github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-10 07:32:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
b9310c56fc
linux/drivers
History
Kefeng Wang 9845fb5a3f hpet: Fix division by zero in hpet_time_div() 
commit 0c7d37f4d9 upstream.

The base value in do_div() called by hpet_time_div() is truncated from
unsigned long to uint32_t, resulting in a divide-by-zero exception.

UBSAN: Undefined behaviour in ../drivers/char/hpet.c:572:2
division by zero
CPU: 1 PID: 23682 Comm: syz-executor.3 Not tainted 4.4.184.x86_64+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
 0000000000000000 b573382df1853d00 ffff8800a3287b98 ffffffff81ad7561
 ffff8800a3287c00 ffffffff838b35b0 ffffffff838b3860 ffff8800a3287c20
 0000000000000000 ffff8800a3287bb0 ffffffff81b8f25e ffffffff838b35a0
Call Trace:
 [<ffffffff81ad7561>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81ad7561>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81b8f25e>] ubsan_epilogue+0x12/0x8d lib/ubsan.c:166
 [<ffffffff81b900cb>] __ubsan_handle_divrem_overflow+0x282/0x2c8 lib/ubsan.c:262
 [<ffffffff823560dd>] hpet_time_div drivers/char/hpet.c:572 [inline]
 [<ffffffff823560dd>] hpet_ioctl_common drivers/char/hpet.c:663 [inline]
 [<ffffffff823560dd>] hpet_ioctl_common.cold+0xa8/0xad drivers/char/hpet.c:577
 [<ffffffff81e63d56>] hpet_ioctl+0xc6/0x180 drivers/char/hpet.c:676
 [<ffffffff81711590>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff81711590>] file_ioctl fs/ioctl.c:470 [inline]
 [<ffffffff81711590>] do_vfs_ioctl+0x6e0/0xf70 fs/ioctl.c:605
 [<ffffffff81711eb4>] SYSC_ioctl fs/ioctl.c:622 [inline]
 [<ffffffff81711eb4>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:613
 [<ffffffff82846003>] tracesys_phase2+0x90/0x95

The main C reproducer autogenerated by syzkaller,

  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
  memcpy((void*)0x20000100, "/dev/hpet\000", 10);
  syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 0, 0);
  syscall(__NR_ioctl, r[0], 0x40086806, 0x40000000000000);

Fix it by using div64_ul().

Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Zhang HongJun <zhanghongjun2@huawei.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190711132757.130092-1-wangkefeng.wang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-07-31 07:27:10 +02:00
..
accessibility
acpi ACPICA: Clear status of GPEs on first direct enable 2019-07-26 09:14:09 +02:00
amba
android binder: prevent transactions to context manager from its own process. 2019-07-31 07:27:10 +02:00
ata libata: don't request sense data on !ZAC ATA devices 2019-07-26 09:14:12 +02:00
atm atm: he: fix sign-extension overflow on large shift 2019-02-27 10:08:57 +01:00
auxdisplay auxdisplay: hd44780: Fix memory leak on ->remove() 2019-04-20 09:15:55 +02:00
base regmap: fix bulk writes on paged registers 2019-07-26 09:14:06 +02:00
bcma
block floppy: fix out-of-bounds read in copy_buffer 2019-07-26 09:14:18 +02:00
bluetooth Bluetooth: Add new 13d3:3501 QCA_ROME device 2019-07-26 09:14:16 +02:00
bus
cdrom cdrom: Fix race condition in cdrom_sysctl_register 2019-04-05 22:33:10 +02:00
char hpet: Fix division by zero in hpet_time_div() 2019-07-31 07:27:10 +02:00
clk clk: ti: clkctrl: Fix returning uninitialized data 2019-07-21 09:03:04 +02:00
clocksource clocksource/drivers/exynos_mct: Increase priority over ARM arch timer 2019-07-26 09:14:12 +02:00
connector connector: fix unsafe usage of ->real_parent 2019-03-19 13:12:38 +01:00
cpufreq cpufreq: kirkwood: fix possible object reference leak 2019-05-31 06:46:24 -07:00
cpuidle cpuidle: big.LITTLE: fix refcount leak 2019-02-12 19:47:08 +01:00
crypto crypto: caam - limit output IV to CBC to work around CTR mode DMA issue 2019-07-26 09:14:29 +02:00
dax mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses 2019-05-22 07:37:40 +02:00
dca
devfreq
dio
dma dmaengine: imx-sdma: fix use-after-free on probe error path 2019-07-26 09:13:56 +02:00
dma-buf dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc 2019-07-28 08:29:28 +02:00
edac EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec 2019-07-26 09:14:13 +02:00
eisa
extcon extcon: arizona: Disable mic detect if running when driver is removed 2019-05-31 06:46:23 -07:00
firewire
firmware efi/bgrt: Drop BGRT status field reserved bits check 2019-07-21 09:03:04 +02:00
fmc
fpga fpga-manager: altera-ps-spi: Fix build error 2019-07-31 07:27:10 +02:00
fsi
gnss gnss: sirf: fix premature wakeup interrupt enable 2019-03-10 07:17:21 +01:00
gpio gpio: davinci: silence error prints in case of EPROBE_DEFER 2019-07-28 08:29:28 +02:00
gpu drm/msm: Depopulate platform on probe failure 2019-07-31 07:27:01 +02:00
hid HID: wacom: correct touch resolution x/y typo 2019-07-26 09:14:27 +02:00
hsi
hv Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup() 2019-05-10 17:54:04 +02:00
hwmon hwmon: (pmbus/core) Treat parameters as paged if on multiple pages 2019-06-25 11:35:59 +08:00
hwspinlock
hwtracing intel_th: msu: Fix single mode with disabled IOMMU 2019-07-26 09:14:30 +02:00
i2c i2c: stm32f7: fix the get_irq error cases 2019-07-31 07:27:02 +02:00
ide
idle x86/cpu: Sanitize FAM6_ATOM naming 2019-05-14 19:17:53 +02:00
iio iio: adc: stm32-dfsdm: missing error case during probe 2019-07-31 07:26:56 +02:00
infiniband RDMA/rxe: Fill in wc byte_len with IB_WC_RECV_RDMA_WITH_IMM 2019-07-31 07:27:07 +02:00
input Input: alps - fix a mismatch between a condition check and its comment 2019-07-26 09:14:22 +02:00
iommu iommu: Fix a leak in iommu_insert_resv_region 2019-07-26 09:14:06 +02:00
ipack
irqchip irqchip/meson-gpio: Add support for Meson-G12A SoC 2019-07-26 09:14:06 +02:00
isdn mISDN: make sure device name is NUL terminated 2019-06-22 08:15:16 +02:00
leds leds: trigger: netdev: use memcpy in device_name_store 2019-05-04 09:20:22 +02:00
lightnvm lightnvm: pblk: fix freeing of merged pages 2019-07-26 09:14:09 +02:00
macintosh
mailbox mailbox: handle failed named mailbox channel request 2019-07-31 07:27:07 +02:00
mcb
md dm bufio: fix deadlock with loop device 2019-07-26 09:14:31 +02:00
media media: videobuf2-dma-sg: Prevent size from overflowing 2019-07-26 09:14:24 +02:00
memory memory: tegra: Fix integer overflow on tick value calculation 2019-05-25 18:23:32 +02:00
memstick memstick: Fix error cleanup path of memstick_init 2019-07-31 07:26:59 +02:00
message
mfd mfd: hi655x-pmic: Fix missing return value check for devm_regmap_init_mmio_clk 2019-07-31 07:27:03 +02:00
misc mei: me: add mule creek canyon (EHL) device ids 2019-07-31 07:27:10 +02:00
mmc mmc: sdhci: sdhci-pci-o2micro: Check if controller supports 8-bit width 2019-07-31 07:27:01 +02:00
mtd mtd: spinand: read returns badly if the last page has bitflips 2019-07-26 09:14:30 +02:00
mux
net cxgb4: reduce kernel stack usage in cudbg_collect_mem_region() 2019-07-31 07:27:09 +02:00
nfc spi: ST ST95HF NFC: declare missing of table 2019-05-16 19:41:25 +02:00
ntb
nubus
nvdimm libnvdimm/pfn: fix fsdax-mode namespace info-block zero-fields 2019-07-26 09:14:27 +02:00
nvme nvme-pci: set the errno on ctrl state change error 2019-07-26 09:14:09 +02:00
nvmem nvmem: sunxi_sid: Support SID on A83T and H5 2019-06-15 11:54:07 +02:00
of of: overlay: set node fields from properties when add new overlay node 2019-06-09 09:17:24 +02:00
opp OPP: Use opp_table->regulators to verify no regulator case 2019-02-12 19:47:08 +01:00
oprofile
parisc parisc: Use implicit space register selection for loading the coherence index of I/O pdirs 2019-06-11 12:20:51 +02:00
parport parport: Fix mem leak in parport_register_dev_model 2019-06-25 11:35:55 +08:00
pci PCI: dwc: pci-dra7xx: Fix compilation when !CONFIG_GPIOLIB 2019-07-31 07:27:07 +02:00
pcmcia
perf perf/arm-cci: Remove broken race mitigation 2019-05-31 06:46:17 -07:00
phy phy: renesas: rcar-gen2: Fix memory leak at error paths 2019-07-31 07:27:00 +02:00
pinctrl pinctrl: rockchip: fix leaked of_node references 2019-07-31 07:26:57 +02:00
platform platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove flow 2019-07-10 09:53:38 +02:00
pnp
power power: supply: max14656: fix potential use-before-alloc 2019-06-15 11:54:09 +02:00
powercap x86/cpu: Sanitize FAM6_ATOM naming 2019-05-14 19:17:53 +02:00
pps
ps3
ptp ptp: Fix pass zero to ERR_PTR() in ptp_clock_register 2019-02-12 19:47:01 +01:00
pwm pwm: Fix deadlock warning when removing PWM device 2019-06-15 11:54:10 +02:00
rapidio rapidio: fix a NULL pointer dereference when create_workqueue() fails 2019-06-15 11:53:59 +02:00
ras RAS/CEC: Fix pfn insertion 2019-07-26 09:14:05 +02:00
regulator regulator: s2mps11: Fix buck7 and buck8 wrong voltages 2019-07-26 09:14:22 +02:00
remoteproc
reset reset: meson-audio-arb: Fix missing .owner setting of reset_controller_dev 2019-05-08 07:21:47 +02:00
rpmsg
rtc rtc: pcf8523: don't return invalid date when battery is low 2019-06-19 08:18:07 +02:00
s390 s390/qdio: handle PENDING state for QEBSM devices 2019-07-26 09:14:04 +02:00
sbus
scsi scsi: mac_scsi: Fix pseudo DMA implementation, take 2 2019-07-26 09:14:19 +02:00
sfi
sh
siox
slimbus slimbus: fix a potential NULL pointer dereference in of_qcom_slim_ngd_register 2019-05-31 06:46:14 -07:00
sn
soc soc: bcm: brcmstb: biuctrl: Register writes require a barrier 2019-07-14 08:11:03 +02:00
soundwire soundwire: intel: set dai min and max channels correctly 2019-07-14 08:11:07 +02:00
spi spi: bitbang: Fix NULL pointer dereference in spi_unregister_master 2019-07-10 09:53:32 +02:00
spmi
ssb ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit 2019-05-31 06:46:04 -07:00
staging staging: vt6656: use meaningful error code during buffer allocation 2019-07-31 07:26:57 +02:00
target scsi: iscsi: set auth_protocol back to NULL if CHAP_A value is not supported 2019-07-26 09:13:56 +02:00
tc
tee tee: optee: avoid possible double list_del() 2019-02-12 19:47:08 +01:00
thermal drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER 2019-06-15 11:54:02 +02:00
thunderbolt thunderbolt: property: Fix a NULL pointer dereference 2019-05-31 06:46:31 -07:00
tty serial: sh-sci: Fix TX DMA buffer flushing and workqueue races 2019-07-31 07:27:04 +02:00
uio
usb usb: pci-quirks: Correct AMD PLL quirk detection 2019-07-31 07:27:10 +02:00
uwb
vfio vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING" 2019-06-15 11:54:07 +02:00
vhost vhost_net: disable zerocopy by default 2019-07-26 09:14:08 +02:00
video video: imsttfb: fix potential NULL pointer dereferences 2019-06-15 11:54:10 +02:00
virt drivers/virt/fsl_hypervisor.c: prevent integer overflow in ioctl 2019-05-16 19:41:31 +02:00
virtio virtio_pci: fix a NULL pointer reference in vp_del_vqs 2019-05-10 17:54:08 +02:00
visorbus
vlynq
vme
w1 w1: fix the resume command API 2019-05-31 06:46:14 -07:00
watchdog watchdog: fix compile time error of pretimeout governors 2019-06-15 11:54:06 +02:00
xen xen/events: fix binding user event channels to cpus 2019-07-26 09:14:25 +02:00
zorro
Kconfig
Makefile