| Message ID | 20221013221105.171883-1-john.cabaj@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | [SRU,Jammy] (upstream) video: fbdev: i740fb: Error out if 'pixclock' equals zero | expand |
On 14.10.22 00:11, John Cabaj wrote: > From: Zheyu Ma <zheyuma97@gmail.com> > > CVE-2022-3061 This appears to be chaotic on the mailing list. Like 5 mails, 2 as a thread, the rest separate but all about the same issue. Apart from that the use of "(upstream)" is not right. Not sure we still use it at all. It did mean something should go to upstream, not that it came from there. Roughly glancing the patch applies across all series, so the submission should look like * [SRU J/F/B v2][PATCH 0/1] Fix CVE-2022-3061 (fbdev pixclock) - [SRU J/F/B][PATCH 1/1] video: fbdev: i740fb: Error out if 'pixclock' equals zero The subject of the cover email might vary. Personally I find it good to have a summary of the batch. But the primary point here is to have only one change to look at, download, and apply when accepted. -Stefan PS: I will NACK the other pieces as well but without comment. > > The userspace program could pass any values to the driver through > ioctl() interface. If the driver doesn't check the value of 'pixclock', > it may cause divide error. > > Fix this by checking whether 'pixclock' is zero in the function > i740fb_check_var(). > > The following log reveals it: > > divide error: 0000 [#1] PREEMPT SMP KASAN PTI > RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:444 [inline] > RIP: 0010:i740fb_set_par+0x272f/0x3bb0 drivers/video/fbdev/i740fb.c:739 > Call Trace: > fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1036 > do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1112 > fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1191 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:874 [inline] > > Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> > Signed-off-by: Helge Deller <deller@gmx.de> > (cherry picked from commit 15cf0b82271b1823fb02ab8c377badba614d95d5) > Signed-off-by: John Cabaj <john.cabaj@canonical.com> > --- > drivers/video/fbdev/i740fb.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c > index ad5ced4ef972..8fb4e01e1943 100644 > --- a/drivers/video/fbdev/i740fb.c > +++ b/drivers/video/fbdev/i740fb.c > @@ -662,6 +662,9 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, > > static int i740fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) > { > + if (!var->pixclock) > + return -EINVAL; > + > switch (var->bits_per_pixel) { > case 8: > var->red.offset = var->green.offset = var->blue.offset = 0;
diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c index ad5ced4ef972..8fb4e01e1943 100644 --- a/drivers/video/fbdev/i740fb.c +++ b/drivers/video/fbdev/i740fb.c @@ -662,6 +662,9 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var, static int i740fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) { + if (!var->pixclock) + return -EINVAL; + switch (var->bits_per_pixel) { case 8: var->red.offset = var->green.offset = var->blue.offset = 0;