microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/drivers
История
Zheyu Ma 236c150252 video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() 
[ Upstream commit 2f1c4523f7 ]

Since the user can control the arguments of the ioctl() from the user
space, under special arguments that may result in a divide-by-zero bug
in:
  drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul);
with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0.
and then in:
  drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock);
we'll get a division-by-zero.

The following log can reveal it:

divide error: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline]
RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784
Call Trace:
 fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034
 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189

Fix this by checking the argument of ark_set_pixclock() first.

Fixes: 681e14730c ("arkfb: new framebuffer driver for ARK Logic cards")
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2022-08-17 14:24:15 +02:00
..
accessibility tty: the rest, stop using tty_schedule_flip() 2022-07-29 17:25:32 +02:00
acpi ACPI: VIOT: Fix ACS setup 2022-08-17 14:23:11 +02:00
amba
…
android android: binder: stop saving a pointer to the VMA 2022-08-17 14:23:58 +02:00
ata ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() 2022-06-22 14:21:56 +02:00
atm atm: eni: Add check for dma_map_single 2022-03-23 09:16:41 +01:00
auxdisplay auxdisplay: lcd2s: Use proper API to free the instance of charlcd object 2022-03-08 19:12:47 +01:00
base driver core: fix potential deadlock in __driver_attach 2022-08-17 14:23:45 +02:00
bcma
…
block null_blk: fix ida error handling in null_add_dev() 2022-08-17 14:24:00 +02:00
bluetooth Bluetooth: hci_intel: Add check for platform_driver_register 2022-08-17 14:23:34 +02:00
bus bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() 2022-08-17 14:23:10 +02:00
cdrom
…
char random: update comment from copy_to_user() -> copy_to_iter() 2022-06-29 09:03:31 +02:00
clk clk: qcom: gcc-msm8939: Fix weird field spacing in ftbl_gcc_camss_cci_clk 2022-08-17 14:23:55 +02:00
clocksource clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup() 2022-07-07 17:53:32 +02:00
comedi comedi: vmk80xx: fix expression for tx buffer size 2022-06-22 14:22:03 +02:00
connector
…
counter
…
cpufreq cpufreq: pmac32-cpufreq: Fix refcount leak bug 2022-07-21 21:24:34 +02:00
cpuidle cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode 2022-06-09 10:22:33 +02:00
crypto crypto: hisilicon/sec - fix auth key size error 2022-08-17 14:23:35 +02:00
cxl cxl/port: Hold port reference until decoder release 2022-07-12 16:34:58 +02:00
dax dax: make sure inodes are flushed before destroy cache 2022-04-08 14:23:31 +02:00
dca
…
devfreq PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events 2022-07-07 17:53:27 +02:00
dio
…
dma dmaengine: imx-dma: Cast of_device_get_match_data() with (uintptr_t) 2022-08-17 14:23:56 +02:00
dma-buf dma-buf/poll: Get a file reference for outstanding fence callbacks 2022-07-12 16:34:51 +02:00
edac EDAC/ghes: Set the DIMM label unconditionally 2022-08-03 12:03:55 +02:00
eisa
…
extcon extcon: Modify extcon device to be created after driver data is set 2022-06-14 18:36:22 +02:00
firewire firewire: core: extend card->lock in fw_core_handle_bus_reset 2022-05-12 12:30:05 +02:00
firmware ACPI: APEI: explicit init of HEST and GHES in apci_init() 2022-08-17 14:23:11 +02:00
fpga fpga: altera-pr-ip: fix unsigned comparison with less than zero 2022-08-17 14:23:41 +02:00
fsi fsi: occ: Force sequence numbering per OCC 2022-07-07 17:53:32 +02:00
gnss
…
gpio gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() 2022-08-17 14:23:56 +02:00
gpu drm/exynos/exynos7_drm_decon: free resources when clk_set_parent() failed. 2022-08-17 14:23:30 +02:00
greybus greybus: svc: fix an error handling bug in gb_svc_hello() 2022-04-08 14:22:50 +02:00
hid HID: amd_sfh: Handle condition of "no sensors" 2022-08-17 14:23:57 +02:00
hsi
…
hv Drivers: hv: vmbus: Release cpu lock in error case 2022-06-22 14:22:00 +02:00
hwmon hwmon: (drivetemp) Add module alias 2022-08-17 14:23:13 +02:00
hwspinlock
…
hwtracing intel_th: msu: Fix vmalloced buffers 2022-08-17 14:23:49 +02:00
i2c i2c: mux-gpmux: Add of_node_put() when breaking out of loop 2022-08-17 14:23:34 +02:00
i3c i3c: master: dw: check return of dw_i3c_master_get_free_pos() 2022-03-08 19:12:37 +01:00
idle intel_idle: Disable IBRS during long idle 2022-07-23 12:54:04 +02:00
iio iio: cros: Register FIFO callback after sensor is registered 2022-08-17 14:23:55 +02:00
infiniband RDMA/rxe: Fix error unwind in rxe_create_qp() 2022-08-17 14:23:59 +02:00
input Input: goodix - try not to touch the reset-pin on x86/ACPI devices 2022-07-12 16:34:51 +02:00
interconnect interconnect: imx: fix max_node_id 2022-08-17 14:23:53 +02:00
iommu iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop 2022-08-17 14:24:09 +02:00
ipack
…
irqchip irqchip/mips-gic: Check the return value of ioremap() in gic_of_init() 2022-08-17 14:23:01 +02:00
isdn isdn: hfcpci: check the return value of dma_set_mask() in setup_hw() 2022-03-16 14:23:36 +01:00
leds
…
macintosh macintosh/adb: fix oob read in do_adb_query() function 2022-08-11 13:07:54 +02:00
mailbox mailbox: forward the hrtimer if not queued and under a lock 2022-06-09 10:23:12 +02:00
mcb
…
md dm: return early from dm_pr_call() if DM device is suspended 2022-08-17 14:23:15 +02:00
media media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment 2022-08-17 14:23:28 +02:00
memory memory: renesas-rpc-if: Avoid unaligned bus access for HyperFlash 2022-07-12 16:34:52 +02:00
memstick memstick/ms_block: Fix a memory leak 2022-08-17 14:23:50 +02:00
message
…
mfd mfd: max77620: Fix refcount leak in max77620_initialise_fps 2022-08-17 14:24:09 +02:00
misc eeprom: idt_89hpesx: uninitialized data in idt_dbgfs_csr_write() 2022-08-17 14:23:52 +02:00
mmc mmc: cavium-thunderx: Add of_node_put() when breaking out of loop 2022-08-17 14:23:57 +02:00
most
…
mtd mtd: spi-nor: fix spi_nor_spimem_setup_op() call in spi_nor_erase_{sector,chip}() 2022-08-17 14:23:58 +02:00
mux
…
net mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv 2022-08-17 14:23:44 +02:00
nfc NFC: nxp-nci: don't print header length mismatch on i2c error 2022-07-21 21:24:35 +02:00
ntb ntb: intel: fix port config status offset for SPR 2022-03-08 19:12:44 +01:00
nubus
…
nvdimm nvdimm: Fix badblocks clear off-by-one error 2022-07-07 17:53:24 +02:00
nvme nvme: catch -ENODEV from nvme_revalidate_zones again 2022-08-17 14:24:00 +02:00
nvmem nvmem: core: Fix a conflict between MTD and NVMEM on wp-gpios property 2022-03-02 11:48:06 +01:00
of of/fdt: declared return type does not match actual return type 2022-08-17 14:23:59 +02:00
opp opp: Fix error check in dev_pm_opp_attach_genpd() 2022-08-17 14:24:01 +02:00
parisc parisc: Check the return value of ioremap() in lba_driver_probe() 2022-08-17 14:22:51 +02:00
parport
…
pci PCI: tegra194: Fix link up retry sequence 2022-08-17 14:23:57 +02:00
pcmcia pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards 2022-06-14 18:36:02 +02:00
perf drivers/perf: arm_spe: Fix consistency of SYS_PMSCR_EL1.CX 2022-08-17 14:23:14 +02:00
phy phy: stm32: fix error return in stm32_usbphyc_phy_init 2022-08-17 14:23:52 +02:00
pinctrl pinctrl: armada-37xx: use raw spinlocks for regmap to avoid invalid wait context 2022-07-29 17:25:20 +02:00
platform platform/olpc: Fix uninitialized data in debugfs write 2022-08-17 14:23:58 +02:00
pnp
…
power power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe 2022-07-29 17:25:10 +02:00
powercap
…
pps pps: clients: gpio: Propagate return value from pps_gpio_probe 2022-04-08 14:23:44 +02:00
ps3
…
ptp ptp: replace snprintf with sysfs_emit 2022-04-13 20:59:01 +02:00
pwm pwm: lpc18xx: Fix period handling 2022-08-17 14:23:16 +02:00
rapidio
…
ras
…
regulator regulator: of: Fix refcount leak bug in of_get_regulation_constraints() 2022-08-17 14:23:14 +02:00
remoteproc remoteproc: sysmon: Wait for SSCTL service to come up 2022-08-17 14:24:09 +02:00
reset reset: tegra-bpmp: Restore Handle errors in BPMP response 2022-04-27 14:38:55 +02:00
rpmsg rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge 2022-08-17 14:24:08 +02:00
rtc rtc: rx8025: fix 12/24 hour mode detection on RX-8035 2022-08-17 14:22:53 +02:00
s390 s390/zcore: fix race when reading from hardware system area 2022-08-17 14:24:10 +02:00
sbus
…
scsi scsi: smartpqi: Fix DMA direction for RAID requests 2022-08-17 14:23:51 +02:00
sh
…
siox
…
slimbus slimbus: qcom: Fix IRQ check in qcom_slim_probe 2022-05-18 10:26:55 +02:00
soc soc: qcom: Make QCOM_RPMPD depend on PM 2022-08-17 14:23:14 +02:00
soundwire soundwire: revisit driver bind/unbind and callbacks 2022-08-17 14:23:48 +02:00
spi spi: tegra20-slink: fix UAF in tegra_slink_remove() 2022-08-17 14:23:12 +02:00
spmi
…
ssb
…
staging staging: rtl8192u: Fix sleep in atomic context bug in dm_fsync_timer_callback 2022-08-17 14:23:50 +02:00
target target: remove an incorrect unmap zeroes data deduction 2022-06-09 10:22:47 +02:00
tc
…
tee optee: use driver internal tee_context for some rpc 2022-03-02 11:47:51 +01:00
thermal thermal: sysfs: Fix cooling_device_stats_setup() error code path 2022-08-17 14:22:50 +02:00
thunderbolt thunderbolt: Use different lane for second DisplayPort tunnel 2022-06-14 18:36:20 +02:00
tty tty: serial: fsl_lpuart: correct the count of break characters 2022-08-17 14:24:12 +02:00
uio
…
usb usb: cdns3: Don't use priv_dev uninitialized in cdns3_gadget_ep_enable() 2022-08-17 14:24:01 +02:00
vdpa vduse: Tie vduse mgmtdev and its device 2022-07-21 21:24:33 +02:00
vfio vfio/pci: Fix vf_token mechanism when device-specific VF drivers are used 2022-04-20 09:34:13 +02:00
vhost vringh: Fix loop descriptors check in the indirect cases 2022-06-14 18:36:24 +02:00
video video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() 2022-08-17 14:24:15 +02:00
virt virt: acrn: fix a memory leak in acrn_dev_ioctl() 2022-04-08 14:23:50 +02:00
virtio virtio_mmio: Restore guest page size on resume 2022-07-21 21:24:33 +02:00
visorbus
…
vlynq
…
vme
…
w1 w1: w1_therm: fixes w1_seq for ds28ea00 sensors 2022-04-13 20:59:11 +02:00
watchdog watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe() 2022-08-17 14:24:11 +02:00
xen xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE 2022-07-21 21:24:23 +02:00
zorro
…
Kconfig
…
Makefile
…