Skip to contentSkip to conversation

FAILED: patch "[PATCH] stm class: Prevent division by zero" failed to apply to 4.19-stable tree

PATCH [email protected] 1 participant 1 message Mar 19, 2019

Subsystems (4)
Stable branch Arm STM32 Hardware tracing facilities System trace module class
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From bf7cbaae0831252b416f375ca9b1027ecd4642dd Mon Sep 17 00:00:00 2001
From: Alexander Shishkin <[email protected]>
Date: Thu, 21 Feb 2019 14:19:17 +0200
Subject: [PATCH] stm class: Prevent division by zero

Using STP_POLICY_ID_SET ioctl command with dummy_stm device, or any STM device that supplies zero mmio channel size, will trigger a division by zero bug in the kernel.

Prevent this by disallowing channel widths other than 1 for such devices.

Signed-off-by Alexander Shishkin <[email protected]>
Fixes 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
CC [email protected] # v4.4+
drivers/hwtracing/stm/core.c +5 -3
index c80b064224f6..c7ba8acfd4d5 100644
@@ -735,7 +735,7 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
 	struct stm_device *stm = stmf->stm;
 	struct stp_policy_id *id;
 	char *ids[] = { NULL, NULL };
-	int ret = -EINVAL;
+	int ret = -EINVAL, wlimit = 1;
 	u32 size;
 
 	if (stmf->output.nr_chans)

@@ -763,8 +763,10 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
 	if (id->__reserved_0 || id->__reserved_1)
 		goto err_free;
 
-	if (id->width < 1 ||
-	    id->width > PAGE_SIZE / stm->data->sw_mmiosz)
+	if (stm->data->sw_mmiosz)
+		wlimit = PAGE_SIZE / stm->data->sw_mmiosz;
+
+	if (id->width < 1 || id->width > wlimit)
 		goto err_free;
 
 	ids[0] = id->id;