NACK/Cmnt: [SRU][Jammy][PATCH](upstream) video: fbdev: i740fb: Error out if 'pixclock' equals zero

[Stefan Bader]

On 14.10.22 00:11, John Cabaj wrote:
> From: Zheyu Ma <zheyuma97 at gmail.com>
> 
> CVE-2022-3061

This appears to be chaotic on the mailing list. Like 5 mails, 2 as a thread, the 
rest separate but all about the same issue.
Apart from that the use of "(upstream)" is not right. Not sure we still use it 
at all. It did mean something should go to upstream, not that it came from there.
Roughly glancing the patch applies across all series, so the submission should 
look like

* [SRU J/F/B v2][PATCH 0/1] Fix CVE-2022-3061 (fbdev pixclock)
   - [SRU J/F/B][PATCH 1/1] video: fbdev: i740fb: Error out if 'pixclock' equals
     zero

The subject of the cover email might vary. Personally I find it good to have a 
summary of the batch. But the primary point here is to have only one change to 
look at, download, and apply when accepted.

-Stefan

PS: I will NACK the other pieces as well but without comment.

> 
> The userspace program could pass any values to the driver through
> ioctl() interface. If the driver doesn't check the value of 'pixclock',
> it may cause divide error.
> 
> Fix this by checking whether 'pixclock' is zero in the function
> i740fb_check_var().
> 
> The following log reveals it:
> 
> divide error: 0000 [#1] PREEMPT SMP KASAN PTI
> RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:444 [inline]
> RIP: 0010:i740fb_set_par+0x272f/0x3bb0 drivers/video/fbdev/i740fb.c:739
> Call Trace:
>      fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1036
>      do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1112
>      fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1191
>      vfs_ioctl fs/ioctl.c:51 [inline]
>      __do_sys_ioctl fs/ioctl.c:874 [inline]
> 
> Signed-off-by: Zheyu Ma <zheyuma97 at gmail.com>
> Signed-off-by: Helge Deller <deller at gmx.de>
> (cherry picked from commit 15cf0b82271b1823fb02ab8c377badba614d95d5)
> Signed-off-by: John Cabaj <john.cabaj at canonical.com>
> ---
>   drivers/video/fbdev/i740fb.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c
> index ad5ced4ef972..8fb4e01e1943 100644
> --- a/drivers/video/fbdev/i740fb.c
> +++ b/drivers/video/fbdev/i740fb.c
> @@ -662,6 +662,9 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
>   
>   static int i740fb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
>   {
> +	if (!var->pixclock)
> +		return -EINVAL;
> +
>   	switch (var->bits_per_pixel) {
>   	case 8:
>   		var->red.offset	= var->green.offset = var->blue.offset = 0;

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20221014/9a48f5b5/attachment.sig>