[PATCH] mtd: phram: Prevent divide by zero bug in phram_setup()

[yangerkun]

Thanks for the fix!

Reviewed-by: yangerkun <yangerkun at huawei.com>

On 2022/1/21 13:38, Dan Carpenter wrote:
> The problem is that "erasesize" is a uint32_t type so it might be
> non-zero but the truncated "(uint32_t)erasesize" value *is* zero. That
> would lead to the divide by zero bug.
> 
> Avoid the bug by delaying the divide until after we have validated
> that "erasesize" is reasonable.
> 
> Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
> Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
> ---
>   drivers/mtd/devices/phram.c | 12 ++++++++----
>   1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
> index 6ed6c51fac69..d503821a3e60 100644
> --- a/drivers/mtd/devices/phram.c
> +++ b/drivers/mtd/devices/phram.c
> @@ -264,16 +264,20 @@ static int phram_setup(const char *val)
>   		}
>   	}
>   
> -	if (erasesize)
> -		div_u64_rem(len, (uint32_t)erasesize, &rem);
> -
>   	if (len == 0 || erasesize == 0 || erasesize > len
> -	    || erasesize > UINT_MAX || rem) {
> +	    || erasesize > UINT_MAX) {
>   		parse_err("illegal erasesize or len\n");
>   		ret = -EINVAL;
>   		goto error;
>   	}
>   
> +	div_u64_rem(len, (uint32_t)erasesize, &rem);
> +	if (rem) {
> +		parse_err("len is not multiple of erasesize\n");
> +		ret = -EINVAL;
> +		goto error;
> +	}
> +
>   	ret = register_device(name, start, len, (uint32_t)erasesize);
>   	if (ret)
>   		goto error;
>