* [syzbot] [mtd?] divide error in block2mtd_setup2
@ 2026-08-10 0:34 syzbot
2026-08-10 2:03 ` Jörn Engel
2026-08-10 9:12 ` [PATCH] mtd: block2mtd: Fix divide error when erase_size is zero Pei Xiao
0 siblings, 2 replies; 5+ messages in thread
From: syzbot @ 2026-08-10 0:34 UTC (permalink / raw)
To: joern, linux-kernel, linux-mtd, miquel.raynal, richard,
syzkaller-bugs, vigneshr
Hello,
syzbot found the following issue on:
HEAD commit: 848acc8ffe1b Merge tag 'fsverity-for-linus' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=149f2cc6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c05be6c9b0d36cb9
dashboard link: https://syzkaller.appspot.com/bug?extid=b320a4d5f65a61dbbf89
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-848acc8f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2425c07b5d46/vmlinux-848acc8f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cf278dd14da3/bzImage-848acc8f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5325 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Code: 48 8b 74 24 30 48 63 ce 48 89 d8 48 09 c8 48 c1 e8 20 4c 8b 64 24 10 74 0d 48 89 d8 48 99 48 f7 f9 49 89 d5 eb 09 89 d8 31 d2 <f7> f6 41 89 d5 31 ff 4c 89 ee e8 1f da 39 fb 4d 85 ed 0f 85 90 04
RSP: 0018:ffffc9000f26f9a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001f00000
RBP: ffffc9000f26fb98 R08: ffff8880353962ef R09: 1ffff11006a72c5d
R10: dffffc0000000000 R11: ffffed1006a72c5e R12: 0000000000000000
R13: ffff88801d02d0b4 R14: ffff8880122be000 R15: ffff8880122be000
FS: 00007fa7d8c5d6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa7d801bb30 CR3: 000000003fb3c000 CR4: 0000000000352ef0
Call Trace:
<TASK>
block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
param_attr_store+0x214/0x310 kernel/params.c:589
module_attr_store+0x65/0x90 kernel/params.c:904
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa7d7d9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa7d8c5cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa7d8025fa0 RCX: 00007fa7d7d9e019
RDX: 000000000000000c RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007fa7d7e3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa7d8026038 R14: 00007fa7d8025fa0 R15: 00007ffe5587a628
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Code: 48 8b 74 24 30 48 63 ce 48 89 d8 48 09 c8 48 c1 e8 20 4c 8b 64 24 10 74 0d 48 89 d8 48 99 48 f7 f9 49 89 d5 eb 09 89 d8 31 d2 <f7> f6 41 89 d5 31 ff 4c 89 ee e8 1f da 39 fb 4d 85 ed 0f 85 90 04
RSP: 0018:ffffc9000f26f9a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001f00000
RBP: ffffc9000f26fb98 R08: ffff8880353962ef R09: 1ffff11006a72c5d
R10: dffffc0000000000 R11: ffffed1006a72c5e R12: 0000000000000000
R13: ffff88801d02d0b4 R14: ffff8880122be000 R15: ffff8880122be000
FS: 00007fa7d8c5d6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffee237bf52 CR3: 000000003fb3c000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 48 8b 74 24 30 mov 0x30(%rsp),%rsi
5: 48 63 ce movslq %esi,%rcx
8: 48 89 d8 mov %rbx,%rax
b: 48 09 c8 or %rcx,%rax
e: 48 c1 e8 20 shr $0x20,%rax
12: 4c 8b 64 24 10 mov 0x10(%rsp),%r12
17: 74 0d je 0x26
19: 48 89 d8 mov %rbx,%rax
1c: 48 99 cqto
1e: 48 f7 f9 idiv %rcx
21: 49 89 d5 mov %rdx,%r13
24: eb 09 jmp 0x2f
26: 89 d8 mov %ebx,%eax
28: 31 d2 xor %edx,%edx
* 2a: f7 f6 div %esi <-- trapping instruction
2c: 41 89 d5 mov %edx,%r13d
2f: 31 ff xor %edi,%edi
31: 4c 89 ee mov %r13,%rsi
34: e8 1f da 39 fb call 0xfb39da58
39: 4d 85 ed test %r13,%r13
3c: 0f .byte 0xf
3d: 85 .byte 0x85
3e: 90 nop
3f: 04 .byte 0x4
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [mtd?] divide error in block2mtd_setup2
2026-08-10 0:34 [syzbot] [mtd?] divide error in block2mtd_setup2 syzbot
@ 2026-08-10 2:03 ` Jörn Engel
2026-08-10 9:17 ` Pei Xiao
2026-08-10 9:12 ` [PATCH] mtd: block2mtd: Fix divide error when erase_size is zero Pei Xiao
1 sibling, 1 reply; 5+ messages in thread
From: Jörn Engel @ 2026-08-10 2:03 UTC (permalink / raw)
To: syzbot
Cc: joern, linux-kernel, linux-mtd, miquel.raynal, richard,
syzkaller-bugs, vigneshr
On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
>
> * 2a: f7 f6 div %esi <-- trapping instruction
Best guess would be this:
if ((long)size % erase_size) {
Someone passing an erase_size of 0 would indeed trigger an exception.
Fix would be something like this:
- if ((long)size % erase_size) {
+ if (!erase_size || (long)size % erase_size) {
I haven't touched the code is nearly two decades. If somebody else
feels like sending a patch and gathering all the glory, please be my
guest!
Jörn
--
Those who come seeking peace without a treaty are plotting.
-- Sun Tzu
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [syzbot] [mtd?] divide error in block2mtd_setup2
2026-08-10 2:03 ` Jörn Engel
@ 2026-08-10 9:17 ` Pei Xiao
2026-08-10 12:40 ` Miquel Raynal
0 siblings, 1 reply; 5+ messages in thread
From: Pei Xiao @ 2026-08-10 9:17 UTC (permalink / raw)
To: Jörn Engel, syzbot
Cc: joern, linux-kernel, linux-mtd, miquel.raynal, richard,
syzkaller-bugs, vigneshr
在 2026/8/10 10:03, Jörn Engel 写道:
> On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
>>
>> * 2a: f7 f6 div %esi <-- trapping instruction
>
> Best guess would be this:
>
> if ((long)size % erase_size) {
>
> Someone passing an erase_size of 0 would indeed trigger an exception.
> Fix would be something like this:
>
> - if ((long)size % erase_size) {
> + if (!erase_size || (long)size % erase_size) {
>
> I haven't touched the code is nearly two decades. If somebody else
> feels like sending a patch and gathering all the glory, please be my
> guest!
Thank you for your contribution. I have sent this patch, but I forgot to
add the Suggested-by: tag
Thanks！
Pei.
>
> Jörn
>
> --
> Those who come seeking peace without a treaty are plotting.
> -- Sun Tzu
>
> ______________________________________________________
> Linux MTD discussion mailing list
> http://lists.infradead.org/mailman/listinfo/linux-mtd/
>
> From mboxrd@z Thu Jan 1 00:00:00 1970
> Received: from mx01.bremer-it.com (mx01.bremer-it.com [85.215.132.167])
> (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
> (No client certificate requested)
> by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73877212550
> for <linux-kernel@vger.kernel.org>; Mon, 10 Aug 2026 02:11:08 +0000 (UTC)
> Authentication-Results: smtp.subspace.kernel.org; arc=ne smtp.client-ip….215.132.167
> ARC-Seal:i= a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
> t\x1786327871; cv=none; b=pmhQ+YkskPdHVocSl0Q3ONibHDLR7s7fI85cff5H13l/yM9Z8mDYTBscKANq7mGFD2ASRqvBgqTpqe5XwuxKTwZFODwuxMgU6JESnW9mL+RH7dPhx/4yRbt05Zn2YwFK2lesfp+iHyordavupm+PNHamOQyJJwTUw9tjZZ0ntHAARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
> s=c-20240116; t\x1786327871; c=relaxed/simple;
> bh=oRdL2tBTFal/JDe029vqeCkmNFJ6Y4/KQ2bpPcX7k=;
> hÚte:From:To:Cc:Subject:Message-ID:References:MIME-Version:
> Content-Type:Content-Disposition:In-Reply-To; b=XeZFkoGl/EX953bQRJEM5Tfe5d/GrpVVJUzcDSc66bRWr8I0onQDDy/7EWgIvCiEGhJzItU2sfKSjm4pNpXCnZj6NtzWG6zriQzO7WsKIZ2npUEbzkr9fxYKPgNq7NiBQehPlmVw8mZbzVsaVdvKHi5zwE5zILA9+gU9cPWxcARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.fromºrelysecure.org; spf=pass smtp.mailfromºrelysecure.org; dkim=pass (2048-bit key) header.dºrelysecure.org header.i=@barelysecure.org header.b=HAaxkQ/6; arc=none smtp.client-ip….215.132.167
> Authentication-Results: smtp.subspace.kernel.org; dmarc=ss (p=none dis=none) header.fromºrelysecure.org
> Authentication-Results: smtp.subspace.kernel.org; spf=ss smtp.mailfromºrelysecure.org
> Authentication-Results: smtp.subspace.kernel.org;
> dkim=ss (2048-bit key) header.dºrelysecure.org header.i=@barelysecure.org header.b="HAaxkQ/6"
> Received: from cashel.logfs.org (c-98-33-96-243.hsd1.ca.comcast.net [98.33.96.243])
> (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
> key-exchange ECDHE (prime256v1) server-signature ECDSA (secp384r1) server-digest SHA384)
> (No client certificate requested)
> by mx01.bremer-it.com (Postfix) with ESMTPSA id 061CA20B86;
> Mon, 10 Aug 2026 04:03:25 +0200 (CEST)
> DKIM-Signature: v= a=rsa-sha256; c=relaxed/relaxed; dºrelysecure.org;
> s=im68; t\x1786327408;
> h=om:from:reply-to:subject:subject:date:date:message-id:message-id:
> to:to:cc:cc:mime-version:mime-version:content-type:content-type:
> content-transfer-encoding:content-transfer-encoding:
> in-reply-to:in-reply-to:references:references;
> bhÍIDTuliDDGgOAKpI245cMmyPRVVKxIWKH3GuXafqZA=;
> b=HAaxkQ/6AawUqio6ZtZxsW0LqcdaN10B/vRSFk0TcWRBU45jxR+oipsFDUbLTtUrltNgoq
> SUJTT9FHYYItqxPYvDw94jAGkuvJipWw3nalbM+Kl5az2K2VReh3w5eQsKr6sdoXp2TYzJ
> R/1QaEGzKjPtOIK5qoT0bvc6jV/0DL6pI9DWuc6O6DxxGrPYGtwZo2mUmQAuO9Qnm4Snbc
> xSJC10kazHhQLi5gnGRmMR3oz+JF66HhtQ+ApzYgkv3zty8o4P/Vk4Bj7YXV9UTiPwdcJq
> HVIfjaeb2e+Z+Q1K56IpiPILzHBRAYt0tcFSf+P7vSEEBvoUD2BFobn0ZIvA2Q=Authentication-Results: ORIGINATING;
> auth=ss smtp.auth=joern@lazybastard.org smtp.mailfrom=joern@barelysecure.org
> Date: Sun, 9 Aug 2026 19:03:22 -0700
> From: =so-8859-1?Q?Jörn?= Engel <joern@barelysecure.org>
> To: syzbot <syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com>
> Cc: joern@lazybastard.org, linux-kernel@vger.kernel.org,
> linux-mtd@lists.infradead.org, miquel.raynal@bootlin.com,
> richard@nod.at, syzkaller-bugs@googlegroups.com, vigneshr@ti.com
> Subject: Re: [syzbot] [mtd?] divide error in block2mtd_setup2
> Message-ID: <ankxaiwtTltL0xMj@cashel.logfs.org>
> References: <6a791c94.01d0871a.3a0d52.009b.GAE@google.com>
> Precedence: bulk
> X-Mailing-List: linux-kernel@vger.kernel.org
> List-Id: <linux-kernel.vger.kernel.org>
> List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
> List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
> MIME-Version: 1.0
> Content-Type: text/plain; charset=o-8859-1
> Content-Disposition: inline
> Content-Transfer-Encoding: 8bit
> In-Reply-To: <6a791c94.01d0871a.3a0d52.009b.GAE@google.com>
> X-Spam-Level: *
> X-Rspamd-Action: no action
> X-Spamd-Result: default: False [1.40 / 14.00];
> SUSPICIOUS_RECIPS(1.50)[];
> MIME_GOOD(-0.10)[text/plain];
> ARC_NA(0.00)[];
> TAGGED_RCPT(0.00)[b320a4d5f65a61dbbf89];
> RCVD_COUNT_ZERO(0.00)[0];
> ASN(0.00)[asn:7922, ipnet:98.32.0.0/11, country:US];
> MIME_TRACE(0.00)[0:+];
> MISSING_XM_UA(0.00)[];
> RCPT_COUNT_SEVEN(0.00)[8];
> FROM_HAS_DN(0.00)[];
> ALIAS_RESOLVED(0.00)[];
> LOCAL_OUTBOUND(0.00)[];
> FROM_EQ_ENVFROM(0.00)[];
> TO_DN_SOME(0.00)[];
> TO_MATCH_ENVRCPT_SOME(0.00)[];
> DKIM_SIGNED(0.00)[barelysecure.org:s=im68];
> URIBL_BLOCKED(0.00)[cashel.logfs.org:mid,cashel.logfs.org:helo];
> SUBJECT_HAS_QUESTION(0.00)[]
> X-Rspamd-Server: server01
> X-Rspamd-Queue-Id: 061CA20B86
> X-Spamd-Bar: +
>
> On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
>>
>> * 2a: f7 f6 div %esi <-- trapping instruction
>
> Best guess would be this:
>
> if ((long)size % erase_size) {
>
> Someone passing an erase_size of 0 would indeed trigger an exception.
> Fix would be something like this:
>
> - if ((long)size % erase_size) {
> + if (!erase_size || (long)size % erase_size) {
>
> I haven't touched the code is nearly two decades. If somebody else
> feels like sending a patch and gathering all the glory, please be my
> guest!
>
> Jörn
>
> --
> Those who come seeking peace without a treaty are plotting.
> -- Sun Tzu
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [syzbot] [mtd?] divide error in block2mtd_setup2
2026-08-10 9:17 ` Pei Xiao
@ 2026-08-10 12:40 ` Miquel Raynal
0 siblings, 0 replies; 5+ messages in thread
From: Miquel Raynal @ 2026-08-10 12:40 UTC (permalink / raw)
To: Pei Xiao
Cc: Jörn Engel, syzbot, joern, linux-kernel, linux-mtd, richard,
syzkaller-bugs, vigneshr
Hi Pei,
>> Best guess would be this:
>>
>> if ((long)size % erase_size) {
>>
>> Someone passing an erase_size of 0 would indeed trigger an exception.
>> Fix would be something like this:
>>
>> - if ((long)size % erase_size) {
>> + if (!erase_size || (long)size % erase_size) {
>>
>> I haven't touched the code is nearly two decades. If somebody else
>> feels like sending a patch and gathering all the glory, please be my
>> guest!
> Thank you for your contribution. I have sent this patch, but I forgot to
> add the Suggested-by: tag
You are invited to send a v2 with the said tag :)
Thanks,
Miquèl
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] mtd: block2mtd: Fix divide error when erase_size is zero
2026-08-10 0:34 [syzbot] [mtd?] divide error in block2mtd_setup2 syzbot
2026-08-10 2:03 ` Jörn Engel
@ 2026-08-10 9:12 ` Pei Xiao
1 sibling, 0 replies; 5+ messages in thread
From: Pei Xiao @ 2026-08-10 9:12 UTC (permalink / raw)
To: syzbot+b320a4d5f65a61dbbf89
Cc: joern, linux-kernel, linux-mtd, miquel.raynal, richard,
syzkaller-bugs, vigneshr, Pei Xiao, stable
The erase size is parsed from the "block2mtd" module parameter and can
be set to zero. add_device() then evaluates
if ((long)size % erase_size)
with a zero divisor, which triggers a divide error:
divide error: 0000 [#1] PREEMPT SMP PTI
RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline]
RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mtd.c:459
Call Trace:
block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476
param_attr_store+0x214/0x310 kernel/params.c:589
module_attr_store+0x65/0x90 kernel/params.c:904
kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
...
Reject a zero erase size before performing the modulo operation so the
existing "erasesize must be a divisor of device size" error path
reports the invalid argument and frees the device.
Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size")
Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6a791c94.01d0871a.3a0d52.009b.GAE@google.com/T/#m5d4961a95b273da06457d603ddcc4170bf82a9fd
Cc: stable@vger.kernel.org
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
---
drivers/mtd/devices/block2mtd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index 03e80b2c4f5a..349fa07be314 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -293,7 +293,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size,
}
size = bdev_nr_bytes(bdev);
- if ((long)size % erase_size) {
+ if (!erase_size || (long)size % erase_size) {
pr_err("erasesize must be a divisor of device size\n");
goto err_free_block2mtd;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-08-10 12:40 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-10 0:34 [syzbot] [mtd?] divide error in block2mtd_setup2 syzbot
2026-08-10 2:03 ` Jörn Engel
2026-08-10 9:17 ` Pei Xiao
2026-08-10 12:40 ` Miquel Raynal
2026-08-10 9:12 ` [PATCH] mtd: block2mtd: Fix divide error when erase_size is zero Pei Xiao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox