Skip to content

Commit 127fbe6

Browse files
ZheyuMaintel-lab-lkp
authored andcommitted
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of 'pixclock', it may cause divide error. Fix this by checking whether 'pixclock' is zero first. The following log reveals it: [ 43.861711] divide error: 0000 [#1] PREEMPT SMP KASAN PTI [ 43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty torvalds#224 [ 43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730 [ 43.861843] Call Trace: [ 43.861848] ? asiliantfb_remove+0x190/0x190 [ 43.861858] fb_set_var+0x2e4/0xeb0 [ 43.861866] ? fb_blank+0x1a0/0x1a0 [ 43.861873] ? lock_acquire+0x1ef/0x530 [ 43.861884] ? lock_release+0x810/0x810 [ 43.861892] ? lock_is_held_type+0x100/0x140 [ 43.861903] ? ___might_sleep+0x1ee/0x2d0 [ 43.861914] ? __mutex_lock+0x620/0x1190 [ 43.861921] ? do_fb_ioctl+0x313/0x700 [ 43.861929] ? mutex_lock_io_nested+0xfa0/0xfa0 [ 43.861936] ? __this_cpu_preempt_check+0x1d/0x30 [ 43.861944] ? _raw_spin_unlock_irqrestore+0x46/0x60 [ 43.861952] ? lockdep_hardirqs_on+0x59/0x100 [ 43.861959] ? _raw_spin_unlock_irqrestore+0x46/0x60 [ 43.861967] ? trace_hardirqs_on+0x6a/0x1c0 [ 43.861978] do_fb_ioctl+0x31e/0x700 Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
1 parent ff11764 commit 127fbe6

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/video/fbdev/asiliantfb.c

+3
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var,
227227
{
228228
unsigned long Ftarget, ratio, remainder;
229229

230+
if (!var->pixclock)
231+
return -EINVAL;
232+
230233
ratio = 1000000 / var->pixclock;
231234
remainder = 1000000 % var->pixclock;
232235
Ftarget = 1000000 * ratio + (1000000 * remainder) / var->pixclock;

0 commit comments

Comments
 (0)