diff options
| author | Nikolay Ivchenko <nivchenko.dev@gmail.com> | 2026-06-20 20:06:03 +0300 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2026-06-29 16:42:42 +0200 |
| commit | ae9d8058f13238cad5f5d16f676da91187684581 (patch) | |
| tree | 44a9e69838a34a16f50ce50ed41d526315766961 /drivers/mtd | |
| parent | 97f9e509d839f7e5b9a32105ae322e5223c86786 (diff) | |
| download | linux-next-ae9d8058f13238cad5f5d16f676da91187684581.tar.gz linux-next-ae9d8058f13238cad5f5d16f676da91187684581.zip | |
mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path
When parsing partition layouts, if a partition requested with
MTDPART_OFS_RETAIN runs out of space, the allocator jumps directly
to 'out_register' to preserve partition numbering.
However, this jump bypasses child->erasesize initialization, leaving
it at zero. When add_mtd_device() is later called on this child, the
registration fails and triggers a WARN_ON() due to the zero ->erasesize.
Fix this by zeroing out child->part.offset and child->part.size, and
initializing child->erasesize to parent->erasesize. This is the exact
same pattern already used just a few lines below in the "out of reach"
error check (child->part.offset >= parent_size) to safely register a
disabled partition.
Reported-by: syzbot+3ae80219c633aca5431c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
Signed-off-by: Nikolay Ivchenko <nivchenko.dev@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/mtdpart.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c index 795a94e6b482..7f23f8a1b59c 100644 --- a/drivers/mtd/mtdpart.c +++ b/drivers/mtd/mtdpart.c @@ -118,6 +118,9 @@ static struct mtd_info *allocate_partition(struct mtd_info *parent, part->name, parent_size - child->part.offset, child->part.size); /* register to preserve ordering */ + child->part.offset = 0; + child->part.size = 0; + child->erasesize = parent->erasesize; goto out_register; } } |