From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f200.google.com (mail-oi1-f200.google.com [209.85.167.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7239036C5B2 for ; Wed, 12 Aug 2026 01:41:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.200 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786498886; cv=none; b=qiDsADjUr1g+488tz+7XM7OwOTzDlDjXEXNG0L0DgSoJ5t5DxYogR2csoqO68Mb+rc1apUMJOjywjC6okNKASd8jYKsO++0H/FKkBoRaycfDSIRXgekcE9Aqxz6kFtj9yk8w/IqXaRPojmKTd6S2tpZNnTMqaMf9qEe25LrCWGA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786498886; c=relaxed/simple; bh=6umTKegmpbTTbOvAdSW3v1TnsKU9r89s/7WwTG9v8b4=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=d8A47+mPKlcFH54vdVX6vw2dhrXt1sGeMzJFeuD0hFPunCj9E4dsPngNB46N8dL9cS8GaMQ2KGsrDHcKWF9erDUDOuZqYO8IxLfYaBn+VBG6b/IciEUIsFNihwmyfGZ2Bx8rTpMi/DMKqAJ1gshP20bb6lX7DV7at/jq7Q780gs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f200.google.com with SMTP id 5614622812f47-4a49f09233fso407773b6e.0 for ; Tue, 11 Aug 2026 18:41:24 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786498883; x=1787103683; h=content-transfer-encoding:content-type:to:from:subject:message-id :in-reply-to:date:mime-version:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=lsGu7Q+SDZkG6Pq9q4pFkiGObu9QXZavd48VvCE45MU=; b=GCGlylwUt2ZW+lpFmUfzRTzEd//PNC/570K17NDRpgsQoYHFCHmwcYReY6Vl2CnMMn ufhH0RnYwov113Jce2jjKxGZCF6mnMXu5zckXRdB3sa/u+1+f9Q0YqJPKQg7loYywGGP YSBuCqpw7WpJR1GYJJIKq3sE3RJC4qcxEb4eqG0Np/VlEmUOHH9keEIqa05ZELlK9EXu zFdIQlXdNxt/H7tdpAKi+LEIOy50ZzDrk3q74UId2V2FUPmzFjxWn14/k7tlmut8P0wA OnIQGMNT5o/RK+9237DisWdyFBE5us5r6wL/ahUvMdLL6bJK68h04HC4D0QtLvUBouRt zLdg== X-Gm-Message-State: AOJu0YxSbElDzHFIrudQPgENd+GB69oiGqtM7iRn7DfPoKyzUGSvAmjk zvsxHIgOTZhrmBdapp67XXu+9xvkm2NuzCMQfhhygufCLAfWXWsMDmg/HHsX6q9h7BKkSDqzRl5 HjByLgQ2qtAt9Que42pNO63SLl6eOZQ+gTQjyZRskXo8VVDo7Dn4x6b5kcYY= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:2e4d:b0:4ab:224d:6dd6 with SMTP id 5614622812f47-4b20915ceb5mr3670106b6e.15.1786498883432; Tue, 11 Aug 2026 18:41:23 -0700 (PDT) Date: Tue, 11 Aug 2026 18:41:23 -0700 In-Reply-To: <6a791c94.01d0871a.3a0d52.009b.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a7bcf43.3668565d.e8814.000a.GAE@google.com> Subject: Forwarded: [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zero From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: [PATCH v2] mtd: block2mtd: Fix divide error when erase_size is zer= o Author: xiaopei01@kylinos.cn #syz test The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates if (size % erase_size) with a zero divisor, which triggers a divide error: divide error: 0000 [#1] PREEMPT SMP PTI RIP: 0010:add_device drivers/mtd/devices/block2mtd.c:296 [inline] RIP: 0010:block2mtd_setup2+0x592/0xda0 drivers/mtd/devices/block2mt= d.c:459 Call Trace: block2mtd_setup+0x27/0xe0 drivers/mtd/devices/block2mtd.c:476 param_attr_store+0x214/0x310 kernel/params.c:589 module_attr_store+0x65/0x90 kernel/params.c:904 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 ... Reject a zero erase size before performing the modulo operation so the existing "erasesize must be a divisor of device size" error path reports the invalid argument and frees the device. While at it, drop the unnecessary (long) cast from the size operand of the modulo. Fixes: ea6d833a3fdd ("mtd: block2mtd: check device size") Reported-by: syzbot+b320a4d5f65a61dbbf89@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/6a7b58ba.ac361c09.22ff0a.0045.GAE@goog= le.com/ Suggested-by: J=C3=B6rn Engel Cc: stable@vger.kernel.org Signed-off-by: Pei Xiao --- changlogs in v2: 1.Add Suggested-by tag 2.remove unnecessary (long) cast from the size --- drivers/mtd/devices/block2mtd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mt= d.c index 03e80b2c4f5a..3e2367dfff88 100644 --- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -293,7 +293,7 @@ static struct block2mtd_dev *add_device(char *devname, = int erase_size, } =20 size =3D bdev_nr_bytes(bdev); - if ((long)size % erase_size) { + if (!erase_size || size % erase_size) { pr_err("erasesize must be a divisor of device size\n"); goto err_free_block2mtd; } --=20 2.25.1