2023-10-14 12:15:58

by Zhang Shurong

Subject: [PATCH] fbdev: fbmon: fix potential divide error in fb_validate_mode

We can easily use FBIOPUT_VSCREENINFO set fb_var_screeninfo, so
it's possible for a divide by zero error to occur.

Fix this by making sure the divisor is non-zero before the computation.

Signed-off-by: Zhang Shurong <[email protected]>
---
drivers/video/fbdev/core/fbmon.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
index 79e5bfbdd34c..bdd15b8e3a71 100644
--- a/drivers/video/fbdev/core/fbmon.c
+++ b/drivers/video/fbdev/core/fbmon.c
@@ -1470,6 +1470,9 @@ int fb_validate_mode(const struct fb_var_screeninfo *var, struct fb_info *info)
if (var->vmode & FB_VMODE_DOUBLE)
vtotal *= 2;

+ if (!htotal || !vtotal)
+ return -EINVAL;
+
hfreq = pixclock/htotal;
hfreq = (hfreq + 500) / 1000 * 1000;

--
2.30.2

2023-10-16 21:16:04

by Helge Deller

Subject: Re: [PATCH] fbdev: fbmon: fix potential divide error in fb_validate_mode

On 10/14/23 14:14, Zhang Shurong wrote:
> We can easily use FBIOPUT_VSCREENINFO set fb_var_screeninfo, so
> it's possible for a divide by zero error to occur.
>
> Fix this by making sure the divisor is non-zero before the computation.
>
> Signed-off-by: Zhang Shurong <[email protected]>
> ---
> drivers/video/fbdev/core/fbmon.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/video/fbdev/core/fbmon.c b/drivers/video/fbdev/core/fbmon.c
> index 79e5bfbdd34c..bdd15b8e3a71 100644
> --- a/drivers/video/fbdev/core/fbmon.c
> +++ b/drivers/video/fbdev/core/fbmon.c
> @@ -1470,6 +1470,9 @@ int fb_validate_mode(const struct fb_var_screeninfo *var, struct fb_info *info)
> if (var->vmode & FB_VMODE_DOUBLE)
> vtotal *= 2;
>
> + if (!htotal || !vtotal)
> + return -EINVAL;

This is above here:
htotal = var->xres + var->right_margin + var->hsync_len +
var->left_margin;
vtotal = var->yres + var->lower_margin + var->vsync_len +
var->upper_margin;

I don't see how htotal and vtotal can become zero...

Helge