• Fullway Wang's avatar
    fbdev: savage: Error out if pixclock equals zero · 04e5eac8
    Fullway Wang authored
    The userspace program could pass any values to the driver through
    ioctl() interface. If the driver doesn't check the value of pixclock,
    it may cause divide-by-zero error.
    
    Although pixclock is checked in savagefb_decode_var(), but it is not
    checked properly in savagefb_probe(). Fix this by checking whether
    pixclock is zero in the function savagefb_check_var() before
    info->var.pixclock is used as the divisor.
    
    This is similar to CVE-2022-3061 in i740fb which was fixed by
    commit 15cf0b82.
    Signed-off-by: default avatarFullway Wang <fullwaywang@outlook.com>
    Signed-off-by: default avatarHelge Deller <deller@gmx.de>
    04e5eac8
savagefb_driver.c 64.9 KB