From dcfd43d78942326e00f09c887e3438a922a5e736 Mon Sep 17 00:00:00 2001 From: Zicheng Qu Date: Mon, 6 Jan 2025 03:13:21 +0000 Subject: [PATCH] ad7780: fix division by zero in ad7780_write_raw() stable inclusion from stable-v6.6.64 commit 7e3a8ea3d1ada7f707de5d9d504774b4191eab66 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMC CVE: CVE-2024-56567 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7e3a8ea3d1ada7f707de5d9d504774b4191eab66 -------------------------------- commit c174b53e95adf2eece2afc56cd9798374919f99a upstream. In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is based on iio_info's write_raw. While val is explicitly declared that can be zero (in read mode), val2 is not specified to be non-zero. Fixes: 9085daa4abcc ("staging: iio: ad7780: add gain & filter gpio support") Cc: stable@vger.kernel.org Signed-off-by: Zicheng Qu Link: https://patch.msgid.link/20241028142027.1032332-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Signed-off-by: ZhangPeng Signed-off-by: Liao Chen --- drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/ad7780.c b/drivers/iio/adc/ad7780.c index a813fe04787c..97b6774e7f58 100644 --- a/drivers/iio/adc/ad7780.c +++ b/drivers/iio/adc/ad7780.c @@ -152,7 +152,7 @@ static int ad7780_write_raw(struct iio_dev *indio_dev, switch (m) { case IIO_CHAN_INFO_SCALE: - if (val != 0) + if (val != 0 || val2 == 0) return -EINVAL; vref = st->int_vref_mv * 1000000LL; -- Gitee