CVE-2022-49978

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fb_pm2fb: Avoid potential divide by zero error

In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be

copied from user, then go through `fb_set_var()` and

`info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`.

Along the path, `var->pixclock` won't be modified. This function checks

whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is

zero, there will be a divide by zero error. So, it is necessary to check

whether denominator is zero to avoid crash. As this bug is found by

Syzkaller, logs are listed below.

divide error in pm2fb_check_var

Call Trace:

<TASK>

fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015

do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110

fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References