From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26149C4167D for ; Wed, 30 Mar 2022 11:54:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344605AbiC3L4T (ORCPT ); Wed, 30 Mar 2022 07:56:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60662 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345943AbiC3LzP (ORCPT ); Wed, 30 Mar 2022 07:55:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66504DFE2; Wed, 30 Mar 2022 04:53:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 02BBA615E7; Wed, 30 Mar 2022 11:53:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 847FBC340F2; Wed, 30 Mar 2022 11:53:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1648641189; bh=gTMrMCC1RQkVhABduM/2Eg06saCccssHNFDPRbEfmG0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qz456oNljKosmfWdJZ3Pl168/rLN+DdCDuaA5EWeh2Bn1V40OqTCyU6OgsSQwp0kx AOZH/HAj4u1FK8C97sn0aSxKihHARwA0nTyapeydqjfb4IUrvOth7T97rdrwWosEbs VDqH6FmNsHn3JLrDiKUxixenGv04DKAuHCVXTtkwp/2xFV14jkkzi8yZX9ORVCeQ/w WfJZtvS51QDKm/mtM7bR25HdmDQbGsx64RfHRmOEToyfoFwrSDa/RxeT0crkg25x6F 7ACaEl3PaJy0YcUqm4/1Kb0YwfOv9CWxbEL7qLdZlTKqZUTXgYwwA69SBFqPKcWZ27 JY3ZvJs4KyfWg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: George Kennedy , Geert Uytterhoeven , Helge Deller , Sasha Levin , tomi.valkeinen@ti.com, linux-fbdev@vger.kernel.org Subject: [PATCH AUTOSEL 4.19 03/22] video: fbdev: cirrusfb: check pixclock to avoid divide by zero Date: Wed, 30 Mar 2022 07:52:44 -0400 Message-Id: <20220330115303.1672616-3-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220330115303.1672616-1-sashal@kernel.org> References: <20220330115303.1672616-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-fbdev@vger.kernel.org From: George Kennedy [ Upstream commit 5c6f402bdcf9e7239c6bc7087eda71ac99b31379 ] Do a sanity check on pixclock value to avoid divide by zero. If the pixclock value is zero, the cirrusfb driver will round up pixclock to get the derived frequency as close to maxclock as possible. Syzkaller reported a divide error in cirrusfb_check_pixclock. divide error: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2 RIP: 0010:cirrusfb_check_var+0x6f1/0x1260 Call Trace: fb_set_var+0x398/0xf90 do_fb_ioctl+0x4b8/0x6f0 fb_ioctl+0xeb/0x130 __x64_sys_ioctl+0x19d/0x220 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Signed-off-by: George Kennedy Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller Signed-off-by: Sasha Levin --- drivers/video/fbdev/cirrusfb.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c index b3be06dd2908..72358d187023 100644 --- a/drivers/video/fbdev/cirrusfb.c +++ b/drivers/video/fbdev/cirrusfb.c @@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) return 0; } -static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, +static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, struct fb_info *info) { long freq; @@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, unsigned maxclockidx = var->bits_per_pixel >> 3; /* convert from ps to kHz */ - freq = PICOS2KHZ(var->pixclock); - - dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + freq = PICOS2KHZ(var->pixclock ? : 1); maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; cinfo->multiplexing = 0; @@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, /* If the frequency is greater than we can support, we might be able * to use multiplexing for the video mode */ if (freq > maxclock) { - dev_err(info->device, - "Frequency greater than maxclock (%ld kHz)\n", - maxclock); - return -EINVAL; + var->pixclock = KHZ2PICOS(maxclock); + + while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) + var->pixclock++; } + dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + /* * Additional constraint: 8bpp uses DAC clock doubling to allow maximum * pixel clock -- 2.34.1