diff --git a/sys/dev/disk/mmcsd/mmcsd.c b/sys/dev/disk/mmcsd/mmcsd.c --- a/sys/dev/disk/mmcsd/mmcsd.c +++ b/sys/dev/disk/mmcsd/mmcsd.c @@ -405,6 +405,14 @@ end = sc->eend; /* Safe round to the erase sector boundaries. */ erase_sector = mmc_get_erase_sector(dev); + if (erase_sector == 0) { + /* A crafted/corrupt SD card can yield a zero erase-sector size; + dividing by it would panic the kernel. Refuse the trim. */ + bp->b_error = EINVAL; + bp->b_flags |= B_ERROR; + biodone(bp); + return (0); + } start = block + erase_sector - 1; /* Round up. */ start -= start % erase_sector; stop = end; /* Round down. */