Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb7877f2 authored by Zheyu Ma's avatar Zheyu Ma Committed by Greg Kroah-Hartman
Browse files

video: fbdev: asiliantfb: Error out if 'pixclock' equals zero 



[ Upstream commit b36b242d4b8ea178f7fd038965e3cac7f30c3f09 ]

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of 'pixclock',
it may cause divide error.

Fix this by checking whether 'pixclock' is zero first.

The following log reveals it:

[   43.861711] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
[   43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #224
[   43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730
[   43.861843] Call Trace:
[   43.861848]  ? asiliantfb_remove+0x190/0x190
[   43.861858]  fb_set_var+0x2e4/0xeb0
[   43.861866]  ? fb_blank+0x1a0/0x1a0
[   43.861873]  ? lock_acquire+0x1ef/0x530
[   43.861884]  ? lock_release+0x810/0x810
[   43.861892]  ? lock_is_held_type+0x100/0x140
[   43.861903]  ? ___might_sleep+0x1ee/0x2d0
[   43.861914]  ? __mutex_lock+0x620/0x1190
[   43.861921]  ? do_fb_ioctl+0x313/0x700
[   43.861929]  ? mutex_lock_io_nested+0xfa0/0xfa0
[   43.861936]  ? __this_cpu_preempt_check+0x1d/0x30
[   43.861944]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861952]  ? lockdep_hardirqs_on+0x59/0x100
[   43.861959]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861967]  ? trace_hardirqs_on+0x6a/0x1c0
[   43.861978]  do_fb_ioctl+0x31e/0x700

Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
Signed-off-by: default avatarSam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-2-git-send-email-zheyuma97@gmail.com


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e31ea11d

drivers/video/fbdev/asiliantfb.c

+3 −0
Original line number Diff line number Diff line
@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var, 
{

	unsigned long Ftarget, ratio, remainder;



	if (!var->pixclock)

		return -EINVAL;



	ratio = 1000000 / var->pixclock;

	remainder = 1000000 % var->pixclock;

	Ftarget = 1000000 * ratio + (1000000 * remainder) / var->pixclock;