From 3b6b144c24feb7115f1437f8a34b101a32e7551d Mon Sep 17 00:00:00 2001 From: Zicheng Qu Date: Tue, 7 Jan 2025 11:33:59 +0000 Subject: [PATCH] ad7780: fix division by zero in ad7780_write_raw() stable inclusion from stable-v5.10.231 commit afc1e3c00b3f5f0b4f1bc3e974fb9803cb938a90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMC CVE: CVE-2024-56567 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=afc1e3c00b3f5f0b4f1bc3e974fb9803cb938a90 -------------------------------- commit c174b53e95adf2eece2afc56cd9798374919f99a upstream. In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is based on iio_info's write_raw. While val is explicitly declared that can be zero (in read mode), val2 is not specified to be non-zero. Fixes: 9085daa4abcc ("staging: iio: ad7780: add gain & filter gpio support") Cc: stable@vger.kernel.org Signed-off-by: Zicheng Qu Link: https://patch.msgid.link/20241028142027.1032332-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Signed-off-by: Liao Chen --- drivers/iio/adc/ad7780.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/ad7780.c b/drivers/iio/adc/ad7780.c index c70048bc791b..81afd46e05d7 100644 --- a/drivers/iio/adc/ad7780.c +++ b/drivers/iio/adc/ad7780.c @@ -152,7 +152,7 @@ static int ad7780_write_raw(struct iio_dev *indio_dev, switch (m) { case IIO_CHAN_INFO_SCALE: - if (val != 0) + if (val != 0 || val2 == 0) return -EINVAL; vref = st->int_vref_mv * 1000000LL; -- Gitee