DragonFlyBSD Kernel Audit
DF-2479 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/disk/mmcsd/mmcsd.c b/sys/dev/disk/mmcsd/mmcsd.c
--- a/sys/dev/disk/mmcsd/mmcsd.c
+++ b/sys/dev/disk/mmcsd/mmcsd.c
@@ -405,6 +405,14 @@
 		end = sc->eend;
 	/* Safe round to the erase sector boundaries. */
 	erase_sector = mmc_get_erase_sector(dev);
+	if (erase_sector == 0) {
+		/* A crafted/corrupt SD card can yield a zero erase-sector size;
+		   dividing by it would panic the kernel.  Refuse the trim. */
+		bp->b_error = EINVAL;
+		bp->b_flags |= B_ERROR;
+		biodone(bp);
+		return (0);
+	}
 	start = block + erase_sector - 1;	 /* Round up. */
 	start -= start % erase_sector;
 	stop = end;				/* Round down. */