From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Pei Xiao <xiaopei01@kylinos.cn>
Cc: joern@lazybastard.org, richard@nod.at, vigneshr@ti.com,
linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org,
syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com,
"Jörn Engel" <joern@barelysecure.org>,
stable@vger.kernel.org
Subject: Re: [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zero
Date: Wed, 12 Aug 2026 14:34:04 +0200 [thread overview]
Message-ID: <871pc3msar.fsf@bootlin.com> (raw)
In-Reply-To: <48230456575d27aa83ce8640de8fc07cc62e8efb.1786499433.git.xiaopei01@kylinos.cn> (Pei Xiao's message of "Wed, 12 Aug 2026 09:52:42 +0800")
On 12/08/2026 at 09:52:42 +08, Pei Xiao <xiaopei01@kylinos.cn> wrote:
> The erase size is parsed from the "block2mtd" module parameter and can
> be set to zero. add_device() then evaluates
>
> if (size % erase_size)
>
> with a zero divisor, which triggers a divide error:
>
> divide error: 0000 [#1] PREEMPT SMP PTI
> RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
> RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
> Call Trace:
> block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
> param_attr_store+0x214/0x310 kernel/params.c:589
> module_attr_store+0x65/0x90 kernel/params.c:904
> kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
> ...
>
> Reject a zero erase size before performing the modulo operation so the
> existing "erasesize must be a divisor of device size" error path
> reports the invalid argument and frees the device.
>
> While at it, drop the unnecessary (long) cast from the size operand of
> the modulo.
>
> Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size")
> Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/6a7b58ba.ac361c09.22ff0a.0045.GAE@google.com/
> Suggested-by: Jörn Engel <joern@barelysecure.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Apparently, removing the cast leads to an unsupported operation with a
64-bit operand on 32-bit architectures (See Sashiko report).
I guess it is best to keep that cast in the end.
Sorry for the changes back-and-forth.
Miquèl
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
WARNING: multiple messages have this Message-ID (diff)
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Pei Xiao <xiaopei01@kylinos.cn>
Cc: joern@lazybastard.org, richard@nod.at, vigneshr@ti.com,
linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org,
syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com,
"Jörn Engel" <joern@barelysecure.org>,
stable@vger.kernel.org
Subject: Re: [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zero
Date: Wed, 12 Aug 2026 14:34:04 +0200 [thread overview]
Message-ID: <871pc3msar.fsf@bootlin.com> (raw)
In-Reply-To: <48230456575d27aa83ce8640de8fc07cc62e8efb.1786499433.git.xiaopei01@kylinos.cn> (Pei Xiao's message of "Wed, 12 Aug 2026 09:52:42 +0800")
On 12/08/2026 at 09:52:42 +08, Pei Xiao <xiaopei01@kylinos.cn> wrote:
> The erase size is parsed from the "block2mtd" module parameter and can
> be set to zero. add_device() then evaluates
>
> if (size % erase_size)
>
> with a zero divisor, which triggers a divide error:
>
> divide error: 0000 [#1] PREEMPT SMP PTI
> RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
> RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
> Call Trace:
> block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
> param_attr_store+0x214/0x310 kernel/params.c:589
> module_attr_store+0x65/0x90 kernel/params.c:904
> kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
> ...
>
> Reject a zero erase size before performing the modulo operation so the
> existing "erasesize must be a divisor of device size" error path
> reports the invalid argument and frees the device.
>
> While at it, drop the unnecessary (long) cast from the size operand of
> the modulo.
>
> Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size")
> Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/6a7b58ba.ac361c09.22ff0a.0045.GAE@google.com/
> Suggested-by: Jörn Engel <joern@barelysecure.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Apparently, removing the cast leads to an unsupported operation with a
64-bit operand on 32-bit architectures (See Sashiko report).
I guess it is best to keep that cast in the end.
Sorry for the changes back-and-forth.
Miquèl
next prev parent reply other threads:[~2026-08-12 12:34 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-12 1:52 [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zero Pei Xiao
2026-08-12 1:52 ` Pei Xiao
2026-08-12 12:34 ` Miquel Raynal [this message]
2026-08-12 12:34 ` Miquel Raynal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=871pc3msar.fsf@bootlin.com \
--to=miquel.raynal@bootlin.com \
--cc=joern@barelysecure.org \
--cc=joern@lazybastard.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=richard@nod.at \
--cc=stable@vger.kernel.org \
--cc=syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com \
--cc=vigneshr@ti.com \
--cc=xiaopei01@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.