[PATCH] mtd: rawnand: nandsim: reject unrepresentable page counts

[James Hilliard]

The simulator stores its total page count in an unsigned int and uses
signed int indices to initialize and free the page array. A device size
accepted by overridesize can exceed both limits even when the eraseblock
count is representable. In particular, a power-of-two page count above
UINT_MAX truncates to zero and reaches a zero-sized allocation.

Reject page counts above INT_MAX before allocating wear counters or page
storage. This preserves the full page count and keeps the page-array
indices representable, while reporting invalid geometry as -EINVAL.

Fixes: 6eda7a55f786 ("[MTD] [NAND] nandsim: allow for 64-bit size")
Cc: stable at vger.kernel.org
Closes: https://lore.kernel.org/r/sashiko-outbox-204066@kernel.org/
Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
---
 drivers/mtd/nand/raw/nandsim.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/mtd/nand/raw/nandsim.c b/drivers/mtd/nand/raw/nandsim.c
index fe968037f75a..802493e01ed9 100644
--- a/drivers/mtd/nand/raw/nandsim.c
+++ b/drivers/mtd/nand/raw/nandsim.c
@@ -13,6 +13,7 @@
 #define pr_fmt(fmt)  "[nandsim]" fmt
 
 #include <linux/init.h>
+#include <linux/limits.h>
 #include <linux/types.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
@@ -2361,6 +2362,12 @@ static int __init ns_init_module(void)
 		chip->pagemask = (targetsize >> chip->page_shift) - 1;
 	}
 
+	if (div_u64(nsmtd->size, nsmtd->writesize) > INT_MAX) {
+		NS_ERR("too many pages for the simulator\n");
+		ret = -EINVAL;
+		goto cleanup_nand;
+	}
+
 	ret = ns_setup_wear_reporting(nsmtd);
 	if (ret)
 		goto cleanup_nand;

---
base-commit: 30daaf3e7897b4a8d9b72e5b0c86dd6e2a4d7d85
change-id: 20261108-submit-nandsim-page-count-v1-9ad8160fbc6c

Best regards,
--  
James Hilliard <james.hilliard1 at gmail.com>