The code attempts to check for out of range calibration. What it forgets to do
is check for the 0 bitrate case. As a result the range check itself oopses the
kernel.

Found by Andrey Konovalov using Syzkaller.

Signed-off-by: Alan Cox <a...@linux.intel.com>
---
 drivers/net/hamradio/hdlcdrv.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 8c3633c..9f34a48 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -576,7 +576,7 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct 
ifreq *ifr, int cmd)
        case HDLCDRVCTL_CALIBRATE:
                if(!capable(CAP_SYS_RAWIO))
                        return -EPERM;
-               if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+               if (!s->par.bitrate || bi.data.calibrate > INT_MAX / 
s->par.bitrate)
                        return -EINVAL;
                s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
                return 0;

Reply via email to