lkml.org 
[lkml]   [2024]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.10 4/8] fbdev: sis: Error out if pixclock equals zero
    Date
    From: Fullway Wang <fullwaywang@outlook.com>

    [ Upstream commit e421946be7d9bf545147bea8419ef8239cb7ca52 ]

    The userspace program could pass any values to the driver through
    ioctl() interface. If the driver doesn't check the value of pixclock,
    it may cause divide-by-zero error.

    In sisfb_check_var(), var->pixclock is used as a divisor to caculate
    drate before it is checked against zero. Fix this by checking it
    at the beginning.

    This is similar to CVE-2022-3061 in i740fb which was fixed by
    commit 15cf0b8.

    Signed-off-by: Fullway Wang <fullwaywang@outlook.com>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/video/fbdev/sis/sis_main.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/video/fbdev/sis/sis_main.c b/drivers/video/fbdev/sis/sis_main.c
    index 03c736f6f3d0..e540cb0c5172 100644
    --- a/drivers/video/fbdev/sis/sis_main.c
    +++ b/drivers/video/fbdev/sis/sis_main.c
    @@ -1474,6 +1474,8 @@ sisfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)

    vtotal = var->upper_margin + var->lower_margin + var->vsync_len;

    + if (!var->pixclock)
    + return -EINVAL;
    pixclock = var->pixclock;

    if((var->vmode & FB_VMODE_MASK) == FB_VMODE_NONINTERLACED) {
    --
    2.43.0

    \
     
     \ /
      Last update: 2024-05-27 14:46    [W:4.832 / U:0.616 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site