]> git.itanic.dy.fi Git - linux-stable/commit
fbdev: fb_pm2fb: Avoid potential divide by zero error
authorLetu Ren <fantasquex@gmail.com>
Thu, 18 Aug 2022 10:44:24 +0000 (18:44 +0800)
committerHelge Deller <deller@gmx.de>
Wed, 24 Aug 2022 19:47:08 +0000 (21:47 +0200)
commit19f953e7435644b81332dd632ba1b2d80b1e37af
treefe643160e2e4a0ec94f68acce1f788f2929b9521
parent868ce967af1ea5d946635f8f89f752319212d769
fbdev: fb_pm2fb: Avoid potential divide by zero error

In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be
copied from user, then go through `fb_set_var()` and
`info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`.
Along the path, `var->pixclock` won't be modified. This function checks
whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is
zero, there will be a divide by zero error. So, it is necessary to check
whether denominator is zero to avoid crash. As this bug is found by
Syzkaller, logs are listed below.

divide error in pm2fb_check_var
Call Trace:
 <TASK>
 fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015
 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Letu Ren <fantasquex@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
drivers/video/fbdev/pm2fb.c