Subject: kern/37607: it(4) blindly trusts hardware to provide non-zero denominator
To: None <kern-bug-people@netbsd.org, gnats-admin@netbsd.org,>
From: None <jakllsch@kollasch.net>
List: netbsd-bugs
Date: 12/24/2007 19:35:01
>Number: 37607
>Category: kern
>Synopsis: it(4) can divide by zero
>Confidential: no
>Severity: critical
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Mon Dec 24 19:35:00 +0000 2007
>Originator: jakllsch@kollasch.net
>Release: NetBSD 4.0
>Organization:
>Environment:
System: NetBSD omega.kollasch.net 4.0 NetBSD 4.0 (OMEGA_III) #5: Mon Dec 24 19:16:09 UTC 2007 root@omega.kollasch.net:/usr/src/sys/arch/amd64/compile/OMEGA_III amd64
Architecture: x86_64
Machine: amd64
>Description:
A value obtained from the hardware is used as a denominator
without being checked for 0.
>How-To-Repeat:
Run envstat on a box w/ a IT8712F and a disconnected
fan.
>Fix:
Index: it.c
===================================================================
RCS file: /cvsroot/src/sys/dev/isa/Attic/it.c,v
retrieving revision 1.6.2.2
diff -u -r1.6.2.2 it.c
--- it.c 12 May 2007 17:32:22 -0000 1.6.2.2
+++ it.c 24 Dec 2007 19:25:11 -0000
@@ -329,8 +329,11 @@
} else {
if (i == 2)
divisor = divisor & 1 ? 3 : 1;
- sc->sc_data[tred->sensor].cur.data_us =
- 1350000 / (sdata << (divisor & 7));
+ if(sdata != 0)
+ sc->sc_data[tred->sensor].cur.data_us =
+ 1350000 / (sdata << (divisor & 7));
+ else
+ sc->sc_data[tred->sensor].cur.data_us = 0;
}
DPRINTF(("sdata[fan%d] 0x%x div: 0x%x\n", i, sdata, divisor));