linux-kernel - [PATCH] comedi: adl_pci9111: Fix possible division by zero in pci9111_ai_do_cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240918104304.15772-1-amishin@t-argos.ru>
Date: Wed, 18 Sep 2024 13:43:04 +0300
From: Aleksandr Mishin <amishin@...rgos.ru>
To: H Hartley Sweeten <hsweeten@...ionengravers.com>
CC: Aleksandr Mishin <amishin@...rgos.ru>, Ian Abbott <abbotti@....co.uk>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>
Subject: [PATCH] comedi: adl_pci9111: Fix possible division by zero in pci9111_ai_do_cmd_test()

Division by zero is possible in pci9111_ai_do_cmd_test() in case of scan
begin trigger source is TRIG_TIMER and either 'chanlist_len' or
'convert_arg' is zero.

Add zero value check to prevent division by zero.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: f1c51faabc4d ("staging: comedi: adl_pci9111: tidy up (*do_cmdtest) Step 4")
Signed-off-by: Aleksandr Mishin <amishin@...rgos.ru>
---
 drivers/comedi/drivers/adl_pci9111.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/comedi/drivers/adl_pci9111.c b/drivers/comedi/drivers/adl_pci9111.c
index 086d93f40cb9..ec1fb570b98c 100644
--- a/drivers/comedi/drivers/adl_pci9111.c
+++ b/drivers/comedi/drivers/adl_pci9111.c
@@ -312,6 +312,8 @@ static int pci9111_ai_do_cmd_test(struct comedi_device *dev,
 	 */
 	if (cmd->scan_begin_src == TRIG_TIMER) {
 		arg = cmd->chanlist_len * cmd->convert_arg;
+		if (!arg)
+			return 4;
 
 		if (arg < cmd->scan_begin_arg)
 			arg *= (cmd->scan_begin_arg / arg);
-- 
2.30.2