Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   George Kennedy <george.kennedy@oracle.com>
To:     gregkh@linuxfoundation.org, tzimmermann@suse.de, sam@ravnborg.org
Cc:     george.kennedy@oracle.com, dri-devel@lists.freedesktop.org,
        linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] video: fbdev: cirrusfb: check pixclock to avoid divide by zero
Date:   Mon, 25 Oct 2021 14:01:30 -0500
Message-Id: <1635188490-15082-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?pYjwyYdPBmcrnaEI1/2PsTdeioHWgB2ZfdmbIGVvzZmNgQheHHRswBDpM7r4?=
 =?us-ascii?Q?OAEi+PqBA4W8UBOcmB74fl79oFInW2Fs8mPupqpYdkqw3XS/SdlZSmf/oW+7?=
 =?us-ascii?Q?DBDe1ENpqvayypPm2T7ZZx6tGbSfKgJrjMG/9KhwK42HyJhLMJBaDrrvauOA?=
 =?us-ascii?Q?4sIhSS9Jt8yz5W29Itb/3XPESINURF1+3rBSY8zD/HYyYYa1cORSuz2Ljdwf?=
 =?us-ascii?Q?q6hRYrWZIUJ2fFIvctLCdGyCPHc/EJhBV+noSzqQPaZGH47EIFqVfFwlK5zi?=
 =?us-ascii?Q?lwS6k0puEEy5K2Quc0a4fy/TnYHFehfgWDsp+576UBaxw1Sz4MRyLFBL9yFu?=
 =?us-ascii?Q?OsSP4LRmU0FpPXWeATGPFp8Yb9z1a7XMAkyip+VRDf9nVBl1yl7uIKjIRLMA?=
 =?us-ascii?Q?c8NiWk2hIo/e/+1RcXCi/qVsTEfb6Fb2DbKF2DSSKfEZTClNzQUqI0Ievjlq?=
 =?us-ascii?Q?MkMsr5zcQqP6wt7cM5oxDSgaV7lbpyVadMr6XZb6kouEjkY9NQ9qCFa3kqxF?=
 =?us-ascii?Q?UBNa5uGf79wueNlHh5MkVwUfbu4PSYeXvrPzLkXADia5phApJ3tM8OJnk+w1?=
 =?us-ascii?Q?Dv1iArnOlpuLXxT/MU9q4S+jaaf63g80irCjBHsUZ90UP6YE7cOuNWZzdttR?=
 =?us-ascii?Q?xtyUkYhnv/Le+251kc2zJihzJ/3OCC5LpAt4FLvr2m8pj6y/zVu6r5cUzJ4w?=
 =?us-ascii?Q?BFp0LSBwJUcWbAtOnyycyPebB9CJ79I/s84EvnS+5YnDFePgAa+SRwG4Yiss?=
 =?us-ascii?Q?7Z8Sd8fbOWpRtuwB8LT5ZFxxcnxFjXpYHsCW9d04KLiT+RRE0aeKRB35UeaV?=
 =?us-ascii?Q?lh/rZQG6R9C2O84DgtQO2vxP04sxmtHH9yPVoSlELGmqOgGrsVcD8doE3OW4?=
 =?us-ascii?Q?Oau2y9fU7sGmb41XuB1SE0YTcdjLX6nmN38psYcKIdkyoawdXZ5qGV1UZt2L?=
 =?us-ascii?Q?YjeeT4sVG6cke5IwKHwyVTQ+U5UU4blAEVAsC4Z5Rnk3Vlrg3o5brkxb4QyS?=
 =?us-ascii?Q?sjMqX1rSlxLUsGP/pIVwPgsXBf//iKAoXKLaCx8hNPQVhzqEZUsJEvd6f0+D?=
 =?us-ascii?Q?KDCiMH0IvCKfMP6w67P0I/qJDEGDSHHbdron835S1LBUUARxjf4uONKTPLOH?=
 =?us-ascii?Q?vDpR+nM6RZqZbmatQFAJjfpK4aBPOtDqA9xRvkHoG93JsD5YXemVCwoJYQg2?=
 =?us-ascii?Q?sdxJW7dD4Vqg2f3ZurxJtYvTQXAttfYSyjN54RZw4tcGHvcxm9uZ0yXirEuy?=
 =?us-ascii?Q?81PiX+LRx79t3o6xyEEuhrhTSIJnLhoRK70xC4HHocqGHP0ysz5ur4bqGc46?=
 =?us-ascii?Q?eyi3evKm340Ebxe8Cs6lh1SoTfSyTu4jr/XWpMyv7RVQQjJD9FogDqb/tWTi?=
 =?us-ascii?Q?zPuau1pcA3i+wfeoglkPQ9gA+qwHE1FQPibl3hUfgS0Hi3k1C3xXIy3n9fFk?=
 =?us-ascii?Q?gq+QF6tTXuVcNZtRhXT+jAKR+K2l2ybfMfiHQvD20JgdfKp5hj9KTWP3SeDP?=
 =?us-ascii?Q?LRTUqAVHAkbFvwoQ1CmolA25E0RawqrfNQtgtTOehPYJHL3pnZTUlIBAJsEY?=
 =?us-ascii?Q?/++DE4RAFf/3fx7Vn08aoAH/F8k4Dfn/hn8XPaz4Lhsm40zfdwcs8UJDj+aV?=
 =?us-ascii?Q?h7dCYgmZ/TR64ulfRgSt5sVuSgEWUpV18750qEi67Qggu8u1WdJhPKs2xPVO?=
 =?us-ascii?Q?8iWReg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4a662441-7a07-4580-b804-08d997e9c05b
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Oct 2021 19:00:46.1719
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 2BW1SOq73VD+Y/pGgWZtQRocPD1t7sIclOq/ejL8IqzZQ4nKKznburRcPbI/s+IrqYIUFXbbL7N7Kni9+6ofemvrGxzB5KJ2DzvFTwpIRS0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3364
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10148 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 adultscore=0
 suspectscore=0 mlxscore=0 bulkscore=0 mlxlogscore=999 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109230001
 definitions=main-2110250110
X-Proofpoint-GUID: 1ITtTsz_fOxPwDVxLP-kznG2yrhEy4KF
X-Proofpoint-ORIG-GUID: 1ITtTsz_fOxPwDVxLP-kznG2yrhEy4KF
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Do a sanity check on pixclock value before using it as a divisor.

Syzkaller reported a divide error in cirrusfb_check_pixclock.

divide error: 0000 [#1] SMP KASAN PTI
CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2
RIP: 0010:cirrusfb_check_var+0x6f1/0x1260

Call Trace:
 fb_set_var+0x398/0xf90
 do_fb_ioctl+0x4b8/0x6f0
 fb_ioctl+0xeb/0x130
 __x64_sys_ioctl+0x19d/0x220
 do_syscall_64+0x3a/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
---
 drivers/video/fbdev/cirrusfb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c
index 93802ab..099ddcb 100644
--- a/drivers/video/fbdev/cirrusfb.c
+++ b/drivers/video/fbdev/cirrusfb.c
@@ -477,6 +477,9 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
 	struct cirrusfb_info *cinfo = info->par;
 	unsigned maxclockidx = var->bits_per_pixel >> 3;
 
+	if (!var->pixclock)
+		return -EINVAL;
+
 	/* convert from ps to kHz */
 	freq = PICOS2KHZ(var->pixclock);
 
-- 
1.8.3.1