From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59AD7C4167B for ; Wed, 30 Mar 2022 12:14:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345278AbiC3MNh (ORCPT ); Wed, 30 Mar 2022 08:13:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58602 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345913AbiC3LzM (ORCPT ); Wed, 30 Mar 2022 07:55:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0AFD275C83; Wed, 30 Mar 2022 04:52:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4BF3B61701; Wed, 30 Mar 2022 11:52:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF138C340EE; Wed, 30 Mar 2022 11:52:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1648641152; bh=Zl3mV2kom1J1QGfCvXrzMeZKwH+Y7QGCQgb+92XB33U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cezlwBjklPOnMm63Pbhwd7TItqiGU+5rL865Xc6zBlLFswSLKzF3FBR+WIcB+cpsE oGGhj+yIRUwGcOyV3/obsoT2bw1DCbUevaNUPUMm6SYN1XgwQI8OzL0HYJLQ4tKvZl 6hAAg9IyGqPA3Lq4efCqycZ+YS7efHvR6TFkqZRI0/F2mZAwnzPVZg8jogHVClQcO0 ekZJv61KHLJcNFQHUQdfonxkpQJIPgxORt5VG24orRq7bLLT2d0bZui4C65XVDP6KV I1jrPMGVn9KBJnxt6yUNLlM/E1h7D9XJ+eWJb5Hh0CkCZHbQEWza9ys2aC2I6yBTuJ BSejM2v4+RqUQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: George Kennedy , Geert Uytterhoeven , Helge Deller , Sasha Levin , tomi.valkeinen@ti.com, linux-fbdev@vger.kernel.org Subject: [PATCH AUTOSEL 5.4 04/25] video: fbdev: cirrusfb: check pixclock to avoid divide by zero Date: Wed, 30 Mar 2022 07:52:04 -0400 Message-Id: <20220330115225.1672278-4-sashal@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220330115225.1672278-1-sashal@kernel.org> References: <20220330115225.1672278-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: George Kennedy [ Upstream commit 5c6f402bdcf9e7239c6bc7087eda71ac99b31379 ] Do a sanity check on pixclock value to avoid divide by zero. If the pixclock value is zero, the cirrusfb driver will round up pixclock to get the derived frequency as close to maxclock as possible. Syzkaller reported a divide error in cirrusfb_check_pixclock. divide error: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2 RIP: 0010:cirrusfb_check_var+0x6f1/0x1260 Call Trace: fb_set_var+0x398/0xf90 do_fb_ioctl+0x4b8/0x6f0 fb_ioctl+0xeb/0x130 __x64_sys_ioctl+0x19d/0x220 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Signed-off-by: George Kennedy Reviewed-by: Geert Uytterhoeven Signed-off-by: Helge Deller Signed-off-by: Sasha Levin --- drivers/video/fbdev/cirrusfb.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c index e4ce5667b125..1b0a58f96af2 100644 --- a/drivers/video/fbdev/cirrusfb.c +++ b/drivers/video/fbdev/cirrusfb.c @@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) return 0; } -static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, +static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, struct fb_info *info) { long freq; @@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, unsigned maxclockidx = var->bits_per_pixel >> 3; /* convert from ps to kHz */ - freq = PICOS2KHZ(var->pixclock); - - dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + freq = PICOS2KHZ(var->pixclock ? : 1); maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; cinfo->multiplexing = 0; @@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, /* If the frequency is greater than we can support, we might be able * to use multiplexing for the video mode */ if (freq > maxclock) { - dev_err(info->device, - "Frequency greater than maxclock (%ld kHz)\n", - maxclock); - return -EINVAL; + var->pixclock = KHZ2PICOS(maxclock); + + while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) + var->pixclock++; } + dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + /* * Additional constraint: 8bpp uses DAC clock doubling to allow maximum * pixel clock -- 2.34.1