From: Devyn Liu liudingyuan@huawei.com

mainline inclusion from mainline-v6.11-rc3 commit 5127c42c77de18651aa9e8e0a3ced190103b449c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAVU80 CVE: CVE-2024-47664

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

If the value of max_speed_hz is 0, it may cause a division by zero error in hisi_calc_effective_speed(). The value of max_speed_hz is provided by firmware. Firmware is generally considered as a trusted domain. However, as division by zero errors can cause system failure, for defense measure, the value of max_speed is validated here. So 0 is regarded as invalid and an error code is returned.

Signed-off-by: Devyn Liu liudingyuan@huawei.com Reviewed-by: Jay Fang f.fangjian@huawei.com Link: https://patch.msgid.link/20240730032040.3156393-3-liudingyuan@huawei.com Signed-off-by: Mark Brown broonie@kernel.org Conflicts: drivers/spi/spi-hisi-kunpeng.c [The author changed the variable naming, replacing all instances of "master" with "host", which aligns with modern naming conventions.] Signed-off-by: Yongjian Sun sunyongjian1@huawei.com --- drivers/spi/spi-hisi-kunpeng.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/drivers/spi/spi-hisi-kunpeng.c b/drivers/spi/spi-hisi-kunpeng.c index 525cc0143a30..54e05fb0387e 100644 --- a/drivers/spi/spi-hisi-kunpeng.c +++ b/drivers/spi/spi-hisi-kunpeng.c @@ -483,6 +483,9 @@ static int hisi_spi_probe(struct platform_device *pdev) return -EINVAL; }

+ if (master->max_speed_hz == 0) + return dev_err_probe(dev, -EINVAL, "spi-max-frequency can't be 0\n"); + ret = device_property_read_u16(dev, "num-cs", &master->num_chipselect); if (ret)