[syzbot] [mtd?] divide error in block2mtd_setup2

[syzbot] [mtd?] divide error in block2mtd_setup2

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    848acc8ffe1b Merge tag 'fsverity-for-linus' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=149f2cc6580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c05be6c9b0d36cb9
dashboard link: https://syzkaller.appspot.com/bug?extid=b320a4d5f65a61dbbf89
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-848acc8f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2425c07b5d46/vmlinux-848acc8f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cf278dd14da3/bzImage-848acc8f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com

Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Code: 48 8b 74 24 30 48 63 ce 48 89 d8 48 09 c8 48 c1 e8 20 4c 8b 64 24 10 74 0d 48 89 d8 48 99 48 f7 f9 49 89 d5 eb 09 89 d8 31 d2 <f7> f6 41 89 d5 31 ff 4c 89 ee e8 1f da 39 fb 4d 85 ed 0f 85 90 04
RSP: 0018:ffffc9000f26f9a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001f00000
RBP: ffffc9000f26fb98 R08: ffff8880353962ef R09: 1ffff11006a72c5d
R10: dffffc0000000000 R11: ffffed1006a72c5e R12: 0000000000000000
R13: ffff88801d02d0b4 R14: ffff8880122be000 R15: ffff8880122be000
FS:  00007fa7d8c5d6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa7d801bb30 CR3: 000000003fb3c000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
 param_attr_store+0x214/0x310 kernel/params.c:589
 module_attr_store+0x65/0x90 kernel/params.c:904
 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x612/0xba0 fs/read_write.c:687
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa7d7d9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa7d8c5cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa7d8025fa0 RCX: 00007fa7d7d9e019
RDX: 000000000000000c RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007fa7d7e3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa7d8026038 R14: 00007fa7d8025fa0 R15: 00007ffe5587a628
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Code: 48 8b 74 24 30 48 63 ce 48 89 d8 48 09 c8 48 c1 e8 20 4c 8b 64 24 10 74 0d 48 89 d8 48 99 48 f7 f9 49 89 d5 eb 09 89 d8 31 d2 <f7> f6 41 89 d5 31 ff 4c 89 ee e8 1f da 39 fb 4d 85 ed 0f 85 90 04
RSP: 0018:ffffc9000f26f9a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001f00000
RBP: ffffc9000f26fb98 R08: ffff8880353962ef R09: 1ffff11006a72c5d
R10: dffffc0000000000 R11: ffffed1006a72c5e R12: 0000000000000000
R13: ffff88801d02d0b4 R14: ffff8880122be000 R15: ffff8880122be000
FS:  00007fa7d8c5d6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee237bf52 CR3: 000000003fb3c000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	48 8b 74 24 30       	mov    0x30(%rsp),%rsi
   5:	48 63 ce             	movslq %esi,%rcx
   8:	48 89 d8             	mov    %rbx,%rax
   b:	48 09 c8             	or     %rcx,%rax
   e:	48 c1 e8 20          	shr    $0x20,%rax
  12:	4c 8b 64 24 10       	mov    0x10(%rsp),%r12
  17:	74 0d                	je     0x26
  19:	48 89 d8             	mov    %rbx,%rax
  1c:	48 99                	cqto
  1e:	48 f7 f9             	idiv   %rcx
  21:	49 89 d5             	mov    %rdx,%r13
  24:	eb 09                	jmp    0x2f
  26:	89 d8                	mov    %ebx,%eax
  28:	31 d2                	xor    %edx,%edx
* 2a:	f7 f6                	div    %esi <-- trapping instruction
  2c:	41 89 d5             	mov    %edx,%r13d
  2f:	31 ff                	xor    %edi,%edi
  31:	4c 89 ee             	mov    %r13,%rsi
  34:	e8 1f da 39 fb       	call   0xfb39da58
  39:	4d 85 ed             	test   %r13,%r13
  3c:	0f                   	.byte 0xf
  3d:	85                   	.byte 0x85
  3e:	90                   	nop
  3f:	04                   	.byte 0x4


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mtd?] divide error in block2mtd_setup2

[Jörn Engel]

On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
> 
> * 2a:	f7 f6                	div    %esi <-- trapping instruction

Best guess would be this:

	if ((long)size % erase_size) {

Someone passing an erase_size of 0 would indeed trigger an exception.
Fix would be something like this:

-	if ((long)size % erase_size) {
+	if (!erase_size || (long)size % erase_size) {

I haven't touched the code is nearly two decades.  If somebody else
feels like sending a patch and gathering all the glory, please be my
guest!

Jörn

--
Those who come seeking peace without a treaty are plotting.
-- Sun Tzu

[PATCH] mtd: block2mtd: Fix divide error when erase_size is zero

[Pei Xiao]

The erase size is parsed from the "block2mtd" module parameter and can
be set to zero. add_device() then evaluates

	if ((long)size % erase_size)

with a zero divisor, which triggers a divide error:

	divide error: 0000 [#1] PREEMPT SMP PTI
	RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
	RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
	Call Trace:
	 block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
	 param_attr_store+0x214/0x310 kernel/params.c:589
	 module_attr_store+0x65/0x90 kernel/params.c:904
	 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
	 ...

Reject a zero erase size before performing the modulo operation so the
existing "erasesize must be a divisor of device size" error path
reports the invalid argument and frees the device.

Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size")
Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a791c94.01d0871a.3a0d52.009b.GAE@google.com/T/#m5d4961a95b273da06457d603ddcc4170bf82a9fd
Cc: stable@vger.kernel.org
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
---
 drivers/mtd/devices/block2mtd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index 03e80b2c4f5a..349fa07be314 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -293,7 +293,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size,
 	}
 
 	size = bdev_nr_bytes(bdev);
-	if ((long)size % erase_size) {
+	if (!erase_size || (long)size % erase_size) {
 		pr_err("erasesize must be a divisor of device size\n");
 		goto err_free_block2mtd;
 	}
-- 
2.25.1

Re: [syzbot] [mtd?] divide error in block2mtd_setup2

[Pei Xiao]

在 2026/8/10 10:03, Jörn Engel 写道:
> On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
>>
>> * 2a:	f7 f6                	div    %esi <-- trapping instruction
> 
> Best guess would be this:
> 
> 	if ((long)size % erase_size) {
> 
> Someone passing an erase_size of 0 would indeed trigger an exception.
> Fix would be something like this:
> 
> -	if ((long)size % erase_size) {
> +	if (!erase_size || (long)size % erase_size) {
> 
> I haven't touched the code is nearly two decades.  If somebody else
> feels like sending a patch and gathering all the glory, please be my
> guest!
Thank you for your contribution. I have sent this patch, but I forgot to
add the Suggested-by: tag

Thanks！
Pei.
> 
> Jörn
> 
> --
> Those who come seeking peace without a treaty are plotting.
> -- Sun Tzu
> 
> ______________________________________________________
> Linux MTD discussion mailing list
> http://lists.infradead.org/mailman/listinfo/linux-mtd/
> 
> From mboxrd@z Thu Jan  1 00:00:00 1970
> Received: from mx01.bremer-it.com (mx01.bremer-it.com [85.215.132.167])
> 	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
> 	(No client certificate requested)
> 	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73877212550
> 	for <linux-kernel@vger.kernel.org>; Mon, 10 Aug 2026 02:11:08 +0000 (UTC)
> Authentication-Results: smtp.subspace.kernel.org; arc=ne smtp.client-ip….215.132.167
> ARC-Seal:i= a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
> 	t\x1786327871; cv=none; b=pmhQ+YkskPdHVocSl0Q3ONibHDLR7s7fI85cff5H13l/yM9Z8mDYTBscKANq7mGFD2ASRqvBgqTpqe5XwuxKTwZFODwuxMgU6JESnW9mL+RH7dPhx/4yRbt05Zn2YwFK2lesfp+iHyordavupm+PNHamOQyJJwTUw9tjZZ0ntHAARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
> 	s=c-20240116; t\x1786327871; c=relaxed/simple;
> 	bh=oRdL2tBTFal/JDe029vqeCkmNFJ6Y4/KQ2bpPcX7k=;
> 	hÚte:From:To:Cc:Subject:Message-ID:References:MIME-Version:
> 	 Content-Type:Content-Disposition:In-Reply-To; b=XeZFkoGl/EX953bQRJEM5Tfe5d/GrpVVJUzcDSc66bRWr8I0onQDDy/7EWgIvCiEGhJzItU2sfKSjm4pNpXCnZj6NtzWG6zriQzO7WsKIZ2npUEbzkr9fxYKPgNq7NiBQehPlmVw8mZbzVsaVdvKHi5zwE5zILA9+gU9cPWxcARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.fromºrelysecure.org; spf=pass smtp.mailfromºrelysecure.org; dkim=pass (2048-bit key) header.dºrelysecure.org header.i=@barelysecure.org header.b=HAaxkQ/6; arc=none smtp.client-ip….215.132.167
> Authentication-Results: smtp.subspace.kernel.org; dmarc=ss (p=none dis=none) header.fromºrelysecure.org
> Authentication-Results: smtp.subspace.kernel.org; spf=ss smtp.mailfromºrelysecure.org
> Authentication-Results: smtp.subspace.kernel.org;
> 	dkim=ss (2048-bit key) header.dºrelysecure.org header.i=@barelysecure.org header.b="HAaxkQ/6"
> Received: from cashel.logfs.org (c-98-33-96-243.hsd1.ca.comcast.net [98.33.96.243])
> 	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
> 	 key-exchange ECDHE (prime256v1) server-signature ECDSA (secp384r1) server-digest SHA384)
> 	(No client certificate requested)
> 	by mx01.bremer-it.com (Postfix) with ESMTPSA id 061CA20B86;
> 	Mon, 10 Aug 2026 04:03:25 +0200 (CEST)
> DKIM-Signature: v= a=rsa-sha256; c=relaxed/relaxed; dºrelysecure.org;
> 	s=im68; t\x1786327408;
> 	h=om:from:reply-to:subject:subject:date:date:message-id:message-id:
> 	 to:to:cc:cc:mime-version:mime-version:content-type:content-type:
> 	 content-transfer-encoding:content-transfer-encoding:
> 	 in-reply-to:in-reply-to:references:references;
> 	bhÍIDTuliDDGgOAKpI245cMmyPRVVKxIWKH3GuXafqZA=;
> 	b=HAaxkQ/6AawUqio6ZtZxsW0LqcdaN10B/vRSFk0TcWRBU45jxR+oipsFDUbLTtUrltNgoq
> 	SUJTT9FHYYItqxPYvDw94jAGkuvJipWw3nalbM+Kl5az2K2VReh3w5eQsKr6sdoXp2TYzJ
> 	R/1QaEGzKjPtOIK5qoT0bvc6jV/0DL6pI9DWuc6O6DxxGrPYGtwZo2mUmQAuO9Qnm4Snbc
> 	xSJC10kazHhQLi5gnGRmMR3oz+JF66HhtQ+ApzYgkv3zty8o4P/Vk4Bj7YXV9UTiPwdcJq
> 	HVIfjaeb2e+Z+Q1K56IpiPILzHBRAYt0tcFSf+P7vSEEBvoUD2BFobn0ZIvA2Q=Authentication-Results: ORIGINATING;
> 	auth=ss smtp.auth=joern@lazybastard.org smtp.mailfrom=joern@barelysecure.org
> Date: Sun, 9 Aug 2026 19:03:22 -0700
> From: =so-8859-1?Q?Jörn?= Engel <joern@barelysecure.org>
> To: syzbot <syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com>
> Cc: joern@lazybastard.org, linux-kernel@vger.kernel.org,
> 	linux-mtd@lists.infradead.org, miquel.raynal@bootlin.com,
> 	richard@nod.at, syzkaller-bugs@googlegroups.com, vigneshr@ti.com
> Subject: Re: [syzbot] [mtd?] divide error in block2mtd_setup2
> Message-ID: <ankxaiwtTltL0xMj@cashel.logfs.org>
> References: <6a791c94.01d0871a.3a0d52.009b.GAE@google.com>
> Precedence: bulk
> X-Mailing-List: linux-kernel@vger.kernel.org
> List-Id: <linux-kernel.vger.kernel.org>
> List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
> List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
> MIME-Version: 1.0
> Content-Type: text/plain; charset=o-8859-1
> Content-Disposition: inline
> Content-Transfer-Encoding: 8bit
> In-Reply-To: <6a791c94.01d0871a.3a0d52.009b.GAE@google.com>
> X-Spam-Level: *
> X-Rspamd-Action: no action
> X-Spamd-Result: default: False [1.40 / 14.00];
> 	SUSPICIOUS_RECIPS(1.50)[];
> 	MIME_GOOD(-0.10)[text/plain];
> 	ARC_NA(0.00)[];
> 	TAGGED_RCPT(0.00)[b320a4d5f65a61dbbf89];
> 	RCVD_COUNT_ZERO(0.00)[0];
> 	ASN(0.00)[asn:7922, ipnet:98.32.0.0/11, country:US];
> 	MIME_TRACE(0.00)[0:+];
> 	MISSING_XM_UA(0.00)[];
> 	RCPT_COUNT_SEVEN(0.00)[8];
> 	FROM_HAS_DN(0.00)[];
> 	ALIAS_RESOLVED(0.00)[];
> 	LOCAL_OUTBOUND(0.00)[];
> 	FROM_EQ_ENVFROM(0.00)[];
> 	TO_DN_SOME(0.00)[];
> 	TO_MATCH_ENVRCPT_SOME(0.00)[];
> 	DKIM_SIGNED(0.00)[barelysecure.org:s=im68];
> 	URIBL_BLOCKED(0.00)[cashel.logfs.org:mid,cashel.logfs.org:helo];
> 	SUBJECT_HAS_QUESTION(0.00)[]
> X-Rspamd-Server: server01
> X-Rspamd-Queue-Id: 061CA20B86
> X-Spamd-Bar: +
> 
> On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
>>
>> * 2a:	f7 f6                	div    %esi <-- trapping instruction
> 
> Best guess would be this:
> 
> 	if ((long)size % erase_size) {
> 
> Someone passing an erase_size of 0 would indeed trigger an exception.
> Fix would be something like this:
> 
> -	if ((long)size % erase_size) {
> +	if (!erase_size || (long)size % erase_size) {
> 
> I haven't touched the code is nearly two decades.  If somebody else
> feels like sending a patch and gathering all the glory, please be my
> guest!
> 
> Jörn
> 
> --
> Those who come seeking peace without a treaty are plotting.
> -- Sun Tzu
> 

Re: [syzbot] [mtd?] divide error in block2mtd_setup2

[Miquel Raynal]

Hi Pei,

>> Best guess would be this:
>> 
>> 	if ((long)size % erase_size) {
>> 
>> Someone passing an erase_size of 0 would indeed trigger an exception.
>> Fix would be something like this:
>> 
>> -	if ((long)size % erase_size) {
>> +	if (!erase_size || (long)size % erase_size) {
>> 
>> I haven't touched the code is nearly two decades.  If somebody else
>> feels like sending a patch and gathering all the glory, please be my
>> guest!
> Thank you for your contribution. I have sent this patch, but I forgot to
> add the Suggested-by: tag

You are invited to send a v2 with the said tag :)

Thanks,
Miquèl

Re: [syzbot] [mtd?] divide error in block2mtd_setup2

[Jörn Engel]

On Sun, Aug 09, 2026 at 07:03:22PM -0700, Jörn Engel wrote:
> 
> Best guess would be this:
> 
> 	if ((long)size % erase_size) {

While at it, what purpose does the cast to (long) serve?

As far as I can see, it is useless and should be removed.  Fabian, do
you remember why it was necessary?

Jörn

--
The real voyage of discovery consists not in seeking new landscapes,
but in having new eyes.
-- Marcel Proust