From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 20 Sep 2022 17:44:21 +0000 (+0200)
Subject: 5.15-stable patches
X-Git-Tag: v5.19.11~29
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ab05993f1818eb46e0e77afc6ea03b1f2e0878ca;p=thirdparty%2Fkernel%2Fstable-queue.git

5.15-stable patches

added patches:
	video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch
---

diff --git a/queue-5.15/series b/queue-5.15/series
index a73ce30f9ad..46f79e3b1c5 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -25,3 +25,4 @@ drm-amdgpu-don-t-enable-ltr-if-not-supported.patch
 drm-amdgpu-move-nbio-ih_doorbell_range-into-ih-code-for-vega.patch
 drm-amdgpu-move-nbio-sdma_doorbell_range-into-sdma-code-for-vega.patch
 binder-remove-inaccurate-mmap_assert_locked.patch
+video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch
diff --git a/queue-5.15/video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch b/queue-5.15/video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch
new file mode 100644
index 00000000000..ef794638e8c
--- /dev/null
+++ b/queue-5.15/video-fbdev-i740fb-error-out-if-pixclock-equals-zero.patch
@@ -0,0 +1,48 @@
+From 15cf0b82271b1823fb02ab8c377badba614d95d5 Mon Sep 17 00:00:00 2001
+From: Zheyu Ma <zheyuma97@gmail.com>
+Date: Mon, 4 Apr 2022 16:47:17 +0800
+Subject: video: fbdev: i740fb: Error out if 'pixclock' equals zero
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+commit 15cf0b82271b1823fb02ab8c377badba614d95d5 upstream.
+
+The userspace program could pass any values to the driver through
+ioctl() interface. If the driver doesn't check the value of 'pixclock',
+it may cause divide error.
+
+Fix this by checking whether 'pixclock' is zero in the function
+i740fb_check_var().
+
+The following log reveals it:
+
+divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:444 [inline]
+RIP: 0010:i740fb_set_par+0x272f/0x3bb0 drivers/video/fbdev/i740fb.c:739
+Call Trace:
+    fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1036
+    do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1112
+    fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1191
+    vfs_ioctl fs/ioctl.c:51 [inline]
+    __do_sys_ioctl fs/ioctl.c:874 [inline]
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/i740fb.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/video/fbdev/i740fb.c
++++ b/drivers/video/fbdev/i740fb.c
+@@ -662,6 +662,9 @@ static int i740fb_decode_var(const struc
+ 
+ static int i740fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
++	if (!var->pixclock)
++		return -EINVAL;
++
+ 	switch (var->bits_per_pixel) {
+ 	case 8:
+ 		var->red.offset	= var->green.offset = var->blue.offset = 0;