Patchwork mtg: docg3: potential divide by zero in doc_write_oob()

login
register
mail settings
Submitter Dan Carpenter
Date Nov. 29, 2012, 2:16 p.m.
Message ID <20121129141651.GA12199@elgon.mountain>
Download mbox | patch
Permalink /patch/202754/
State New
Headers show

Comments

Dan Carpenter - Nov. 29, 2012, 2:16 p.m.
If we set oobdelta to zero then we will either return -EINVAL or hit
a divide (modulus) by zero on the next line when we check
"(ooblen % oobdelta)".  It's better to just return -EINVAL here instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Static analysis.  I don't know if it's actually possible to hit this
condition.
Robert Jarzmik - Nov. 29, 2012, 6:46 p.m.
Dan Carpenter <dan.carpenter@oracle.com> writes:

> If we set oobdelta to zero then we will either return -EINVAL or hit
> a divide (modulus) by zero on the next line when we check
> "(ooblen % oobdelta)".  It's better to just return -EINVAL here instead.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Static analysis.  I don't know if it's actually possible to hit this
> condition.
I don't know any possibility to reach that condition, nonetheless the patch
makes the code more robust, therefore :

Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>

Cheers.

--
Robert
Artem Bityutskiy - Dec. 10, 2012, 1:28 p.m.
On Thu, 2012-11-29 at 17:16 +0300, Dan Carpenter wrote:
> If we set oobdelta to zero then we will either return -EINVAL or hit
> a divide (modulus) by zero on the next line when we check
> "(ooblen % oobdelta)".  It's better to just return -EINVAL here instead.
> 
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Pushed to l2-mtd.git, thanks!

Patch

diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
index d34d83b..8510ccb 100644
--- a/drivers/mtd/devices/docg3.c
+++ b/drivers/mtd/devices/docg3.c
@@ -1440,7 +1440,7 @@  static int doc_write_oob(struct mtd_info *mtd, loff_t ofs,
 		oobdelta = mtd->ecclayout->oobavail;
 		break;
 	default:
-		oobdelta = 0;
+		return -EINVAL;
 	}
 	if ((len % DOC_LAYOUT_PAGE_SIZE) || (ooblen % oobdelta) ||
 	    (ofs % DOC_LAYOUT_PAGE_SIZE))