linux-fbdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: George Kennedy <george.kennedy@oracle.com>
To: gregkh@linuxfoundation.org, tzimmermann@suse.de, sam@ravnborg.org
Cc: george.kennedy@oracle.com, dri-devel@lists.freedesktop.org,
	linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] video: fbdev: cirrusfb: check pixclock to avoid divide by zero
Date: Mon, 25 Oct 2021 14:01:30 -0500	[thread overview]
Message-ID: <1635188490-15082-1-git-send-email-george.kennedy@oracle.com> (raw)

Do a sanity check on pixclock value before using it as a divisor.

Syzkaller reported a divide error in cirrusfb_check_pixclock.

divide error: 0000 [#1] SMP KASAN PTI
CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2
RIP: 0010:cirrusfb_check_var+0x6f1/0x1260

Call Trace:
 fb_set_var+0x398/0xf90
 do_fb_ioctl+0x4b8/0x6f0
 fb_ioctl+0xeb/0x130
 __x64_sys_ioctl+0x19d/0x220
 do_syscall_64+0x3a/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
---
 drivers/video/fbdev/cirrusfb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c
index 93802ab..099ddcb 100644
--- a/drivers/video/fbdev/cirrusfb.c
+++ b/drivers/video/fbdev/cirrusfb.c
@@ -477,6 +477,9 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
 	struct cirrusfb_info *cinfo = info->par;
 	unsigned maxclockidx = var->bits_per_pixel >> 3;
 
+	if (!var->pixclock)
+		return -EINVAL;
+
 	/* convert from ps to kHz */
 	freq = PICOS2KHZ(var->pixclock);
 
-- 
1.8.3.1


             reply	other threads:[~2021-10-25 19:01 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-25 19:01 George Kennedy [this message]
2021-10-25 19:07 ` [PATCH] video: fbdev: cirrusfb: check pixclock to avoid divide by zero Greg KH
2021-10-25 19:33   ` George Kennedy
2021-10-26  8:30     ` Geert Uytterhoeven
2021-10-26 13:36       ` George Kennedy
2021-10-26 14:11         ` Geert Uytterhoeven
2021-10-26 15:47           ` George Kennedy
2021-10-26 17:12             ` Geert Uytterhoeven
2021-10-27  1:12               ` George Kennedy
2021-10-27  6:53                 ` Geert Uytterhoeven
2021-10-27 12:05                   ` George Kennedy
2021-10-27 15:22                   ` George Kennedy

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1635188490-15082-1-git-send-email-george.kennedy@oracle.com \
    --to=george.kennedy@oracle.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-fbdev@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sam@ravnborg.org \
    --cc=tzimmermann@suse.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).