|
Thomas Zimmermann |
042996 |
From 19f953e7435644b81332dd632ba1b2d80b1e37af Mon Sep 17 00:00:00 2001
|
|
Thomas Zimmermann |
042996 |
From: Letu Ren <fantasquex@gmail.com>
|
|
Thomas Zimmermann |
042996 |
Date: Thu, 18 Aug 2022 18:44:24 +0800
|
|
Thomas Zimmermann |
042996 |
Subject: fbdev: fb_pm2fb: Avoid potential divide by zero error
|
|
Thomas Zimmermann |
042996 |
Git-commit: 19f953e7435644b81332dd632ba1b2d80b1e37af
|
|
Thomas Zimmermann |
042996 |
Patch-mainline: v6.0-rc3
|
|
Thomas Zimmermann |
042996 |
References: bsc#1154048
|
|
Thomas Zimmermann |
042996 |
|
|
Thomas Zimmermann |
042996 |
In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be
|
|
Thomas Zimmermann |
042996 |
copied from user, then go through `fb_set_var()` and
|
|
Thomas Zimmermann |
042996 |
`info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`.
|
|
Thomas Zimmermann |
042996 |
Along the path, `var->pixclock` won't be modified. This function checks
|
|
Thomas Zimmermann |
042996 |
whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is
|
|
Thomas Zimmermann |
042996 |
zero, there will be a divide by zero error. So, it is necessary to check
|
|
Thomas Zimmermann |
042996 |
whether denominator is zero to avoid crash. As this bug is found by
|
|
Thomas Zimmermann |
042996 |
Syzkaller, logs are listed below.
|
|
Thomas Zimmermann |
042996 |
|
|
Thomas Zimmermann |
042996 |
divide error in pm2fb_check_var
|
|
Thomas Zimmermann |
042996 |
Call Trace:
|
|
Thomas Zimmermann |
042996 |
<TASK>
|
|
Thomas Zimmermann |
042996 |
fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015
|
|
Thomas Zimmermann |
042996 |
do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
|
|
Thomas Zimmermann |
042996 |
fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
|
|
Thomas Zimmermann |
042996 |
|
|
Thomas Zimmermann |
042996 |
Reported-by: Zheyu Ma <zheyuma97@gmail.com>
|
|
Thomas Zimmermann |
042996 |
Signed-off-by: Letu Ren <fantasquex@gmail.com>
|
|
Thomas Zimmermann |
042996 |
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Thomas Zimmermann |
042996 |
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
|
|
Thomas Zimmermann |
042996 |
---
|
|
Thomas Zimmermann |
042996 |
drivers/video/fbdev/pm2fb.c | 5 +++++
|
|
Thomas Zimmermann |
042996 |
1 file changed, 5 insertions(+)
|
|
Thomas Zimmermann |
042996 |
|
|
Thomas Zimmermann |
042996 |
diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c
|
|
Thomas Zimmermann |
042996 |
index d3be2c64f1c0..8fd79deb1e2a 100644
|
|
Thomas Zimmermann |
042996 |
--- a/drivers/video/fbdev/pm2fb.c
|
|
Thomas Zimmermann |
042996 |
+++ b/drivers/video/fbdev/pm2fb.c
|
|
Thomas Zimmermann |
042996 |
@@ -617,6 +617,11 @@ static int pm2fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
|
|
Thomas Zimmermann |
042996 |
return -EINVAL;
|
|
Thomas Zimmermann |
042996 |
}
|
|
Thomas Zimmermann |
042996 |
|
|
Thomas Zimmermann |
042996 |
+ if (!var->pixclock) {
|
|
Thomas Zimmermann |
042996 |
+ DPRINTK("pixclock is zero\n");
|
|
Thomas Zimmermann |
042996 |
+ return -EINVAL;
|
|
Thomas Zimmermann |
042996 |
+ }
|
|
Thomas Zimmermann |
042996 |
+
|
|
Thomas Zimmermann |
042996 |
if (PICOS2KHZ(var->pixclock) > PM2_MAX_PIXCLOCK) {
|
|
Thomas Zimmermann |
042996 |
DPRINTK("pixclock too high (%ldKHz)\n",
|
|
Thomas Zimmermann |
042996 |
PICOS2KHZ(var->pixclock));
|
|
Thomas Zimmermann |
042996 |
--
|
|
Thomas Zimmermann |
042996 |
2.37.3
|
|
Thomas Zimmermann |
042996 |
|