1. 03 Aug, 2022 1 commit
    • Zheyu Ma's avatar
      video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() · 2f1c4523
      Zheyu Ma authored
      Since the user can control the arguments of the ioctl() from the user
      space, under special arguments that may result in a divide-by-zero bug
      in:
        drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul);
      with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0.
      and then in:
        drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock);
      we'll get a division-by-zero.
      
      The following log can reveal it:
      
      divide error: 0000 [#1] PREEMPT SMP KASAN PTI
      RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline]
      RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784
      Call Trace:
       fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034
       do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
       fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
      
      Fix this by checking the argument of ark_set_pixclock() first.
      
      Fixes: 681e1473 ("arkfb: new framebuffer driver for ARK Logic cards")
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      2f1c4523
  2. 29 Jul, 2022 1 commit
  3. 26 Jul, 2022 6 commits
  4. 18 Jul, 2022 15 commits
  5. 17 Jul, 2022 15 commits
  6. 16 Jul, 2022 2 commits