernel.org/r/20230927093442.25915-12-jack@suse.cz Signed-off-by: Christian Brauner <brauner@kernel.org> Stable-dep-of: b5965c422116 ("mtd: block2mtd: Fix divide error when erase_size is zero") Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/mtd/devices/block2mtd.c | 51 +++++++++++++++++++-------------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c index be106dc20ff3c..aa44a23ec0451 100644 --- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -37,7 +37,7 @@ /* Info for the block device */ struct block2mtd_dev { struct list_head list; - struct block_device *blkdev; + struct bdev_handle *bdev_handle; struct mtd_info mtd; struct mutex write_mutex; }; @@ -55,7 +55,8 @@ static struct page *page_read(struct address_space *mapping, pgoff_t index) /* erase a specified part of the device */ static int _block2mtd_erase(struct block2mtd_dev *dev, loff_t to, size_t len) { - struct address_space *mapping = dev->blkdev->bd_inode->i_mapping; + struct address_space *mapping = + dev->bdev_handle->bdev->bd_inode->i_mapping; struct page *page; pgoff_t index = to >> PAGE_SHIFT; // page index int pages = len >> PAGE_SHIFT; @@ -105,6 +106,8 @@ static int block2mtd_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char *buf) { struct block2mtd_dev *dev = mtd->priv; + struct address_space *mapping = + dev->bdev_handle->bdev->bd_inode->i_mapping; struct page *page; pgoff_t index = from >> PAGE_SHIFT; int offset = from & (PAGE_SIZE-1); @@ -117,7 +120,7 @@ static int block2mtd_read(struct mtd_info *mtd, loff_t from, size_t len, cpylen = len; // this page len = len - cpylen; - page = page_read(dev->blkdev->bd_inode->i_mapping, index); + page = page_read(mapping, index); if (IS_ERR(page)) return PTR_ERR(page); @@ -139,7 +142,8 @@ static int _block2mtd_write(struct block2mtd_dev *dev, const u_char *buf, loff_t to, size_t len, size_t *retlen) { struct page *page; - struct address_space *mapping = dev->blkdev->bd_inode->i_mapping; + struct address_space *mapping = + dev->bdev_handle->bdev->bd_inode->i_mapping; pgoff_t index = to >> PAGE_SHIFT; // page index int offset = to & ~PAGE_MASK; // page offset int cpylen; @@ -194,7 +198,7 @@ static int block2mtd_write(struct mtd_info *mtd, loff_t to, size_t len, static void block2mtd_sync(struct mtd_info *mtd) { struct block2mtd_dev *dev = mtd->priv; - sync_blockdev(dev->blkdev); + sync_blockdev(dev->bdev_handle->bdev); return; } @@ -206,10 +210,10 @@ static void block2mtd_free_device(struct block2mtd_dev *dev) kfree(dev->mtd.name); - if (dev->blkdev) { - invalidate_mapping_pages(dev->blkdev->bd_inode->i_mapping, - 0, -1); - blkdev_put(dev->blkdev, NULL); + if (dev->bdev_handle) { + invalidate_mapping_pages( + dev->bdev_handle->bdev->bd_inode->i_mapping, 0, -1); + bdev_release(dev->bdev_handle); } kfree(dev); @@ -219,10 +223,10 @@ static void block2mtd_free_device(struct block2mtd_dev *dev) * This function is marked __ref because it calls the __init marked * early_lookup_bdev when called from the early boot code. */ -static struct block_device __ref *mdtblock_early_get_bdev(const char *devname, +static struct bdev_handle __ref *mdtblock_early_get_bdev(const char *devname, blk_mode_t mode, int timeout, struct block2mtd_dev *dev) { - struct block_device *bdev = ERR_PTR(-ENODEV); + struct bdev_handle *bdev_handle = ERR_PTR(-ENODEV); #ifndef MODULE int i; @@ -230,7 +234,7 @@ static struct block_device __ref *mdtblock_early_get_bdev(const char *devname, * We can't use early_lookup_bdev from a running system. */ if (system_state >= SYSTEM_RUNNING) - return bdev; + return bdev_handle; /* * We might not have the root device mounted at this point. @@ -249,19 +253,20 @@ static struct block_device __ref *mdtblock_early_get_bdev(const char *devname, wait_for_device_probe(); if (!early_lookup_bdev(devname, &devt)) { - bdev = blkdev_get_by_dev(devt, mode, dev, NULL); - if (!IS_ERR(bdev)) + bdev_handle = bdev_open_by_dev(devt, mode, dev, NULL); + if (!IS_ERR(bdev_handle)) break; } } #endif - return bdev; + return bdev_handle; } static struct block2mtd_dev *add_device(char *devname, int erase_size, char *label, int timeout) { const blk_mode_t mode = BLK_OPEN_READ | BLK_OPEN_WRITE; + struct bdev_handle *bdev_handle; struct block_device *bdev; struct block2mtd_dev *dev; char *name; @@ -274,21 +279,23 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, return NULL; /* Get a handle on the device */ - bdev = blkdev_get_by_path(devname, mode, dev, NULL); - if (IS_ERR(bdev)) - bdev = mdtblock_early_get_bdev(devname, mode, timeout, dev); - if (IS_ERR(bdev)) { + bdev_handle = bdev_open_by_path(devname, mode, dev, NULL); + if (IS_ERR(bdev_handle)) + bdev_handle = mdtblock_early_get_bdev(devname, mode, timeout, + dev); + if (IS_ERR(bdev_handle)) { pr_err("error: cannot open device %s\n", devname); goto err_free_block2mtd; } - dev->blkdev = bdev; + dev->bdev_handle = bdev_handle; + bdev = bdev_handle->bdev; if (MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) { pr_err("attempting to use an MTD device as a block device\n"); goto err_free_block2mtd; } - if ((long)dev->blkdev->bd_inode->i_size % erase_size) { + if ((long)bdev->bd_inode->i_size % erase_size) { pr_err("erasesize must be a divisor of device size\n"); goto err_free_block2mtd; } @@ -306,7 +313,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, dev->mtd.name = name; - dev->mtd.size = dev->blkdev->bd_inode->i_size & PAGE_MASK; + dev->mtd.size = bdev->bd_inode->i_size & PAGE_MASK; dev->mtd.erasesize = erase_size; dev->mtd.writesize = 1; dev->mtd.writebufsize = PAGE_SIZE; -- 2.53.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 6.6.y 2/3] block2mtd: prevent direct access of bd_inode 2026-10-06 15:39 ` Sasha Levin (?) @ 2026-10-06 15:40 ` Sasha Levin -1 siblings, 0 replies; 5+ messages in thread From: Sasha Levin @ 2026-10-06 15:40 UTC (permalink / raw) To: stable Cc: Yu Kuai, Christoph Hellwig, Jan Kara, Al Viro, Christian Brauner, Sasha Levin From: Yu Kuai <yukuai3@huawei.com> [ Upstream commit c9600c63a694249100e2bdcbb604c30d8fee2dc7 ] All we need is size, and that can be obtained via bdev_nr_bytes() Signed-off-by: Yu Kuai <yukuai3@huawei.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Jan Kara <jack@suse.cz> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Link: https://lore.kernel.org/r/20240411145346.2516848-11-viro@zeniv.linux.org.uk Signed-off-by: Christian Brauner <brauner@kernel.org> Stable-dep-of: b5965c422116 ("mtd: block2mtd: Fix divide error when erase_size is zero") Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/mtd/devices/block2mtd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c index aa44a23ec0451..502c30124aa61 100644 --- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -269,6 +269,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, struct bdev_handle *bdev_handle; struct block_device *bdev; struct block2mtd_dev *dev; + loff_t size; char *name; if (!devname) @@ -295,7 +296,8 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, goto err_free_block2mtd; } - if ((long)bdev->bd_inode->i_size % erase_size) { + size = bdev_nr_bytes(bdev); + if ((long)size % erase_size) { pr_err("erasesize must be a divisor of device size\n"); goto err_free_block2mtd; } @@ -313,7 +315,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, dev->mtd.name = name; - dev->mtd.size = bdev->bd_inode->i_size & PAGE_MASK; + dev->mtd.size = size & PAGE_MASK; dev->mtd.erasesize = erase_size; dev->mtd.writesize = 1; dev->mtd.writebufsize = PAGE_SIZE; -- 2.53.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 6.6.y 3/3] mtd: block2mtd: Fix divide error when erase_size is zero 2026-10-06 15:39 ` Sasha Levin (?) (?) @ 2026-10-06 15:40 ` Sasha Levin -1 siblings, 0 replies; 5+ messages in thread From: Sasha Levin @ 2026-10-06 15:40 UTC (permalink / raw) To: stable Cc: Pei Xiao, syzbot+b320a4d5f65a61dbbf89, Jörn Engel, Miquel Raynal, Sasha Levin From: Pei Xiao <xiaopei01@kylinos.cn> [ Upstream commit b5965c4221165045e19736794ca5f48ae3d67142 ] The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates if (size % erase_size) with a zero divisor, which triggers a divide error: divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459 Call Trace: block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 param_attr_store+0x214/0x310 kernel/params.c:589 module_attr_store+0x65/0x90 kernel/params.c:904 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 ... Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device. Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size") Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/6a7b58ba.ac361c09.22ff0a.0045.GAE@google.com/ Suggested-by: Jörn Engel <joern@barelysecure.org> Cc: stable@vger.kernel.org Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/mtd/devices/block2mtd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c index 502c30124aa61..1eb6bcab7adc6 100644 --- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -297,7 +297,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size, } size = bdev_nr_bytes(bdev); - if ((long)size % erase_size) { + if (!erase_size || (long)size % erase_size) { pr_err("erasesize must be a divisor of device size\n"); goto err_free_block2mtd; } -- 2.53.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-06 15:40 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-10-05 14:32 FAILED: patch "[PATCH] mtd: block2mtd: Fix divide error when erase_size is zero" failed to apply to 6.6-stable tree gregkh 2026-10-06 15:39 ` [PATCH 6.6.y 1/3] mtd: block2mtd: Convert to bdev_open_by_dev/path() Sasha Levin 2026-10-06 15:39 ` Sasha Levin 2026-10-06 15:40 ` [PATCH 6.6.y 2/3] block2mtd: prevent direct access of bd_inode Sasha Levin 2026-10-06 15:40 ` [PATCH 6.6.y 3/3] mtd: block2mtd: Fix divide error when erase_size is zero Sasha Levin
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.