Thanks for the fix! Reviewed-by: yangerkun <yangerkun@xxxxxxxxxx> On 2022/1/21 13:38, Dan Carpenter wrote:
The problem is that "erasesize" is a uint32_t type so it might be non-zero but the truncated "(uint32_t)erasesize" value *is* zero. That would lead to the divide by zero bug. Avoid the bug by delaying the divide until after we have validated that "erasesize" is reasonable. Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup") Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> --- drivers/mtd/devices/phram.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c index 6ed6c51fac69..d503821a3e60 100644 --- a/drivers/mtd/devices/phram.c +++ b/drivers/mtd/devices/phram.c @@ -264,16 +264,20 @@ static int phram_setup(const char *val) } }- if (erasesize)- div_u64_rem(len, (uint32_t)erasesize, &rem); - if (len == 0 || erasesize == 0 || erasesize > len - || erasesize > UINT_MAX || rem) { + || erasesize > UINT_MAX) { parse_err("illegal erasesize or len\n"); ret = -EINVAL; goto error; }+ div_u64_rem(len, (uint32_t)erasesize, &rem);+ if (rem) { + parse_err("len is not multiple of erasesize\n"); + ret = -EINVAL; + goto error; + } + ret = register_device(name, start, len, (uint32_t)erasesize); if (ret) goto error;
