[lvc-project] [PATCH] drm/nouveau: handle division by zero and overflow in nouveau_bo_fixup_align()

[Alexandr Sapozhnikov]

The expression 64 * nvbo->mode can evaluate to 0 when 
nvbo->mode = U32_MAX/64, which results in division by zero 
in the do_div() function. A value greater than U32_MAX/64 
causes a u32 overflow, and the division result may be 
incorrect. The nvbo->mode value depends on the data 
passed from the user via ioctl. Generally, the kernel 
should distrust userspace data (an attacker could operate 
from there, and there's no guarantee that mesa and similar 
software are bug-free) and validate it to avoid crashing.

Found by Linux Verification Center (linuxtesting.org) with svace.

Fixes: a0af9add499c ("drm/nouveau: Make the MM aware of pre-G80 tiling.")

Signed-off-by: Alexandr Sapozhnikov <alsp705 at gmail.com>
---
 drivers/gpu/drm/nouveau/nouveau_bo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 7daa12eec01b..afe4e73b6190 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -168,7 +168,7 @@ nouveau_bo_fixup_align(struct nouveau_bo *nvbo, int *align, u64 *size)
 	struct nvif_device *device = &drm->client.device;
 
 	if (device->info.family < NV_DEVICE_INFO_V0_TESLA) {
-		if (nvbo->mode) {
+		if (nvbo->mode && nvbo->mode < U32_MAX / 64) {
 			if (device->info.chipset >= 0x40) {
 				*align = 65536;
 				*size = roundup_64(*size, 64 * nvbo->mode);
-- 
2.43.0