mtd: phram: Prevent divide by zero bug in phram_setup()

The problem is that "erasesize" is a uint64_t type so it might be
non-zero but the lower 32 bits are zero so when it's truncated,
"(uint32_t)erasesize", then that value is zero. This leads to a
divide by zero bug.

Avoid the bug by delaying the divide until after we have validated
that "erasesize" is non-zero and within the uint32_t range.

Fixes: dc2b3e5cbc80 ("mtd: phram: use div_u64_rem to stop overwrite len in phram_setup")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20220121115505.GI1978@kadam

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 6ed6c51fac69e8e52b5179e8baeafc3b8b4935e5..d503821a3e60613911f409010be56eff1eacf0ae 100644 (file)
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -264,16 +264,20 @@ static int phram_setup(const char *val)
                }
        }
 
-       if (erasesize)
-               div_u64_rem(len, (uint32_t)erasesize, &rem);
-
        if (len == 0 || erasesize == 0 || erasesize > len
-           || erasesize > UINT_MAX || rem) {
+           || erasesize > UINT_MAX) {
                parse_err("illegal erasesize or len\n");
                ret = -EINVAL;
                goto error;
        }
 
+       div_u64_rem(len, (uint32_t)erasesize, &rem);
+       if (rem) {
+               parse_err("len is not multiple of erasesize\n");
+               ret = -EINVAL;
+               goto error;
+       }
+
        ret = register_device(name, start, len, (uint32_t)erasesize);
        if (ret)
                goto error;