The expression 64 * nvbo->mode can evaluate to 0 when
nvbo->mode = U32_MAX/64, which results in division by zero
in the do_div() function. A value greater than U32_MAX/64
causes a u32 overflow, and the division result may be
incorrect. The nvbo->mode value depends on the data
passed from the user via ioctl. Generally, the kernel
should distrust userspace data (an attacker could operate
from there, and there's no guarantee that mesa and similar
software are bug-free) and validate it to avoid crashing.
Found by Linux Verification Center (linuxtesting.org) with svace.
Fixes: a0af9add499c ("drm/nouveau: Make the MM aware of pre-G80 tiling.")
Signed-off-by: Alexandr Sapozhnikov <[email protected]>
---
drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c
b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 7daa12eec01b..afe4e73b6190 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -168,7 +168,7 @@ nouveau_bo_fixup_align(struct nouveau_bo *nvbo, int *align,
u64 *size)
struct nvif_device *device = &drm->client.device;
if (device->info.family < NV_DEVICE_INFO_V0_TESLA) {
- if (nvbo->mode) {
+ if (nvbo->mode && nvbo->mode < U32_MAX / 64) {
if (device->info.chipset >= 0x40) {
*align = 65536;
*size = roundup_64(*size, 64 * nvbo->mode);
--
2.43.0
