Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb3ce90b authored by Firo Yang's avatar Firo Yang Committed by David S. Miller
Browse files

hdlcdrv: Fix divide by zero in hdlcdrv_ioctl 



syszkaller fuzzer triggered a divide by zero, when set calibration
through ioctl().

To fix it, test 'bitrate' if it is negative or 0, just return -EINVAL.

Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Signed-off-by: default avatarFiro Yang <firogm@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6c713a3a

drivers/net/hamradio/hdlcdrv.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -576,6 +576,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) 
	case HDLCDRVCTL_CALIBRATE:

	case HDLCDRVCTL_CALIBRATE:

		if(!capable(CAP_SYS_RAWIO))

		if(!capable(CAP_SYS_RAWIO))

			return -EPERM;

			return -EPERM;

		if (s->par.bitrate <= 0)

			return -EINVAL;

		if (bi.data.calibrate > INT_MAX / s->par.bitrate)

		if (bi.data.calibrate > INT_MAX / s->par.bitrate)

			return -EINVAL;

			return -EINVAL;

		s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

		s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;