This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch releases/13.1 in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 10493e982d533633b4f4bcd0a2f1662c360fa660 Author: chao an <[email protected]> AuthorDate: Thu Oct 29 14:27:46 2026 +0800 drivers/usbhost: Reject zero storage block size USB mass-storage devices report their logical block size through READ CAPACITY. A zero block size is invalid and can later reach partition parsing, where the geometry block size is used as a divisor. Reject zero block sizes in the USB storage capacity path, and make the partition helpers return an error for zero block or sector sizes before using them in division. Signed-off-by: chao an <[email protected]> --- drivers/usbhost/usbhost_storage.c | 15 ++++++++++++--- fs/partition/fs_partition.c | 17 ++++++++++++++--- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/drivers/usbhost/usbhost_storage.c b/drivers/usbhost/usbhost_storage.c index 13de617f172..a39bc76b66f 100644 --- a/drivers/usbhost/usbhost_storage.c +++ b/drivers/usbhost/usbhost_storage.c @@ -805,13 +805,22 @@ static inline int usbhost_readcapacity(FAR struct usbhost_state_s *priv) priv->nblocks = usbhost_getbe32(resp->lba) + 1; priv->blocksize = usbhost_getbe32(resp->blklen); + if (priv->blocksize == 0) + { + uerr("ERROR: Invalid zero block size\n"); + nbytes = -EINVAL; + } + /* Receive the CSW */ - nbytes = DRVR_TRANSFER(hport->drvr, priv->bulkin, - priv->tbuffer, USBMSC_CSW_SIZEOF); if (nbytes >= 0) { - usbhost_dumpcsw((FAR struct usbmsc_csw_s *)priv->tbuffer); + nbytes = DRVR_TRANSFER(hport->drvr, priv->bulkin, + priv->tbuffer, USBMSC_CSW_SIZEOF); + if (nbytes >= 0) + { + usbhost_dumpcsw((FAR struct usbmsc_csw_s *)priv->tbuffer); + } } } } diff --git a/fs/partition/fs_partition.c b/fs/partition/fs_partition.c index 9bb6fab7356..b97a5580ca7 100644 --- a/fs/partition/fs_partition.c +++ b/fs/partition/fs_partition.c @@ -220,7 +220,11 @@ int parse_block_partition(FAR const char *path, state.blk->u.i_bops->ioctl(state.blk, MTDIOC_GEOMETRY, (unsigned long)(uintptr_t)&mgeo) >= 0) { - DEBUGASSERT(mgeo.blocksize); + if (mgeo.blocksize == 0) + { + close_blockdriver(state.blk); + return -EINVAL; + } state.blocksize = mgeo.blocksize; state.erasesize = mgeo.erasesize; @@ -234,7 +238,11 @@ int parse_block_partition(FAR const char *path, ret = state.blk->u.i_bops->geometry(state.blk, &geo); if (ret >= 0) { - DEBUGASSERT(geo.geo_sectorsize); + if (geo.geo_sectorsize == 0) + { + close_blockdriver(state.blk); + return -EINVAL; + } state.blocksize = geo.geo_sectorsize; state.erasesize = geo.geo_sectorsize; @@ -278,7 +286,10 @@ int parse_mtd_partition(FAR struct mtd_dev_s *mtd, return ret; } - DEBUGASSERT(mgeo.blocksize); + if (mgeo.blocksize == 0) + { + return -EINVAL; + } state.blk = NULL; state.mtd = mtd;
