• Zheyu Ma's avatar
    video: fbdev: asiliantfb: Error out if 'pixclock' equals zero · b36b242d
    Zheyu Ma authored
    The userspace program could pass any values to the driver through
    ioctl() interface. If the driver doesn't check the value of 'pixclock',
    it may cause divide error.
    
    Fix this by checking whether 'pixclock' is zero first.
    
    The following log reveals it:
    
    [   43.861711] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
    [   43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #224
    [   43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730
    [   43.861843] Call Trace:
    [   43.861848]  ? asiliantfb_remove+0x190/0x190
    [   43.861858]  fb_set_var+0x2e4/0xeb0
    [   43.861866]  ? fb_blank+0x1a0/0x1a0
    [   43.861873]  ? lock_acquire+0x1ef/0x530
    [   43.861884]  ? lock_release+0x810/0x810
    [   43.861892]  ? lock_is_held_type+0x100/0x140
    [   43.861903]  ? ___might_sleep+0x1ee/0x2d0
    [   43.861914]  ? __mutex_lock+0x620/0x1190
    [   43.861921]  ? do_fb_ioctl+0x313/0x700
    [   43.861929]  ? mutex_lock_io_nested+0xfa0/0xfa0
    [   43.861936]  ? __this_cpu_preempt_check+0x1d/0x30
    [   43.861944]  ? _raw_spin_unlock_irqrestore+0x46/0x60
    [   43.861952]  ? lockdep_hardirqs_on+0x59/0x100
    [   43.861959]  ? _raw_spin_unlock_irqrestore+0x46/0x60
    [   43.861967]  ? trace_hardirqs_on+0x6a/0x1c0
    [   43.861978]  do_fb_ioctl+0x31e/0x700
    Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
    Signed-off-by: default avatarSam Ravnborg <sam@ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-2-git-send-email-zheyuma97@gmail.com
    b36b242d
asiliantfb.c 16.5 KB