Variable var->pixclock can be set by user. In case it equals to zero, divide by zero would occur in tdfxfb_check_var. Similar crashes have happened in other fbdev drivers. We fix this by checking whether 'pixclock' is zero.
Signed-off-by: Alex Guo <alexguo1...@gmail.com> --- drivers/video/fbdev/tdfxfb.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/fbdev/tdfxfb.c b/drivers/video/fbdev/tdfxfb.c index 51ebe78359ec..2100857fa7b3 100644 --- a/drivers/video/fbdev/tdfxfb.c +++ b/drivers/video/fbdev/tdfxfb.c @@ -495,6 +495,9 @@ static int tdfxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) return -EINVAL; } } + + if (var->pixclock <= KHZ2PICOS(par->max_pixclock)) + var->pixclock = KHZ2PICOS(par->max_pixclock) + 1; if (PICOS2KHZ(var->pixclock) > par->max_pixclock) { DPRINTK("pixclock too high (%ldKHz)\n", -- 2.34.1