This is an automated email from the ASF dual-hosted git repository. acassis pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit a4ba96280d8e0c9fc1cb68b2aa8a0f8a5febe644 Author: chao an <[email protected]> AuthorDate: Thu Oct 29 14:27:46 2026 +0800 drivers/usbhost: Reject zero storage block size USB mass-storage devices report their logical block size through READ CAPACITY. A zero block size is invalid and can later reach partition parsing, where the geometry block size is used as a divisor. Reject zero block sizes in the USB storage capacity path, and make the partition helpers return an error for zero block or sector sizes before using them in division. Signed-off-by: chao an <[email protected]> --- drivers/usbhost/usbhost_storage.c | 15 ++++++++++++--- fs/partition/fs_partition.c | 17 ++++++++++++++--- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/drivers/usbhost/usbhost_storage.c b/drivers/usbhost/usbhost_storage.c index 13de617f172..a39bc76b66f 100644 --- a/drivers/usbhost/usbhost_storage.c +++ b/drivers/usbhost/usbhost_storage.c @@ -805,13 +805,22 @@ static inline int usbhost_readcapacity(FAR struct usbhost_state_s *priv) priv->nblocks = usbhost_getbe32(resp->lba) + 1; priv->blocksize = usbhost_getbe32(resp->blklen); + if (priv->blocksize == 0) + { + uerr("ERROR: Invalid zero block size\n"); + nbytes = -EINVAL; + } + /* Receive the CSW */ - nbytes = DRVR_TRANSFER(hport->drvr, priv->bulkin, - priv->tbuffer, USBMSC_CSW_SIZEOF); if (nbytes >= 0) { - usbhost_dumpcsw((FAR struct usbmsc_csw_s *)priv->tbuffer); + nbytes = DRVR_TRANSFER(hport->drvr, priv->bulkin, + priv->tbuffer, USBMSC_CSW_SIZEOF); + if (nbytes >= 0) + { + usbhost_dumpcsw((FAR struct usbmsc_csw_s *)priv->tbuffer); + } } } } diff --git a/fs/partition/fs_partition.c b/fs/partition/fs_partition.c index 92b11a283eb..68ef61550f2 100644 --- a/fs/partition/fs_partition.c +++ b/fs/partition/fs_partition.c @@ -223,7 +223,11 @@ int parse_block_partition(FAR const char *path, state.blk->u.i_bops->ioctl(state.blk, MTDIOC_GEOMETRY, (unsigned long)(uintptr_t)&mgeo) >= 0) { - DEBUGASSERT(mgeo.blocksize); + if (mgeo.blocksize == 0) + { + close_blockdriver(state.blk); + return -EINVAL; + } state.blocksize = mgeo.blocksize; state.erasesize = mgeo.erasesize; @@ -237,7 +241,11 @@ int parse_block_partition(FAR const char *path, ret = state.blk->u.i_bops->geometry(state.blk, &geo); if (ret >= 0) { - DEBUGASSERT(geo.geo_sectorsize); + if (geo.geo_sectorsize == 0) + { + close_blockdriver(state.blk); + return -EINVAL; + } state.blocksize = geo.geo_sectorsize; state.erasesize = geo.geo_sectorsize; @@ -281,7 +289,10 @@ int parse_mtd_partition(FAR struct mtd_dev_s *mtd, return ret; } - DEBUGASSERT(mgeo.blocksize); + if (mgeo.blocksize == 0) + { + return -EINVAL; + } state.blk = NULL; state.mtd = mtd;
