]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
mtd: phram: Prevent divide by zero bug in phram_setup()
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 21 Jan 2022 11:55:05 +0000 (14:55 +0300)
committerPaolo Pisati <paolo.pisati@canonical.com>
Mon, 7 Mar 2022 10:44:11 +0000 (11:44 +0100)
commitd93cf1a712217e819674a119cc47f761cf6c3a7e
tree5dce3369d7dfc260e97c87cdb107bbcc6323b43b
parent66d7c7ab08a48ebd4b5870af1671231ba6ff00e0
mtd: phram: Prevent divide by zero bug in phram_setup()

BugLink: https://bugs.launchpad.net/bugs/1963890
commit 3e3765875b1b8864898603768fd5c93eeb552211 upstream.

The problem is that "erasesize" is a uint64_t type so it might be
non-zero but the lower 32 bits are zero so when it's truncated,
"(uint32_t)erasesize", then that value is zero. This leads to a
divide by zero bug.

Avoid the bug by delaying the divide until after we have validated
that "erasesize" is non-zero and within the uint32_t range.

Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220121115505.GI1978@kadam
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
drivers/mtd/devices/phram.c