5.10-stable patches

added patches:
	video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch

diff --git a/queue-5.10/series b/queue-5.10/series
index 152bb3b32f49db3f9399600e52d24370db3bc72e..3c1ff24769488fd68b86d323203c3fbe45b4c473 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -21,3 +21,4 @@ of-device-fix-up-of_dma_configure_id-stub.patch
 cifs-revalidate-mapping-when-doing-direct-writes.patch
 cifs-don-t-send-down-the-destination-address-to-sendmsg-for-a-sock_stream.patch
 tools-include-uapi-fix-asm-errno.h-for-parisc-and-xtensa.patch
+video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch

diff --git a/queue-5.10/video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch b/queue-5.10/video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch
new file mode 100644 (file)
index 0000000..ef79463
--- /dev/null
+++ b/queue-5.10/video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch
@@ -0,0 +1,48 @@
+From 15cf0b82271b1823fb02ab8c377badba614d95d5 Mon Sep 17 00:00:00 2001
+From: Zheyu Ma <zheyuma97@gmail.com>
+Date: Mon, 4 Apr 2022 16:47:17 +0800
+Subject: video: fbdev: i740fb: Error out if 'pixclock' equals zero
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+commit 15cf0b82271b1823fb02ab8c377badba614d95d5 upstream.
+
+The userspace program could pass any values to the driver through
+ioctl() interface. If the driver doesn't check the value of 'pixclock',
+it may cause divide error.
+
+Fix this by checking whether 'pixclock' is zero in the function
+i740fb_check_var().
+
+The following log reveals it:
+
+divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:444 [inline]
+RIP: 0010:i740fb_set_par+0x272f/0x3bb0 drivers/video/fbdev/i740fb.c:739
+Call Trace:
+    fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1036
+    do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1112
+    fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1191
+    vfs_ioctl fs/ioctl.c:51 [inline]
+    __do_sys_ioctl fs/ioctl.c:874 [inline]
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/i740fb.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/video/fbdev/i740fb.c
++++ b/drivers/video/fbdev/i740fb.c
+@@ -662,6 +662,9 @@ static int i740fb_decode_var(const struc
+ 
+ static int i740fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
++      if (!var->pixclock)
++              return -EINVAL;
++
+       switch (var->bits_per_pixel) {
+       case 8:
+               var->red.offset = var->green.offset = var->blue.offset = 0;