From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33031C43219 for ; Wed, 30 Mar 2022 12:07:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347942AbiC3MI0 (ORCPT ); Wed, 30 Mar 2022 08:08:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344480AbiC3LxM (ORCPT ); Wed, 30 Mar 2022 07:53:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 242AB26242A; Wed, 30 Mar 2022 04:49:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C32F3B81C23; Wed, 30 Mar 2022 11:48:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8C58BC3410F; Wed, 30 Mar 2022 11:48:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1648640938; bh=xuNZMXifvmTGhpPgK2BkPkaKp82sCR/h9SV2ylyFzog=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V1CzbiX94X8okQBVm/cClxTSxBpu1OoXuA2A+YBLsE+rJNxVVWq8tNiFPeIYZioUS snNMU32ZTUcHeLClDHHSZBpyxuYJ37HU9heEpV33mH0kgtOR20YPBeJHQZHGWRzX4P dih65CsmknuDSyJTe0QdsOXlFusM7areYImmoK+qE1UWjaeOkREb9fgcps+8bXld0W 9bmzvaVyTq+37s5a6gUF6kdlyKUUnwCXwspu7CJqoqBBZT6stIPxUbZL7RHCQWm3++ k81JbpkAFCcqK41S5xIvqiB8PWDuAqSDv0WNYSg38AvIJimgZCdvqRBA0sGq8uOObb rSDHPKxGc8/Vg== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: George Kennedy , Geert Uytterhoeven , Helge Deller , Sasha Levin , tomi.valkeinen@ti.com, linux-fbdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.16 16/59] video: fbdev: cirrusfb: check pixclock to avoid divide by zero Date: Wed, 30 Mar 2022 07:47:48 -0400 Message-Id: <20220330114831.1670235-16-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220330114831.1670235-1-sashal@kernel.org> References: <20220330114831.1670235-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: George Kennedy [ Upstream commit 5c6f402bdcf9e7239c6bc7087eda71ac99b31379 ] Do a sanity check on pixclock value to avoid divide by zero. If the pixclock value is zero, the cirrusfb driver will round up pixclock to get the derived frequency as close to maxclock as possible. Syzkaller reported a divide error in cirrusfb_check_pixclock. divide error: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2 RIP: 0010:cirrusfb_check_var+0x6f1/0x1260 Call Trace: fb_set_var+0x398/0xf90 do_fb_ioctl+0x4b8/0x6f0 fb_ioctl+0xeb/0x130 __x64_sys_ioctl+0x19d/0x220 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Signed-off-by: George Kennedy Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller Signed-off-by: Sasha Levin --- drivers/video/fbdev/cirrusfb.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c index 93802abbbc72..3d47c347b897 100644 --- a/drivers/video/fbdev/cirrusfb.c +++ b/drivers/video/fbdev/cirrusfb.c @@ -469,7 +469,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) return 0; } -static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, +static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, struct fb_info *info) { long freq; @@ -478,9 +478,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, unsigned maxclockidx = var->bits_per_pixel >> 3; /* convert from ps to kHz */ - freq = PICOS2KHZ(var->pixclock); - - dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + freq = PICOS2KHZ(var->pixclock ? : 1); maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; cinfo->multiplexing = 0; @@ -488,11 +486,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, /* If the frequency is greater than we can support, we might be able * to use multiplexing for the video mode */ if (freq > maxclock) { - dev_err(info->device, - "Frequency greater than maxclock (%ld kHz)\n", - maxclock); - return -EINVAL; + var->pixclock = KHZ2PICOS(maxclock); + + while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) + var->pixclock++; } + dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + /* * Additional constraint: 8bpp uses DAC clock doubling to allow maximum * pixel clock -- 2.34.1