[syzbot] [mtd?] divide error in block2mtd_setup2
Pei Xiao
xiaopei01 at kylinos.cn
Mon Aug 10 02:17:50 PDT 2026
在 2026/8/10 10:03, Jörn Engel 写道:
> On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
>>
>> * 2a: f7 f6 div %esi <-- trapping instruction
>
> Best guess would be this:
>
> if ((long)size % erase_size) {
>
> Someone passing an erase_size of 0 would indeed trigger an exception.
> Fix would be something like this:
>
> - if ((long)size % erase_size) {
> + if (!erase_size || (long)size % erase_size) {
>
> I haven't touched the code is nearly two decades. If somebody else
> feels like sending a patch and gathering all the glory, please be my
> guest!
Thank you for your contribution. I have sent this patch, but I forgot to
add the Suggested-by: tag
Thanks！
Pei.
>
> Jörn
>
> --
> Those who come seeking peace without a treaty are plotting.
> -- Sun Tzu
>
> ______________________________________________________
> Linux MTD discussion mailing list
> http://lists.infradead.org/mailman/listinfo/linux-mtd/
>
> From mboxrd at z Thu Jan 1 00:00:00 1970
> Received: from mx01.bremer-it.com (mx01.bremer-it.com [85.215.132.167])
> (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
> (No client certificate requested)
> by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73877212550
> for <linux-kernel at vger.kernel.org>; Mon, 10 Aug 2026 02:11:08 +0000 (UTC)
> Authentication-Results: smtp.subspace.kernel.org; arc=ne smtp.client-ip….215.132.167
> ARC-Seal:i= a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
> t86327871; cv=none; b=pmhQ+YkskPdHVocSl0Q3ONibHDLR7s7fI85cff5H13l/yM9Z8mDYTBscKANq7mGFD2ASRqvBgqTpqe5XwuxKTwZFODwuxMgU6JESnW9mL+RH7dPhx/4yRbt05Zn2YwFK2lesfp+iHyordavupm+PNHamOQyJJwTUw9tjZZ0ntHAARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
> s=c-20240116; t86327871; c=relaxed/simple;
> bh=oRdL2tBTFal/JDe029vqeCkmNFJ6Y4/KQ2bpPcX7k=;
> hÚte:From:To:Cc:Subject:Message-ID:References:MIME-Version:
> Content-Type:Content-Disposition:In-Reply-To; b=XeZFkoGl/EX953bQRJEM5Tfe5d/GrpVVJUzcDSc66bRWr8I0onQDDy/7EWgIvCiEGhJzItU2sfKSjm4pNpXCnZj6NtzWG6zriQzO7WsKIZ2npUEbzkr9fxYKPgNq7NiBQehPlmVw8mZbzVsaVdvKHi5zwE5zILA9+gU9cPWxcARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.fromºrelysecure.org; spf=pass smtp.mailfromºrelysecure.org; dkim=pass (2048-bit key) header.dºrelysecure.org header.i=@barelysecure.org header.b=HAaxkQ/6; arc=none smtp.client-ip….215.132.167
> Authentication-Results: smtp.subspace.kernel.org; dmarc=ss (p=none dis=none) header.fromºrelysecure.org
> Authentication-Results: smtp.subspace.kernel.org; spf=ss smtp.mailfromºrelysecure.org
> Authentication-Results: smtp.subspace.kernel.org;
> dkim=ss (2048-bit key) header.dºrelysecure.org header.i=@barelysecure.org header.b="HAaxkQ/6"
> Received: from cashel.logfs.org (c-98-33-96-243.hsd1.ca.comcast.net [98.33.96.243])
> (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
> key-exchange ECDHE (prime256v1) server-signature ECDSA (secp384r1) server-digest SHA384)
> (No client certificate requested)
> by mx01.bremer-it.com (Postfix) with ESMTPSA id 061CA20B86;
> Mon, 10 Aug 2026 04:03:25 +0200 (CEST)
> DKIM-Signature: v= a=rsa-sha256; c=relaxed/relaxed; dºrelysecure.org;
> s=im68; t86327408;
> h=om:from:reply-to:subject:subject:date:date:message-id:message-id:
> to:to:cc:cc:mime-version:mime-version:content-type:content-type:
> content-transfer-encoding:content-transfer-encoding:
> in-reply-to:in-reply-to:references:references;
> bhÍIDTuliDDGgOAKpI245cMmyPRVVKxIWKH3GuXafqZA=;
> b=HAaxkQ/6AawUqio6ZtZxsW0LqcdaN10B/vRSFk0TcWRBU45jxR+oipsFDUbLTtUrltNgoq
> SUJTT9FHYYItqxPYvDw94jAGkuvJipWw3nalbM+Kl5az2K2VReh3w5eQsKr6sdoXp2TYzJ
> R/1QaEGzKjPtOIK5qoT0bvc6jV/0DL6pI9DWuc6O6DxxGrPYGtwZo2mUmQAuO9Qnm4Snbc
> xSJC10kazHhQLi5gnGRmMR3oz+JF66HhtQ+ApzYgkv3zty8o4P/Vk4Bj7YXV9UTiPwdcJq
> HVIfjaeb2e+Z+Q1K56IpiPILzHBRAYt0tcFSf+P7vSEEBvoUD2BFobn0ZIvA2Q=Authentication-Results: ORIGINATING;
> auth=ss smtp.auth=joern at lazybastard.org smtp.mailfrom=joern at barelysecure.org
> Date: Sun, 9 Aug 2026 19:03:22 -0700
> From: =so-8859-1?Q?Jörn?= Engel <joern at barelysecure.org>
> To: syzbot <syzbot+b320a4d5f65a61dbbf89 at syzkaller.appspotmail.com>
> Cc: joern at lazybastard.org, linux-kernel at vger.kernel.org,
> linux-mtd at lists.infradead.org, miquel.raynal at bootlin.com,
> richard at nod.at, syzkaller-bugs at googlegroups.com, vigneshr at ti.com
> Subject: Re: [syzbot] [mtd?] divide error in block2mtd_setup2
> Message-ID: <ankxaiwtTltL0xMj at cashel.logfs.org>
> References: <6a791c94.01d0871a.3a0d52.009b.GAE at google.com>
> Precedence: bulk
> X-Mailing-List: linux-kernel at vger.kernel.org
> List-Id: <linux-kernel.vger.kernel.org>
> List-Subscribe: <mailto:linux-kernel+subscribe at vger.kernel.org>
> List-Unsubscribe: <mailto:linux-kernel+unsubscribe at vger.kernel.org>
> MIME-Version: 1.0
> Content-Type: text/plain; charset=o-8859-1
> Content-Disposition: inline
> Content-Transfer-Encoding: 8bit
> In-Reply-To: <6a791c94.01d0871a.3a0d52.009b.GAE at google.com>
> X-Spam-Level: *
> X-Rspamd-Action: no action
> X-Spamd-Result: default: False [1.40 / 14.00];
> SUSPICIOUS_RECIPS(1.50)[];
> MIME_GOOD(-0.10)[text/plain];
> ARC_NA(0.00)[];
> TAGGED_RCPT(0.00)[b320a4d5f65a61dbbf89];
> RCVD_COUNT_ZERO(0.00)[0];
> ASN(0.00)[asn:7922, ipnet:98.32.0.0/11, country:US];
> MIME_TRACE(0.00)[0:+];
> MISSING_XM_UA(0.00)[];
> RCPT_COUNT_SEVEN(0.00)[8];
> FROM_HAS_DN(0.00)[];
> ALIAS_RESOLVED(0.00)[];
> LOCAL_OUTBOUND(0.00)[];
> FROM_EQ_ENVFROM(0.00)[];
> TO_DN_SOME(0.00)[];
> TO_MATCH_ENVRCPT_SOME(0.00)[];
> DKIM_SIGNED(0.00)[barelysecure.org:s=im68];
> URIBL_BLOCKED(0.00)[cashel.logfs.org:mid,cashel.logfs.org:helo];
> SUBJECT_HAS_QUESTION(0.00)[]
> X-Rspamd-Server: server01
> X-Rspamd-Queue-Id: 061CA20B86
> X-Spamd-Bar: +
>
> On Sun, Aug 09, 2026 at 05:34:28PM -0700, syzbot wrote:
>>
>> * 2a: f7 f6 div %esi <-- trapping instruction
>
> Best guess would be this:
>
> if ((long)size % erase_size) {
>
> Someone passing an erase_size of 0 would indeed trigger an exception.
> Fix would be something like this:
>
> - if ((long)size % erase_size) {
> + if (!erase_size || (long)size % erase_size) {
>
> I haven't touched the code is nearly two decades. If somebody else
> feels like sending a patch and gathering all the glory, please be my
> guest!
>
> Jörn
>
> --
> Those who come seeking peace without a treaty are plotting.
> -- Sun Tzu
>
More information about the linux-mtd
mailing list