linux-kernel - Re: BUG: divide error in ubi_attach_mtd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231002101117.GA175828@google.com>
Date:   Mon, 2 Oct 2023 11:11:17 +0100
From:   Lee Jones <lee@...nel.org>
To:     Zhihao Cheng <chengzhihao1@...wei.com>
Cc:     Richard Weinberger <richard@....at>, Yu Hao <yhao016@....edu>,
        Miquel Raynal <miquel.raynal@...tlin.com>,
        Vignesh Raghavendra <vigneshr@...com>,
        linux-mtd <linux-mtd@...ts.infradead.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: BUG: divide error in ubi_attach_mtd_dev

On Sun, 23 Apr 2023, Zhihao Cheng wrote:

> 在 2023/4/23 16:02, Richard Weinberger 写道:
> > ----- Ursprüngliche Mail -----
> > > Von: "chengzhihao1" <chengzhihao1@...wei.com>
> > > > > root@...kaller:~# cat /proc/mtd
> > > > > dev:    size   erasesize  name
> > > > > mtd0: 00020000 00001000 “mtdram test device”
> > > > 
> > > > Hmm, mtdram should be fine, erasesize is not zero.
> > > > 
> > > 
> > > I guess the zero-erasesize mtd device is dynamically generated in
> > > runtime, after looking through the code, I find erasesize is
> > > initiallized in specific flash driver and it won't be updated later(eg.
> > > ioctl\sysctl). And some mtd devices may have zero erasesize, eg.
> > > drivers/mtd/devices/mchp23k256.c[1]. Unfortunately, I don't know how to
> > > load/simulate this mtd, maybe it requires a real device? If we load this
> > > mtd device as ubi, it will trigger the problem?
> > 
> > Indeed. I guess qemu can emulate such chips.
> > So better fix UBI to reject attaching of mtd's with erasesize being 0.
> > (Please note, we cannot test for MTD_NO_ERASE, this one means there is no
> > erase method).
> 
> Phram is an exception, it has erase function but is set flag 'MTD_CAP_RAM'.
> May I interpret 'MTD_NO_ERASE' as erase function is not necessary?

For better or worse, someone has applied to have this report associated
with a CVE which means a bunch of companies and individuals are going to
be tracking it.

What is the current status please?

Is this deemed to be a real issue?

Did the report culminate in a posted patch?

Any help would be gratefully received.

-- 
Lee Jones [李琼斯]