Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   George Kennedy <george.kennedy@oracle.com>
To:     gregkh@linuxfoundation.org, maarten.lankhorst@linux.intel.com,
        mripard@kernel.org, tzimmermann@suse.de, airlied@linux.ie,
        daniel@ffwll.ch
Cc:     george.kennedy@oracle.com, dri-devel@lists.freedesktop.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH] drm: check drm_format_info hsub and vsub to avoid divide by zero
Date:   Thu, 28 Oct 2021 08:57:17 -0500
Message-Id: <1635429437-21718-1-git-send-email-george.kennedy@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?U9g0ZrjTzZm7pmGQUAj6bdjhpVmBNUBCXw+lJk/wa3XjvTIRwJhvO/q8Ap7Q?=
 =?us-ascii?Q?FE29Ib/axH5Do/ZEOVfvyRwc1spRSPzS8ak1xACt/5fpSi1v60+gfvzJ6bg/?=
 =?us-ascii?Q?YBpp08vx6ZGaj34bYm6HCcu6EnOyDXFC+UB17jlgnvxqTvbsIvdhOBDMZUDo?=
 =?us-ascii?Q?+h7LvpObblQafwv/KIQ+RwnPz4bsVwUTeaOINwUT+CIi8xUMZInni2frb9BF?=
 =?us-ascii?Q?Ab7KfqZNAd9l5xnC/urAy8WS6cOJNrUTgFR8GZpXaH4K/nxvhCs2gtsMf9xU?=
 =?us-ascii?Q?1au3KWPy4BCxLjnSHqNSZ/J0KcMKVHjI/J70qs0RwSVRXyLwxgsSGFJTMovj?=
 =?us-ascii?Q?/vHhUWtUkbWRcCmC4YhrXPoTI3hV28LsLb84mwXfmELQEvo/f4wws1XWBfBm?=
 =?us-ascii?Q?2Ioso3jJDEMo1H2LdcFZHlI3z88smSP/Pp0UyDugVuz9XCjt2WMikbPEEjdZ?=
 =?us-ascii?Q?CONZV4lw3WmOlbUuKexKLgUoVa11WbCzwEYAZ6doGmfwuyawowN7jRwBo85H?=
 =?us-ascii?Q?r9dmi0TjILdiJE3unSAB71RpLXHIFJFP3cbEdZlqdUgwM1KDQrYP+c73Rnvw?=
 =?us-ascii?Q?qJbMs3pR/UNMEiEOe7McAiglSG/5ewTsqa0Wc3ikHXVBhG7gZXws0OGfy0+E?=
 =?us-ascii?Q?ksVZ543O0pKRfidY/lDY+qx8FnK0Z7MnVkYFXbW7A0wpOe8uk0118wCTc62e?=
 =?us-ascii?Q?7UpcSdtGbmuR5N8dteRA6RnE3A2RY5dwmROBiu6EKmjnc9xGKrV27GmuQbc8?=
 =?us-ascii?Q?BvQxrP9AmSBIxE9pZWanPgirymIZSk6/DzobDlebAVucUiI4hHsWXH/Sqjw4?=
 =?us-ascii?Q?B/AMUGLL7g/4idzQt166UM9qYqA5RR+3dVHrEPc6kWe00WGhenfcDeI4upN6?=
 =?us-ascii?Q?yuIfdOkF0neO9YvKXmuH66WYM5W8OyEQqk4k/Ee21QPb7HBrXk3YLw9uyotU?=
 =?us-ascii?Q?TDe8LSoplvWOP6RAKnFy/MVWlCkswjW/sMU8Uqa8PzXK/5W4au790TsfK1H3?=
 =?us-ascii?Q?H2Cd5fYtoCBLY8Hfcyrzz1VdcEXq7ItW7dGxsAPjfDStu8Glv+uFiBlfXhbO?=
 =?us-ascii?Q?Cu4xJmNAHFDo85descBjX4SYtdepZjUYjnMxgGPxTgNIiC5t+6KMboNd6v4o?=
 =?us-ascii?Q?JHhA5WRaRtsCS13WHh5ghg/IPKEgMHjwlQe4YuX8e1Wrcan71fsQ+RNPe24g?=
 =?us-ascii?Q?JlQzLwEL4zVIi2wBWKEU1ZKvwNUW/AfgYUsph9Q8/sTME0sXbIVkWJ+B8o0Q?=
 =?us-ascii?Q?KzfRPukgJqLxXgwPnAIvVTXjAglpkWx5MYY9/VopJIDR6Tlbv+HjYBDYU51a?=
 =?us-ascii?Q?N9kwD0NolVA0aszVq06reggm0xS65BS1DRgrmW/8CuEqVtbm8SDNlONeDUWV?=
 =?us-ascii?Q?pZly1SoOAvemPj6pvlUs8bt2S4tLdnidtAFh+aW2UNQXuhNdthAA+nL17MrG?=
 =?us-ascii?Q?4iQyAy3ngtK0guUAcv9hdt+nUOdFT018EfTvsy3zVizpmXevVv/lKJyyhFge?=
 =?us-ascii?Q?ggo3nVX74JyxnLaHlLn2+tah9WPYkwMYiZSHF3NeD7k0xfj4mtOIg35k0+wz?=
 =?us-ascii?Q?fu3pvX/c+gV2ZZlNKaFzM/EmO5m2elljA9KMAXgfm3VBtZMp9pqbPMZ8lEie?=
 =?us-ascii?Q?U0kKfryJLm7EgcDlU6+FC9B4phIGC7aPihsQUnmVOdzgjkbt4b3csQ1foqev?=
 =?us-ascii?Q?II3I0w=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5ebec9ea-e499-4592-c3bf-08d99a1b2c54
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Oct 2021 13:59:35.0821
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: LCFhfBAbOEdaNu/2iSLskRo2ikqy5hkyW+ZC65M06FuPT+yyz52XA0szE9orls1x6B1Ph/dX9RuwWff3yrDGavJut9CQh5MT+F5aU2H5WPM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR10MB3283
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10150 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 malwarescore=0
 adultscore=0 suspectscore=0 bulkscore=0 mlxscore=0 spamscore=0
 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2110280077
X-Proofpoint-GUID: 7nGOtMqxqKYgxx0i_oyayPCIesDrqdAA
X-Proofpoint-ORIG-GUID: 7nGOtMqxqKYgxx0i_oyayPCIesDrqdAA
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Do a sanity check on struct drm_format_info hsub and vsub values to
avoid divide by zero.

Syzkaller reported a divide error in framebuffer_check() when the
DRM_FORMAT_Q410 or DRM_FORMAT_Q401 pixel_format is passed in via
the DRM_IOCTL_MODE_ADDFB2 ioctl. The drm_format_info struct for
the DRM_FORMAT_Q410 pixel_pattern has ".hsub = 0" and ".vsub = 0".
fb_plane_width() uses hsub as a divisor and fb_plane_height() uses
vsub as a divisor. These divisors need to be sanity checked for
zero before use.

divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 0 PID: 14995 Comm: syz-executor709 Not tainted 5.15.0-rc6-syzk #1
Hardware name: Red Hat KVM, BIOS 1.13.0-2
RIP: 0010:framebuffer_check drivers/gpu/drm/drm_framebuffer.c:199 [inline]
RIP: 0010:drm_internal_framebuffer_create+0x604/0xf90
drivers/gpu/drm/drm_framebuffer.c:317

Call Trace:
 drm_mode_addfb2+0xdc/0x320 drivers/gpu/drm/drm_framebuffer.c:355
 drm_mode_addfb2_ioctl+0x2a/0x40 drivers/gpu/drm/drm_framebuffer.c:391
 drm_ioctl_kernel+0x23a/0x2e0 drivers/gpu/drm/drm_ioctl.c:795
 drm_ioctl+0x589/0xac0 drivers/gpu/drm/drm_ioctl.c:898
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl fs/ioctl.c:860 [inline]
 __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: George Kennedy <george.kennedy@oracle.com>
---
 drivers/gpu/drm/drm_framebuffer.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c
index 07f5abc..a146e4b 100644
--- a/drivers/gpu/drm/drm_framebuffer.c
+++ b/drivers/gpu/drm/drm_framebuffer.c
@@ -195,6 +195,16 @@ static int framebuffer_check(struct drm_device *dev,
 	/* now let the driver pick its own format info */
 	info = drm_get_format_info(dev, r);
 
+	if (info->hsub == 0) {
+		DRM_DEBUG_KMS("bad horizontal chroma subsampling factor %u\n", info->hsub);
+		return -EINVAL;
+	}
+
+	if (info->vsub == 0) {
+		DRM_DEBUG_KMS("bad vertical chroma subsampling factor %u\n", info->vsub);
+		return -EINVAL;
+	}
+
 	for (i = 0; i < info->num_planes; i++) {
 		unsigned int width = fb_plane_width(r->width, info, i);
 		unsigned int height = fb_plane_height(r->height, info, i);
-- 
1.8.3.1