Kefeng Wang
0cbed4f1c6
hpet: Fix division by zero in hpet_time_div()
commit 0c7d37f4d9b8446956e97b7c5e61173cdb7c8522 upstream.
The base value in do_div() called by hpet_time_div() is truncated from
unsigned long to uint32_t, resulting in a divide-by-zero exception.
UBSAN: Undefined behaviour in ../drivers/char/hpet.c:572:2
division by zero
CPU: 1 PID: 23682 Comm: syz-executor.3 Not tainted 4.4.184.x86_64+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
0000000000000000 b573382df1853d00 ffff8800a3287b98 ffffffff81ad7561
ffff8800a3287c00 ffffffff838b35b0 ffffffff838b3860 ffff8800a3287c20
0000000000000000 ffff8800a3287bb0 ffffffff81b8f25e ffffffff838b35a0
Call Trace:
[<ffffffff81ad7561>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81ad7561>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<ffffffff81b8f25e>] ubsan_epilogue+0x12/0x8d lib/ubsan.c:166
[<ffffffff81b900cb>] __ubsan_handle_divrem_overflow+0x282/0x2c8 lib/ubsan.c:262
[<ffffffff823560dd>] hpet_time_div drivers/char/hpet.c:572 [inline]
[<ffffffff823560dd>] hpet_ioctl_common drivers/char/hpet.c:663 [inline]
[<ffffffff823560dd>] hpet_ioctl_common.cold+0xa8/0xad drivers/char/hpet.c:577
[<ffffffff81e63d56>] hpet_ioctl+0xc6/0x180 drivers/char/hpet.c:676
[<ffffffff81711590>] vfs_ioctl fs/ioctl.c:43 [inline]
[<ffffffff81711590>] file_ioctl fs/ioctl.c:470 [inline]
[<ffffffff81711590>] do_vfs_ioctl+0x6e0/0xf70 fs/ioctl.c:605
[<ffffffff81711eb4>] SYSC_ioctl fs/ioctl.c:622 [inline]
[<ffffffff81711eb4>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:613
[<ffffffff82846003>] tracesys_phase2+0x90/0x95
The main C reproducer autogenerated by syzkaller,
syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
memcpy((void*)0x20000100, "/dev/hpet\000", 10);
syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 0, 0);
syscall(__NR_ioctl, r[0], 0x40086806, 0x40000000000000);
Fix it by using div64_ul().
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Zhang HongJun <zhanghongjun2@huawei.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190711132757.130092-1-wangkefeng.wang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2019-08-04 09:33:43 +02:00 |
| .. |
|
agp
|
agp/intel: Flush all chipset writes after updating the GGTT
|
2018-03-22 09:17:57 +01:00 |
|
hw_random
|
hwrng: virtio - Avoid repeated init of completion
|
2019-04-05 22:29:13 +02:00 |
|
ipmi
|
ipmi:ssif: compare block number correctly for multi-part return messages
|
2019-05-21 18:49:00 +02:00 |
|
mwave
|
char/mwave: fix potential Spectre v1 vulnerability
|
2019-01-31 08:12:34 +01:00 |
|
pcmcia
|
pcmcia: remove left-over %Z format
|
2017-06-07 12:07:48 +02:00 |
|
tpm
|
tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
|
2019-04-27 09:34:41 +02:00 |
|
xilinx_hwicap
|
|
|
|
xillybus
|
char: xillybus: Fix spelling mistake and comment
|
2016-08-31 14:47:54 +02:00 |
|
apm-emulation.c
|
|
|
|
applicom.c
|
applicom: Fix potential Spectre v1 vulnerabilities
|
2019-03-13 14:04:54 -07:00 |
|
applicom.h
|
|
|
|
bfin-otp.c
|
miscdevice: Use module_misc_device() macro
|
2016-08-31 14:12:35 +02:00 |
|
bsr.c
|
|
|
|
ds1302.c
|
|
|
|
ds1620.c
|
|
|
|
dsp56k.c
|
dsp56k: prevent a harmless underflow
|
2016-07-14 16:21:53 +09:00 |
|
dtlk.c
|
|
|
|
efirtc.c
|
|
|
|
generic_nvram.c
|
|
|
|
hangcheck-timer.c
|
|
|
|
hpet.c
|
hpet: Fix division by zero in hpet_time_div()
|
2019-08-04 09:33:43 +02:00 |
|
Kconfig
|
tty: mark Siemens R3964 line discipline as BROKEN
|
2019-04-17 08:36:44 +02:00 |
|
lp.c
|
char: lp: fix possible integer overflow in lp_setup()
|
2017-05-25 15:44:30 +02:00 |
|
Makefile
|
RTC for 4.8
|
2016-08-05 09:48:22 -04:00 |
|
mbcs.c
|
|
|
|
mbcs.h
|
|
|
|
mem.c
|
drivers: char: mem: Fix wraparound check to allow mappings up to the end
|
2017-06-14 15:06:04 +02:00 |
|
misc.c
|
|
|
|
mmtimer.c
|
|
|
|
mspec.c
|
|
|
|
nsc_gpio.c
|
|
|
|
nvram.c
|
|
|
|
nwbutton.c
|
|
|
|
nwbutton.h
|
|
|
|
nwflash.c
|
|
|
|
pc8736x_gpio.c
|
|
|
|
powernv-op-panel.c
|
powerpc/powernv: Add driver for operator panel on FSP machines
|
2016-06-29 17:33:46 +10:00 |
|
ppdev.c
|
ppdev: fix registering same device name
|
2017-04-12 12:41:10 +02:00 |
|
ps3flash.c
|
|
|
|
random.c
|
random: mix rdrand with entropy sent in from userspace
|
2018-08-03 07:55:26 +02:00 |
|
raw.c
|
|
|
|
rtc.c
|
|
|
|
scx200_gpio.c
|
|
|
|
snsc.c
|
snsc: check return value of class_create
|
2016-08-31 14:47:54 +02:00 |
|
snsc.h
|
|
|
|
snsc_event.c
|
|
|
|
sonypi.c
|
fs: Replace current_fs_time() with current_time()
|
2016-09-27 21:06:22 -04:00 |
|
tb0219.c
|
mips: separate extable.h, switch module.h to it
|
2016-10-05 18:36:18 -04:00 |
|
tile-srom.c
|
tile-srom: avoid krealloc(... __GFP_ZERO) pattern
|
2016-08-30 14:45:50 +02:00 |
|
tlclk.c
|
|
|
|
toshiba.c
|
|
|
|
ttyprintk.c
|
ttyprintk: Neaten and simplify printing
|
2016-09-13 17:30:17 +02:00 |
|
uv_mmtimer.c
|
|
|
|
virtio_console.c
|
virtio_console: initialize vtermno value for ports
|
2019-05-31 06:48:29 -07:00 |