From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zheyu Ma <zheyuma97@gmail.com>, Sam Ravnborg <sam@ravnborg.org>,
Sasha Levin <sashal@kernel.org>,
dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.13 060/219] video: fbdev: kyro: Error out if 'pixclock' equals zero
Date: Thu, 9 Sep 2021 07:43:56 -0400 [thread overview]
Message-ID: <20210909114635.143983-60-sashal@kernel.org> (raw)
In-Reply-To: <20210909114635.143983-1-sashal@kernel.org>
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit 1520b4b7ba964f8eec2e7dd14c571d50de3e5191 ]
The userspace program could pass any values to the driver through
ioctl() interface. if the driver doesn't check the value of 'pixclock',
it may cause divide error because the value of 'lineclock' and
'frameclock' will be zero.
Fix this by checking whether 'pixclock' is zero in kyrofb_check_var().
The following log reveals it:
[ 103.073930] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
[ 103.073942] CPU: 4 PID: 12483 Comm: syz-executor Not tainted 5.14.0-rc2-00478-g2734d6c1b1a0-dirty #118
[ 103.073959] RIP: 0010:kyrofb_set_par+0x316/0xc80
[ 103.074045] Call Trace:
[ 103.074048] ? ___might_sleep+0x1ee/0x2d0
[ 103.074060] ? kyrofb_ioctl+0x330/0x330
[ 103.074069] fb_set_var+0x5bf/0xeb0
[ 103.074078] ? fb_blank+0x1a0/0x1a0
[ 103.074085] ? lock_acquire+0x3bd/0x530
[ 103.074094] ? lock_release+0x810/0x810
[ 103.074103] ? ___might_sleep+0x1ee/0x2d0
[ 103.074114] ? __mutex_lock+0x620/0x1190
[ 103.074126] ? trace_hardirqs_on+0x6a/0x1c0
[ 103.074137] do_fb_ioctl+0x31e/0x700
[ 103.074144] ? fb_getput_cmap+0x280/0x280
[ 103.074152] ? rcu_read_lock_sched_held+0x11/0x80
[ 103.074162] ? rcu_read_lock_sched_held+0x11/0x80
[ 103.074171] ? __sanitizer_cov_trace_switch+0x67/0xf0
[ 103.074181] ? __sanitizer_cov_trace_const_cmp2+0x20/0x80
[ 103.074191] ? do_vfs_ioctl+0x14b/0x16c0
[ 103.074199] ? vfs_fileattr_set+0xb60/0xb60
[ 103.074207] ? rcu_read_lock_sched_held+0x11/0x80
[ 103.074216] ? lock_release+0x483/0x810
[ 103.074224] ? __fget_files+0x217/0x3d0
[ 103.074234] ? __fget_files+0x239/0x3d0
[ 103.074243] ? do_fb_ioctl+0x700/0x700
[ 103.074250] fb_ioctl+0xe6/0x130
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-3-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/kyro/fbdev.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 4b8c7c16b1df..25801e8e3f74 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -399,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
{
struct kyrofb_info *par = info->par;
+ if (!var->pixclock)
+ return -EINVAL;
+
if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) {
printk(KERN_WARNING "kyrofb: depth not supported: %u\n", var->bits_per_pixel);
return -EINVAL;
--
2.30.2
next prev parent reply other threads:[~2021-09-09 11:47 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-09 11:42 [PATCH AUTOSEL 5.13 001/219] drm/vmwgfx: Fix subresource updates with new contexts Sasha Levin
2021-09-09 11:42 ` [PATCH AUTOSEL 5.13 002/219] drm/vmwgfx: Fix some static checker warnings Sasha Levin
2021-09-09 11:42 ` [PATCH AUTOSEL 5.13 003/219] drm/vc4: hdmi: Set HD_CTL_WHOLSMP and HD_CTL_CHALIGN_SET Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 004/219] drm/omap: Follow implicit fencing in prepare_fb Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 005/219] drm/amdgpu: Fix amdgpu_ras_eeprom_init() Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 012/219] drm/vkms: Let shadow-plane helpers prepare the plane's FB Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 022/219] video: fbdev: kyro: fix a DoS bug by restricting user input Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 023/219] drm/ast: Disable fast reset after DRAM initial Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 027/219] drm: avoid blocking in drm_clients_info's rcu section Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 028/219] drm: serialize drm_file.master with a new spinlock Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 029/219] drm: protect drm_master pointers in drm_lease.c Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 044/219] drm/amd/display: Fix timer_per_pixel unit error Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 053/219] drm/amdgpu: Fix a printing message Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 054/219] drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 057/219] drm/bridge: nwl-dsi: Avoid potential multiplication overflow on 32-bit Sasha Levin
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 059/219] video: fbdev: asiliantfb: Error out if 'pixclock' equals zero Sasha Levin
2021-09-09 11:43 ` Sasha Levin [this message]
2021-09-09 11:43 ` [PATCH AUTOSEL 5.13 061/219] video: fbdev: riva: " Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 076/219] drm: rcar-du: Shutdown the display on system shutdown Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 112/219] drm/msm: mdp4: drop vblank get/put from prepare/complete_commit Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 113/219] drm/msm/dsi: Fix DSI and DSI PHY regulator config from SDM660 Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 114/219] drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync before setting pixel clock Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 115/219] drm: xlnx: zynqmp: release reset to DP controller before accessing DP registers Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 118/219] drm/amd/display: fix missing writeback disablement if plane is removed Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 119/219] drm/amd/display: fix incorrect CM/TF programming sequence in dwb Sasha Levin
2021-09-09 11:44 ` [PATCH AUTOSEL 5.13 121/219] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c Sasha Levin
2021-09-09 11:45 ` [PATCH AUTOSEL 5.13 125/219] drm/msm/dp: reduce link rate if failed at link training 1 Sasha Levin
2021-09-09 11:45 ` [PATCH AUTOSEL 5.13 126/219] drm/msm/dp: return correct edid checksum after corrupted edid checksum read Sasha Levin
2021-09-09 11:45 ` [PATCH AUTOSEL 5.13 127/219] drm/msm/dp: do not end dp link training until video is ready Sasha Levin
2021-09-09 11:45 ` [PATCH AUTOSEL 5.13 129/219] gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() Sasha Levin
2021-09-09 11:45 ` [PATCH AUTOSEL 5.13 130/219] drm/display: fix possible null-pointer dereference in dcn10_set_clock() Sasha Levin
2021-09-09 11:45 ` [PATCH AUTOSEL 5.13 162/219] drm/exynos: Always initialize mapping in exynos_drm_register_dma() Sasha Levin
2021-09-09 11:46 ` [PATCH AUTOSEL 5.13 198/219] drm/amdkfd: Account for SH/SE count when setting up cu masks Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210909114635.143983-60-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sam@ravnborg.org \
--cc=stable@vger.kernel.org \
--cc=zheyuma97@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox