linux-kernel - Re: [PATCH] hpet: Fix division by zero in hpet_time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK8P3a3M3cNZm4meO+_vPkJcjtq7Fu5SrnJ11FAkOtGW3WBvNw@mail.gmail.com>
Date:   Thu, 11 Jul 2019 14:32:31 +0200
From:   Arnd Bergmann <arnd@...db.de>
To:     Kefeng Wang <wangkefeng.wang@...wei.com>
Cc:     Clemens Ladisch <clemens@...isch.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] hpet: Fix division by zero in hpet_time_div()

On Thu, Jul 11, 2019 at 1:20 PM Kefeng Wang <wangkefeng.wang@...wei.com> wrote:
> The base value in do_div() called by hpet_time_div() is truncated from
> unsigned long to uint32_t, resulting in a divide-by-zero exception.

Good catch!

> --- a/drivers/char/hpet.c
> +++ b/drivers/char/hpet.c
> @@ -567,7 +567,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
>         unsigned long long m;
>
>         m = hpets->hp_tick_freq + (dis >> 1);
> -       do_div(m, dis);
> +       div64_ul(m, dis);
>         return (unsigned long)m;
>  }

This still looks wrong to me: div64_ul() unlike do_div() does not
modify its argument, so you have to assign the output like

       return div64_ul(m, dis);

       Arnd