]> git.baikalelectronics.ru Git - kernel.git/commit
fbdev: fb_pm2fb: Avoid potential divide by zero error
authorLetu Ren <fantasquex@gmail.com>
Thu, 18 Aug 2022 10:44:24 +0000 (18:44 +0800)
committerHelge Deller <deller@gmx.de>
Wed, 24 Aug 2022 19:47:08 +0000 (21:47 +0200)
commit3db59a8a3aacff7dfa36b05ccb32303d0e2494d9
treefe643160e2e4a0ec94f68acce1f788f2929b9521
parenta98cf68e8f7c4bd4d6c24f0e585149ac45dbce3c
fbdev: fb_pm2fb: Avoid potential divide by zero error

In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be
copied from user, then go through `fb_set_var()` and
`info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`.
Along the path, `var->pixclock` won't be modified. This function checks
whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is
zero, there will be a divide by zero error. So, it is necessary to check
whether denominator is zero to avoid crash. As this bug is found by
Syzkaller, logs are listed below.

divide error in pm2fb_check_var
Call Trace:
 <TASK>
 fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015
 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Letu Ren <fantasquex@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
drivers/video/fbdev/pm2fb.c