Kefeng Wang
0cbed4f1c6
hpet: Fix division by zero in hpet_time_div()
commit 0c7d37f4d9 upstream.
The base value in do_div() called by hpet_time_div() is truncated from
unsigned long to uint32_t, resulting in a divide-by-zero exception.
UBSAN: Undefined behaviour in ../drivers/char/hpet.c:572:2
division by zero
CPU: 1 PID: 23682 Comm: syz-executor.3 Not tainted 4.4.184.x86_64+ #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
0000000000000000 b573382df1853d00 ffff8800a3287b98 ffffffff81ad7561
ffff8800a3287c00 ffffffff838b35b0 ffffffff838b3860 ffff8800a3287c20
0000000000000000 ffff8800a3287bb0 ffffffff81b8f25e ffffffff838b35a0
Call Trace:
[<ffffffff81ad7561>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81ad7561>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<ffffffff81b8f25e>] ubsan_epilogue+0x12/0x8d lib/ubsan.c:166
[<ffffffff81b900cb>] __ubsan_handle_divrem_overflow+0x282/0x2c8 lib/ubsan.c:262
[<ffffffff823560dd>] hpet_time_div drivers/char/hpet.c:572 [inline]
[<ffffffff823560dd>] hpet_ioctl_common drivers/char/hpet.c:663 [inline]
[<ffffffff823560dd>] hpet_ioctl_common.cold+0xa8/0xad drivers/char/hpet.c:577
[<ffffffff81e63d56>] hpet_ioctl+0xc6/0x180 drivers/char/hpet.c:676
[<ffffffff81711590>] vfs_ioctl fs/ioctl.c:43 [inline]
[<ffffffff81711590>] file_ioctl fs/ioctl.c:470 [inline]
[<ffffffff81711590>] do_vfs_ioctl+0x6e0/0xf70 fs/ioctl.c:605
[<ffffffff81711eb4>] SYSC_ioctl fs/ioctl.c:622 [inline]
[<ffffffff81711eb4>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:613
[<ffffffff82846003>] tracesys_phase2+0x90/0x95
The main C reproducer autogenerated by syzkaller,
syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
memcpy((void*)0x20000100, "/dev/hpet\000", 10);
syscall(__NR_openat, 0xffffffffffffff9c, 0x20000100, 0, 0);
syscall(__NR_ioctl, r[0], 0x40086806, 0x40000000000000);
Fix it by using div64_ul().
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Zhang HongJun <zhanghongjun2@huawei.com>
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20190711132757.130092-1-wangkefeng.wang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-08-04 09:33:43 +02:00
..
2019-05-14 19:19:34 +02:00
2018-05-01 15:13:08 -07:00
2019-06-11 12:22:44 +02:00
2019-08-04 09:33:22 +02:00
2019-02-27 10:06:59 +01:00
2018-02-13 12:35:55 +01:00
2019-08-04 09:33:19 +02:00
2017-03-12 06:41:52 +01:00
2019-08-04 09:33:29 +02:00
2019-08-04 09:33:24 +02:00
2018-12-05 19:42:41 +01:00
2019-04-05 22:29:12 +02:00
2019-08-04 09:33:43 +02:00
2019-07-10 09:55:44 +02:00
2019-08-04 09:33:22 +02:00
2019-05-31 06:48:27 -07:00
2019-02-12 19:44:55 +01:00
2019-08-04 09:33:30 +02:00
2018-02-28 10:18:33 +01:00
2018-04-13 19:48:09 +02:00
2019-08-04 09:33:14 +02:00
2018-06-06 16:44:33 +02:00
2019-08-04 09:33:23 +02:00
2019-05-31 06:48:26 -07:00
2018-05-30 07:50:18 +02:00
2019-06-11 12:22:45 +02:00
2019-08-04 09:33:24 +02:00
2019-08-04 09:33:38 +02:00
2019-05-31 06:48:29 -07:00
2018-03-24 11:00:12 +01:00
2018-12-29 13:40:15 +01:00
2019-07-10 09:55:32 +02:00
2019-08-04 09:33:31 +02:00
2019-06-22 08:17:23 +02:00
2018-12-21 14:11:37 +01:00
2019-05-14 19:19:34 +02:00
2019-05-31 06:48:27 -07:00
2019-08-04 09:33:40 +02:00
2019-08-04 09:33:26 +02:00
2019-06-22 08:17:14 +02:00
2016-10-27 18:43:43 -07:00
2019-06-11 12:22:48 +02:00
2019-06-22 08:17:22 +02:00
2019-05-04 08:49:10 +02:00
2016-10-07 14:42:05 -07:00
2018-10-20 09:51:32 +02:00
2019-08-04 09:33:41 +02:00
2017-09-09 17:39:41 +02:00
2019-08-04 09:33:32 +02:00
2019-08-04 09:33:27 +02:00
2019-05-25 18:26:49 +02:00
2019-08-04 09:33:37 +02:00
2018-05-25 16:13:06 +02:00
2019-08-04 09:33:39 +02:00
2019-07-21 09:06:03 +02:00
2019-05-31 06:48:25 -07:00
2019-02-15 08:07:37 +01:00
2019-08-04 09:33:35 +02:00
2019-05-16 19:43:43 +02:00
2018-05-30 07:50:22 +02:00
2019-08-04 09:33:29 +02:00
2019-07-10 09:55:32 +02:00
2019-06-22 08:17:15 +02:00
2018-12-01 09:44:21 +01:00
2016-10-10 20:16:43 -07:00
2019-06-11 12:22:47 +02:00
2019-07-10 09:55:29 +02:00
2019-08-04 09:33:38 +02:00
2018-11-13 11:16:46 -08:00
2018-03-22 09:17:51 +01:00
2019-08-04 09:33:37 +02:00
2019-08-04 09:33:36 +02:00
2019-06-22 08:17:16 +02:00
2019-05-25 18:26:56 +02:00
2019-05-14 19:19:34 +02:00
2016-10-11 15:06:32 -07:00
2019-02-12 19:44:52 +01:00
2019-06-22 08:17:17 +02:00
2019-06-22 08:17:11 +02:00
2019-08-04 09:33:26 +02:00
2017-03-12 06:41:50 +01:00
2018-12-08 13:05:08 +01:00
2018-11-13 11:17:03 -08:00
2019-06-22 08:17:21 +02:00
2019-08-04 09:33:18 +02:00
2018-12-21 14:11:36 +01:00
2019-08-04 09:33:25 +02:00
2019-06-22 08:17:15 +02:00
2019-07-10 09:55:43 +02:00
2017-07-27 15:08:08 -07:00
2019-05-31 06:48:12 -07:00
2019-08-04 09:33:17 +02:00
2019-03-23 13:19:47 +01:00
2018-11-13 11:17:02 -08:00
2019-06-22 08:17:13 +02:00
2018-04-24 09:34:12 +02:00
2019-08-04 09:33:40 +02:00
2018-11-27 16:09:41 +01:00
2019-08-04 09:33:42 +02:00
2018-10-03 17:01:42 -07:00
2019-05-08 07:19:10 +02:00
2019-08-04 09:33:20 +02:00
2019-06-22 08:17:17 +02:00
2019-05-16 19:43:47 +02:00
2019-04-17 08:36:47 +02:00
2017-03-12 06:41:50 +01:00
2019-05-31 06:48:15 -07:00
2019-06-22 08:17:14 +02:00
2019-08-04 09:33:25 +02:00
2018-05-30 07:50:44 +02:00
2018-02-25 11:05:45 +01:00