From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Wei Chen <harperchen1110@gmail.com>, Helge Deller <deller@gmx.de>,
Sasha Levin <sashal@kernel.org>,
adaplas@gmail.com, linux-fbdev@vger.kernel.org,
dri-devel@lists.freedesktop.org
Subject: [PATCH AUTOSEL 6.2 39/45] fbdev: nvidia: Fix potential divide by zero
Date: Wed, 22 Mar 2023 15:56:33 -0400 [thread overview]
Message-ID: <20230322195639.1995821-39-sashal@kernel.org> (raw)
In-Reply-To: <20230322195639.1995821-1-sashal@kernel.org>
From: Wei Chen <harperchen1110@gmail.com>
[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ]
variable var->pixclock can be set by user. In case it
equals to zero, divide by zero would occur in nvidiafb_set_par.
Similar crashes have happened in other fbdev drivers. There
is no check and modification on var->pixclock along the call
chain to nvidia_check_var and nvidiafb_set_par. We believe it
could also be triggered in driver nvidia from user site.
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/nvidia/nvidia.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
index e60a276b4855d..ea4ba3dfb96bb 100644
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -764,6 +764,8 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var,
int pitch, err = 0;
NVTRACE_ENTER();
+ if (!var->pixclock)
+ return -EINVAL;
var->transp.offset = 0;
var->transp.length = 0;
--
2.39.2
next prev parent reply other threads:[~2023-03-22 20:03 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-22 19:55 [PATCH AUTOSEL 6.2 01/45] xfrm: Zero padding when dumping algos and encap Sasha Levin
2023-03-22 19:55 ` [PATCH AUTOSEL 6.2 02/45] ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds Sasha Levin
2023-03-22 19:55 ` [PATCH AUTOSEL 6.2 03/45] ASoC: Intel: avs: max98357a: Explicitly define codec format Sasha Levin
2023-03-22 19:55 ` [PATCH AUTOSEL 6.2 04/45] ASoC: Intel: avs: da7219: " Sasha Levin
2023-03-22 19:55 ` [PATCH AUTOSEL 6.2 05/45] ASoC: Intel: avs: rt5682: " Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 06/45] ASoC: Intel: avs: ssm4567: Remove nau8825 bits Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 07/45] ASoC: Intel: avs: nau8825: Adjust clock control Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 08/45] lib: zstd: Backport fix for in-place decompression Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 09/45] zstd: Fix definition of assert() Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 10/45] ACPI: video: Add backlight=native DMI quirk for Dell Vostro 15 3535 Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 11/45] ACPI: x86: Introduce an acpi_quirk_skip_gpio_event_handlers() helper Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 12/45] ACPI: x86: Add skip i2c clients quirk for Acer Iconia One 7 B1-750 Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 13/45] ACPI: x86: Add skip i2c clients quirk for Lenovo Yoga Book X90 Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 14/45] ASoC: SOF: ipc3: Check for upper size limit for the received message Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 15/45] ASoC: SOF: ipc4-topology: Fix incorrect sample rate print unit Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 16/45] ASoC: SOF: Intel: pci-tng: revert invalid bar size setting Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 17/45] ASoC: SOF: Intel: hda-dsp: harden D0i3 programming sequence Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 18/45] ASoC: SOF: Intel: hda-ctrl: re-add sleep after entering and exiting reset Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 19/45] ASoC: SOF: IPC4: update gain ipc msg definition to align with fw Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 20/45] ASoC: hdmi-codec: only startup/shutdown on supported streams Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 21/45] wifi: mac80211: check basic rates validity Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 22/45] md: avoid signed overflow in slot_store() Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 23/45] x86/PVH: obtain VGA console info in Dom0 Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 24/45] drm/amdkfd: Fix BO offset for multi-VMA page migration Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 25/45] drm/amdkfd: fix a potential double free in pqm_create_queue Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 26/45] drm/amdgpu/vcn: custom video info caps for sriov Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 27/45] drm/amdkfd: fix potential kgd_mem UAFs Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 28/45] drm/amd/display: Fix HDCP failing to enable after suspend Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 29/45] net: hsr: Don't log netdev_err message on unknown prp dst node Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 30/45] ALSA: asihpi: check pao in control_message() Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 31/45] ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 32/45] fbdev: tgafb: Fix potential divide by zero Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 33/45] ACPI: tools: pfrut: Check if the input of level and type is in the right numeric range Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 34/45] sched_getaffinity: don't assume 'cpumask_size()' is fully initialized Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 35/45] nvme-pci: fixing memory leak in probe teardown path Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 36/45] nvme-pci: add NVME_QUIRK_BOGUS_NID for Lexar NM620 Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 37/45] drm/amdkfd: Fixed kfd_process cleanup on module exit Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 38/45] net/mlx5e: Lower maximum allowed MTU in XSK to match XDP prerequisites Sasha Levin
2023-03-22 19:56 ` Sasha Levin [this message]
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 40/45] fbdev: intelfb: Fix potential divide by zero Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 41/45] fbdev: lxfb: " Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 42/45] fbdev: au1200fb: " Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 43/45] tools/power turbostat: Fix /dev/cpu_dma_latency warnings Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 44/45] tools/power turbostat: fix decoding of HWP_STATUS Sasha Levin
2023-03-22 19:56 ` [PATCH AUTOSEL 6.2 45/45] tracing: Fix wrong return in kprobe_event_gen_test.c Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230322195639.1995821-39-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=adaplas@gmail.com \
--cc=deller@gmx.de \
--cc=dri-devel@lists.freedesktop.org \
--cc=harperchen1110@gmail.com \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®