1. 11 Apr, 2022 8 commits
    • Zheyu Ma's avatar
      video: fbdev: i740fb: Error out if 'pixclock' equals zero · 15cf0b82
      Zheyu Ma authored
      The userspace program could pass any values to the driver through
      ioctl() interface. If the driver doesn't check the value of 'pixclock',
      it may cause divide error.
      
      Fix this by checking whether 'pixclock' is zero in the function
      i740fb_check_var().
      
      The following log reveals it:
      
      divide error: 0000 [#1] PREEMPT SMP KASAN PTI
      RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:444 [inline]
      RIP: 0010:i740fb_set_par+0x272f/0x3bb0 drivers/video/fbdev/i740fb.c:739
      Call Trace:
          fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1036
          do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1112
          fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1191
          vfs_ioctl fs/ioctl.c:51 [inline]
          __do_sys_ioctl fs/ioctl.c:874 [inline]
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      15cf0b82
    • Ondrej Zary's avatar
      video: fbdev: i740fb: use memset_io() to clear screen · 12acdbd7
      Ondrej Zary authored
      sparse complains that using memset() on __iomem pointer is wrong:
      incorrect type in argument 1 (different address spaces)
      
      Use memset_io() to clear screen instead.
      
      Tested on real i740 cards.
      Signed-off-by: default avatarOndrej Zary <linux@zary.sk>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      12acdbd7
    • Zheyu Ma's avatar
      video: fbdev: s3fb: Error out if 'pixclock' equals zero · 7015bb57
      Zheyu Ma authored
      The userspace program could pass any values to the driver through
      ioctl() interface. If the driver doesn't check the value of 'pixclock',
      it may cause divide error.
      
      Fix this by checking whether 'pixclock' is zero in s3fb_check_var().
      
      The following log reveals it:
       divide error: 0000 [#1] PREEMPT SMP KASAN PTI
       RIP: 0010:s3fb_check_var+0x3f3/0x530
       Call Trace:
        <TASK>
        fb_set_var+0x367/0xeb0
        do_fb_ioctl+0x234/0x670
        fb_ioctl+0xdd/0x130
        do_syscall_64+0x3b/0x90
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      7015bb57
    • Zheyu Ma's avatar
      video: fbdev: arkfb: Error out if 'pixclock' equals zero · e1e96515
      Zheyu Ma authored
      The userspace program could pass any values to the driver through
      ioctl() interface. If the driver doesn't check the value of 'pixclock',
      it may cause divide error.
      
      Fix this by checking whether 'pixclock' is zero.
      
      The following log reveals it:
       divide error: 0000 [#1] PREEMPT SMP KASAN PTI
       RIP: 0010:arkfb_set_par+0x10fc/0x24f0
       Call Trace:
        <TASK>
        fb_set_var+0x604/0xeb0
        do_fb_ioctl+0x234/0x670
        fb_ioctl+0xdd/0x130
        do_syscall_64+0x3b/0x90
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      e1e96515
    • Zheyu Ma's avatar
      video: fbdev: tridentfb: Error out if 'pixclock' equals zero · 16844e58
      Zheyu Ma authored
      The userspace program could pass any values to the driver through
      ioctl() interface. If the driver doesn't check the value of 'pixclock',
      it may cause divide error.
      
      Fix this by checking whether 'pixclock' is zero.
      
      The following log reveals it:
       divide error: 0000 [#1] PREEMPT SMP KASAN PTI
       RIP: 0010:tridentfb_check_var+0x853/0xe60
       Call Trace:
        <TASK>
        fb_set_var+0x367/0xeb0
        do_fb_ioctl+0x234/0x670
        fb_ioctl+0xdd/0x130
        do_syscall_64+0x3b/0x90
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      16844e58
    • Zheyu Ma's avatar
      video: fbdev: vt8623fb: Error out if 'pixclock' equals zero · f2bfd792
      Zheyu Ma authored
      The userspace program could pass any values to the driver through
      ioctl() interface. If the driver doesn't check the value of 'pixclock',
      it may cause divide error.
      
      Fix this by checking whether 'pixclock' is zero in the function
      vt8623fb_check_var().
      
      The following log reveals it:
       divide error: 0000 [#1] PREEMPT SMP KASAN PTI
       RIP: 0010:vt8623fb_set_par+0xecd/0x2210
       Call Trace:
        <TASK>
        fb_set_var+0x604/0xeb0
        do_fb_ioctl+0x234/0x670
        fb_ioctl+0xdd/0x130
        do_syscall_64+0x3b/0x90
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      f2bfd792
    • Zheyu Ma's avatar
      video: fbdev: kyro: Error out if 'lineclock' equals zero · 213e2df4
      Zheyu Ma authored
      The userspace program could pass any values to the driver through
      ioctl() interface. If the driver doesn't check the value of 'lineclock',
      it may cause divide error.
      
      Fix this by checking whether 'lineclock' is zero.
      
      The following log reveals it:
       divide error: 0000 [#1] PREEMPT SMP KASAN PTI
       RIP: 0010:kyrofb_set_par+0x30d/0xd80
       Call Trace:
        <TASK>
        fb_set_var+0x604/0xeb0
        do_fb_ioctl+0x234/0x670
        fb_ioctl+0xdd/0x130
        do_syscall_64+0x3b/0x90
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      213e2df4
    • Zheyu Ma's avatar
      video: fbdev: neofb: Fix the check of 'var->pixclock' · 85ec038b
      Zheyu Ma authored
      The previous check against 'var->pixclock' doesn't return -EINVAL when
      it equals zero, but the driver uses it again, causing the divide error.
      
      Fix this by returning when 'var->pixclock' is zero.
      
      The following log reveals it:
       divide error: 0000 [#1] PREEMPT SMP KASAN PTI
       RIP: 0010:neofb_set_par+0x190f/0x49a0
       Call Trace:
        <TASK>
        fb_set_var+0x604/0xeb0
        do_fb_ioctl+0x234/0x670
        fb_ioctl+0xdd/0x130
        do_syscall_64+0x3b/0x90
      Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
      Signed-off-by: default avatarHelge Deller <deller@gmx.de>
      85ec038b
  2. 07 Apr, 2022 1 commit
  3. 04 Apr, 2022 8 commits
  4. 03 Apr, 2022 8 commits
  5. 02 Apr, 2022 15 commits