All of lore.kernel.org
 help / color / mirror / Atom feed
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Pei Xiao <xiaopei01@kylinos.cn>
Cc: joern@lazybastard.org, richard@nod.at, vigneshr@ti.com,
	linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org,
	syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com,
	"Jörn Engel" <joern@barelysecure.org>,
	stable@vger.kernel.org
Subject: Re: [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zero
Date: Wed, 12 Aug 2026 14:34:04 +0200	[thread overview]
Message-ID: <871pc3msar.fsf@bootlin.com> (raw)
In-Reply-To: <48230456575d27aa83ce8640de8fc07cc62e8efb.1786499433.git.xiaopei01@kylinos.cn> (Pei Xiao's message of "Wed, 12 Aug 2026 09:52:42 +0800")

On 12/08/2026 at 09:52:42 +08, Pei Xiao <xiaopei01@kylinos.cn> wrote:

> The erase size is parsed from the "block2mtd" module parameter and can
> be set to zero. add_device() then evaluates
>
>         if (size % erase_size)
>
> with a zero divisor, which triggers a divide error:
>
>         divide error: 0000 [#1] PREEMPT SMP PTI
>         RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
>         RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
>         Call Trace:
>          block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
>          param_attr_store+0x214/0x310 kernel/params.c:589
>          module_attr_store+0x65/0x90 kernel/params.c:904
>          kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
>          ...
>
> Reject a zero erase size before performing the modulo operation so the
> existing "erasesize must be a divisor of device size" error path
> reports the invalid argument and frees the device.
>
> While at it, drop the unnecessary (long) cast from the size operand of
> the modulo.
>
> Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size")
> Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/6a7b58ba.ac361c09.22ff0a.0045.GAE@google.com/
> Suggested-by: Jörn Engel <joern@barelysecure.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>

Apparently, removing the cast leads to an unsupported operation with a
64-bit operand on 32-bit architectures (See Sashiko report).

I guess it is best to keep that cast in the end.

Sorry for the changes back-and-forth.

Miquèl

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

WARNING: multiple messages have this Message-ID (diff)
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Pei Xiao <xiaopei01@kylinos.cn>
Cc: joern@lazybastard.org, richard@nod.at, vigneshr@ti.com,
	linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org,
	syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com,
	"Jörn Engel" <joern@barelysecure.org>,
	stable@vger.kernel.org
Subject: Re: [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zero
Date: Wed, 12 Aug 2026 14:34:04 +0200	[thread overview]
Message-ID: <871pc3msar.fsf@bootlin.com> (raw)
In-Reply-To: <48230456575d27aa83ce8640de8fc07cc62e8efb.1786499433.git.xiaopei01@kylinos.cn> (Pei Xiao's message of "Wed, 12 Aug 2026 09:52:42 +0800")

On 12/08/2026 at 09:52:42 +08, Pei Xiao <xiaopei01@kylinos.cn> wrote:

> The erase size is parsed from the "block2mtd" module parameter and can
> be set to zero. add_device() then evaluates
>
>         if (size % erase_size)
>
> with a zero divisor, which triggers a divide error:
>
>         divide error: 0000 [#1] PREEMPT SMP PTI
>         RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
>         RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
>         Call Trace:
>          block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
>          param_attr_store+0x214/0x310 kernel/params.c:589
>          module_attr_store+0x65/0x90 kernel/params.c:904
>          kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
>          ...
>
> Reject a zero erase size before performing the modulo operation so the
> existing "erasesize must be a divisor of device size" error path
> reports the invalid argument and frees the device.
>
> While at it, drop the unnecessary (long) cast from the size operand of
> the modulo.
>
> Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size")
> Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/6a7b58ba.ac361c09.22ff0a.0045.GAE@google.com/
> Suggested-by: Jörn Engel <joern@barelysecure.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>

Apparently, removing the cast leads to an unsupported operation with a
64-bit operand on 32-bit architectures (See Sashiko report).

I guess it is best to keep that cast in the end.

Sorry for the changes back-and-forth.

Miquèl

  reply	other threads:[~2026-08-12 12:34 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-12  1:52 [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zero Pei Xiao
2026-08-12  1:52 ` Pei Xiao
2026-08-12 12:34 ` Miquel Raynal [this message]
2026-08-12 12:34   ` Miquel Raynal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=871pc3msar.fsf@bootlin.com \
    --to=miquel.raynal@bootlin.com \
    --cc=joern@barelysecure.org \
    --cc=joern@lazybastard.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mtd@lists.infradead.org \
    --cc=richard@nod.at \
    --cc=stable@vger.kernel.org \
    --cc=syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com \
    --cc=vigneshr@ti.com \
    --cc=xiaopei01@kylinos.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.