lkml.org 
[lkml]   [2017]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: drivers/net/hamradio: divide error in hdlcdrv_ioctl
On Tue, 16 May 2017 17:05:32 +0200
Andrey Konovalov <andreyknvl@google.com> wrote:

> Hi,
>
> I've got the following error report while fuzzing the kernel with syzkaller.
>
> On commit 2ea659a9ef488125eb46da6eb571de5eae5c43f6 (4.12-rc1).
>
> A reproducer and .config are attached.

This should fix it.

commit 37b3fa4b617681f00cfa1f76d6d7716cc6d9f79a
Author: Alan Cox <alan@llwyncelyn.cymru>
Date: Wed May 17 21:04:27 2017 +0100

hdlcdrv: Fix division by zero when bitrate is unset

The code attempts to check for out of range calibration. What it forgets to do
is check for the 0 bitrate case. As a result the range check itself oopses the
kernel.

Found by Andrey Konovalov using Syzkaller.

Signed-off-by: Alan Cox <alan@linux.intel.com>

diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c..9f34a48 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,7 +576,7 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
case HDLCDRVCTL_CALIBRATE:
if(!capable(CAP_SYS_RAWIO))
return -EPERM;
- if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+ if (!s->par.bitrate || bi.data.calibrate > INT_MAX / s->par.bitrate)
return -EINVAL;
s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
return 0;
\
 
 \ /
  Last update: 2017-05-17 22:09    [W:0.052 / U:1.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site