| Message ID | 20250607194959.2457473-1-alexguo1023@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | fbdev: pm3fb: Fix potential divide by zero | expand |
On 6/7/25 21:49, Alex Guo wrote: > variable var->pixclock can be set by user. In case it equals to > zero, divide by zero would occur in pm3fb_check_var. Similar > crashes have happened in other fbdev drivers. There is no check > and modification on var->pixclock along the call chain to > pm3fb_check_var. So we fix this by checking whether 'pixclock' > is zero. > > Similar commit: commit 16844e58704 ("video: fbdev: tridentfb: > Error out if 'pixclock' equals zero") > > Signed-off-by: Alex Guo <alexguo1023@gmail.com> > --- > drivers/video/fbdev/pm3fb.c | 3 +++ > 1 file changed, 3 insertions(+) applied. Thanks! Helge
diff --git a/drivers/video/fbdev/pm3fb.c b/drivers/video/fbdev/pm3fb.c index 6e55e42514d6..d9b3f1937ce6 100644 --- a/drivers/video/fbdev/pm3fb.c +++ b/drivers/video/fbdev/pm3fb.c @@ -998,6 +998,9 @@ static int pm3fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) return -EINVAL; } + if (!var->pixclock) + return -EINVAL; + if (PICOS2KHZ(var->pixclock) > PM3_MAX_PIXCLOCK) { DPRINTK("pixclock too high (%ldKHz)\n", PICOS2KHZ(var->pixclock));
variable var->pixclock can be set by user. In case it equals to zero, divide by zero would occur in pm3fb_check_var. Similar crashes have happened in other fbdev drivers. There is no check and modification on var->pixclock along the call chain to pm3fb_check_var. So we fix this by checking whether 'pixclock' is zero. Similar commit: commit 16844e58704 ("video: fbdev: tridentfb: Error out if 'pixclock' equals zero") Signed-off-by: Alex Guo <alexguo1023@gmail.com> --- drivers/video/fbdev/pm3fb.c | 3 +++ 1 file changed, 3 insertions(+)