[PATCH] char: hpet: prevent hard-IRQ divide-by-zero in hpet_interrupt() via HPET_IRQFREQ

[Hui Peng]

In hpet_ioctl_common(), HPET_IRQFREQ sets:

        devp->hd_ireqfreq = hpet_time_div(hpetp, arg);

where hpet_time_div() computes (hpetp->hp_tick_freq + (arg >> 1)) / arg.
Whenever arg > 2 * hpetp->hp_tick_freq, integer division yields 0 and
sets devp->hd_ireqfreq = 0. In addition, HPET_IRQFREQ allows updating
devp->hd_ireqfreq while timer interrupts (HPET_IE) are already enabled.

When the armed HPET timer interrupt fires, hpet_interrupt() executes:

        base = mc % devp->hd_ireqfreq;

in hard-IRQ context with devp->hd_ireqfreq == 0, triggering an immediate
divide error (#DE) kernel Oops.

Reject HPET_IRQFREQ with -EBUSY when HPET_IE is already enabled, and
reject arg values where hpet_time_div(hpetp, arg) == 0 with -EINVAL.

Fixes: ba3f213f8a31 ("[PATCH] HPET: make frequency calculations 32 bit safe")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -625,13 +625,18 @@ hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
 		devp->hd_flags &= ~HPET_PERIODIC;
 		break;
 	case HPET_IRQFREQ:
+		if (devp->hd_flags & HPET_IE) {
+			err = -EBUSY;
+			break;
+		}
+
 		if ((arg > hpet_max_freq) &&
 		    !capable(CAP_SYS_RESOURCE)) {
 			err = -EACCES;
 			break;
 		}
 
-		if (!arg) {
+		if (!arg || !hpet_time_div(hpetp, arg)) {
 			err = -EINVAL;
 			break;
 		}
-- 
2.43.0