Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Wan Jiabing <wanjiabing@vivo.com>
To:     Amitkumar Karwar <amitkarwar@gmail.com>,
        Ganapathi Bhat <ganapathi017@gmail.com>,
        Sharvari Harisangam <sharvari.harisangam@nxp.com>,
        Xinming Hu <huxinming820@gmail.com>,
        Kalle Valo <kvalo@codeaurora.org>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Cc:     kael_w@yeah.net, Wan Jiabing <wanjiabing@vivo.com>,
        syzbot+4e7b6c94d22f4bfca9a0@syzkaller.appspotmail.com
Subject: [PATCH] mwifiex: Fix divide error in mwifiex_usb_dnld_fw
Date:   Mon, 18 Oct 2021 23:31:01 -0400
Message-Id: <20211019033101.27658-1-wanjiabing@vivo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?TfegXpZXODXgHAlBC2CCIWAs8ALQ5NGfHi/9RngV0t3/8DmwRUBE7jGUa9K0?=
 =?us-ascii?Q?meD1HcGXxuJLXna5adU0L3/Deiuj1pIJXMfV74QX5raBA6whKSsjkUDmEMhu?=
 =?us-ascii?Q?8mZUekR95HiC5I60SzF99CUAqaHd/2rS2Qkl8TJ7RoXHqFHjcyxU3v8GyJ+x?=
 =?us-ascii?Q?OeBaNvbsogSXE3wanfLFCFGn+dGssZn4Im6awvVZoZ655VsDkUDZR0Qi3hM7?=
 =?us-ascii?Q?gYNohDHblFmJQRZp+r3ENvo3xxMkSMJSCQFunRVTbjzZ25eJUsqgnILkGMGT?=
 =?us-ascii?Q?X90BmX4h3Lx1wCuVTL5H8SWVR9sy3GgdHzTgAcBVj+7Tkq83654fk76RvGlP?=
 =?us-ascii?Q?CTHjEzXbZ/sSK9VAmitUM0YfukdsdFwi2tP5wnU238IxlxXzutwtJM2DkUar?=
 =?us-ascii?Q?w1vf3WbXqyOSCoKc3vYpjq77qqYnOZj9UkfUWRwp3pF4Y5yAChHMoBSrwno/?=
 =?us-ascii?Q?w68I8wcBpFdcHvyjbRNVF2yrc7g/hPgNZSfmQCCMybyelc3Wll8TyK+xGXck?=
 =?us-ascii?Q?9pSooZYyRUf+82B/CYY8DFREBSOLX4vympu+F/0WiNtvIl52x0j+oKgNYsvq?=
 =?us-ascii?Q?oPSYyH6iNQs/NtJXUZUaGwOYvKUnPEburRcTZaVeW6wkngRhL9bEjF81xHvQ?=
 =?us-ascii?Q?9F79rfDM0nclDjXsB4zppbh6fk+5SDfIFDZetzAaF+Dw+4Mpp0u/YbRCAzVl?=
 =?us-ascii?Q?yoV08AwKdnfsYNgdU/Utf4z8hxsp3xrmAGus+Y0dYgQkQVBV0QMc6lFDwLe9?=
 =?us-ascii?Q?iZNRi4E1umw4ygHCulcNjPDKMtDUgkrsZBzPBq+pmn5zQiJFntS+pkvDEv7O?=
 =?us-ascii?Q?d/0QO9goa8YSfAU1uLF9fe7TVVDKcYXtyLvw8BgfCB/rSqYDr2kwrnvEPQeu?=
 =?us-ascii?Q?srNsHl8KaxRJqpUL7mGCq64/UGSoHCAxriMtTMv/VyDrUJARRnDaQXhLpvEd?=
 =?us-ascii?Q?Xsasu90B/OJCSABk2IoyMGQOaBApqABalr6srf4neC6P4EWI/phnlYjXipHE?=
 =?us-ascii?Q?xWKEuO0QAYFcwaKacKK52LDgNiFEIe75ABkY8zOiByHz1avVzuRjWzCPrIHk?=
 =?us-ascii?Q?sa7kRAim5KhFX/DneStXIVPMnNEftZu6gJEJF4bx4sBB+IO/i4Jzox3yySzk?=
 =?us-ascii?Q?qXPFXyMBR/rCD0fSkiZrCoeOBjZaYhwlTStjhul0PCt70ixe8drnCidoTnMv?=
 =?us-ascii?Q?4yhe392yglqBbWxjWhTvSk+VUHmLtfhK4nlkUku6mZAHWHQVFaRUNS2GaIM0?=
 =?us-ascii?Q?8I8iLVOEbcBgyl4iPZxvvbxVG+aHRJ1qwRuGz6iZ4yOtboY3mwpA3x5B3WOD?=
 =?us-ascii?Q?xBMGOdoiV88S98fFfAQ1Rdft?=
X-OriginatorOrg: vivo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 47f3bd93-0aa7-4249-5e58-08d992b0eec5
X-MS-Exchange-CrossTenant-AuthSource: SG2PR06MB3367.apcprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Oct 2021 03:31:26.9935
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 923e42dc-48d5-4cbe-b582-1a797a6412ed
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: cf+FfcmUM4ekKpLsS0OVptUn6WEDLb8sBIq53eLDHnPjL7qXcOwctgC4U5oqUzNP77/nVWXl8aQzyhLEYOxDHg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SG2PR06MB2121
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

This patch try to fix bug reported by syzkaller:
divide error: 0000 [#1] SMP KASAN
CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.15.0-rc5-syzkaller #0
Hardware name: Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events request_firmware_work_func
RIP: 0010:mwifiex_write_data_sync drivers/net/wireless/marvell/mwifiex/usb.c:696 [inline]
RIP: 0010:mwifiex_prog_fw_w_helper drivers/net/wireless/marvell/mwifiex/usb.c:1437 [inline]
RIP: 0010:mwifiex_usb_dnld_fw+0xabd/0x11a0 drivers/net/wireless/marvell/mwifiex/usb.c:1518
Call Trace:
 _mwifiex_fw_dpc+0x181/0x10a0 drivers/net/wireless/marvell/mwifiex/main.c:542
 request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1081
 process_one_work+0x9bf/0x1620 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x3c2/0x4a0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Link: https://syzkaller.appspot.com/bug?extid=4e7b6c94d22f4bfca9a0
Reported-and-tested-by: syzbot+4e7b6c94d22f4bfca9a0@syzkaller.appspotmail.com
Signed-off-by: Wan Jiabing <wanjiabing@vivo.com>
---
 drivers/net/wireless/marvell/mwifiex/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index 426e39d4ccf0..c24ec27d4057 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -693,7 +693,7 @@ static int mwifiex_write_data_sync(struct mwifiex_adapter *adapter, u8 *pbuf,
 	struct usb_card_rec *card = adapter->card;
 	int actual_length, ret;
 
-	if (!(*len % card->bulk_out_maxpktsize))
+	if (card->bulk_out_maxpktsize && !(*len % card->bulk_out_maxpktsize))
 		(*len)++;
 
 	/* Send the data block */
-- 
2.20.1