Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <4cf6a155-85b7-649b-066d-e56da87dc8fd@oracle.com>
Date:   Tue, 26 Oct 2021 21:12:57 -0400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.2.1
Subject: Re: [PATCH] video: fbdev: cirrusfb: check pixclock to avoid divide by
 zero
Content-Language: en-US
To:     Geert Uytterhoeven <geert@linux-m68k.org>
Cc:     Greg KH <gregkh@linuxfoundation.org>,
        Thomas Zimmermann <tzimmermann@suse.de>,
        Sam Ravnborg <sam@ravnborg.org>,
        DRI Development <dri-devel@lists.freedesktop.org>,
        Linux Fbdev development list <linux-fbdev@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
References: <1635188490-15082-1-git-send-email-george.kennedy@oracle.com>
 <YXcAbXJfg/jKCo5h@kroah.com>
 <0ddb1c19-64b0-4117-7a92-c3d2fcddfdcf@oracle.com>
 <CAMuHMdWcU7wy1dxa_MXuHoUTWebvq6ShP820Bn_v+8tx7-TEdg@mail.gmail.com>
 <c73402dd-ec3f-4df7-6a16-36fb276a50f4@oracle.com>
 <CAMuHMdVHt=9N274SG+B7W83JbVVnbz_U5Nkejs_PR2HqvZvJgQ@mail.gmail.com>
 <d2119d59-89e4-34aa-86df-38fee2a0c6ef@oracle.com>
 <CAMuHMdUZq00r7QYeAKGm36UKpGwH_uEGMvwHBzRi9_nxV-dRhg@mail.gmail.com>
From:   George Kennedy <george.kennedy@oracle.com>
Organization: Oracle Corporation
In-Reply-To: <CAMuHMdUZq00r7QYeAKGm36UKpGwH_uEGMvwHBzRi9_nxV-dRhg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dUIyUytlMlR0Q1ZiZTJZa05mbk5JRUpJM0VTMnhuSmxhWlJaNFE4L0tJemw0?=
 =?utf-8?B?TVNidWg4eE5BNGpaQWlTTHZTQmxab1ZseGU4eHExZE9NdW1ZNEZhZFJETzUz?=
 =?utf-8?B?NUFwaEpCMGs0M29FVHRQaUJqNHJkd0hiUWs2YlJRbFZQamE1SjRzMVcxNkJW?=
 =?utf-8?B?a0xBNkM2TFBuTWF5M0hSWDVjT0dvNWR0aHREM0YzVVl6MTZBRDlkcFFFdThl?=
 =?utf-8?B?ZUNNZWlvOUtBblVtTFU2SnVOcG91ZWk4djNGMDMrNHFBa3lSN2hmcXlHUWxN?=
 =?utf-8?B?Rnh6TFBZZytMenV3Z0lIOUV6S2NFd2ZxS1VoYnVBMkRMWGsxd25LZGlSaWtQ?=
 =?utf-8?B?TWc0QlllckVuNWJFZUZpN0kvMDhabU0xNUE5bk5Ea1dkK3h3czVMT0lBWlZ1?=
 =?utf-8?B?TFRpT0gwK3QxU0R3Q3BsSnY4L3JqWjZwcmNMMndwY1lNUGYvT2Z5eXZFRURY?=
 =?utf-8?B?QmtBMCtwYVNPNWoxajJZRTQ4bGtHbWRmZk1rOXNSdlhQTGRkSko2N0lJS1NE?=
 =?utf-8?B?cUxTcldRQzFrdHVBWGZHNTR3TldxazljM1dFcFk0eFFqbHp0ZXVUejFuMkFC?=
 =?utf-8?B?UDlsdnI4aG9XRzdSenIwTDRlb3VyeVBDemJCT0w1TTlwL0I1U2JwRGlvME4r?=
 =?utf-8?B?QmFmZGhySzUya2EvY3A2ZitTVDNha2ZFeGlwVUluVmlsc0RpUmtXeWxmWHdy?=
 =?utf-8?B?dlBvZ1RueWtFQ1BDQUVjT0tnQnNTTkFwZVBOOUxPWW1oWlUydjB3STMxT2NV?=
 =?utf-8?B?S09VY0JUZ2FXOURDSmdHaGR4MjJvYUYza1dPajdaRkV6Z080d0haU204NVFi?=
 =?utf-8?B?aW5DRnZ0RVhaKy9xazExNDU4a1puUkYyTURVMThZeVRFZHlrWkc4SGVtQXI5?=
 =?utf-8?B?L3NCVUs4QTkvaVZKZldsNkJNNThLSlBzak1wM2xxYVh4ekVwUG5uK2lSd1l1?=
 =?utf-8?B?bGI1Y0pBTEI0UHM5VVgva0NRWTIra2o4WFhLZkNVTm9ZSldBSFhTWGdsWXNU?=
 =?utf-8?B?VEg3YkdaWTNtUmxaL2xpTklmNEE2MzlJdmlaRDNmd1BrOVR1aVRpMUNvMkY2?=
 =?utf-8?B?YWo5VXYvM1d1em5UK1hPaE5hOUZKcmJ4VjJCSkZHYkg2dnYwckVQTDlySGRT?=
 =?utf-8?B?T0M5Q0hYeHQva0o0S3psNlhIdm1kcWsyZy9WWnlpSmdyZWRiL0gzbjZubHA5?=
 =?utf-8?B?UCtUQ2JjU3FsSzVZcjlUZXdJRVJFVzB2WXFJeU80UExxZmVkamFSZ0VKZmc5?=
 =?utf-8?B?Z2F2VzFxbzBFMjBkM0c3NzdNZnJiR0Q2SG1xVTM1d1pSRG0vemp3K1Jva0Q2?=
 =?utf-8?B?ODY5c3hVWHZyRU43dHpScnVxdzVieFJiVkRvZUIwSzMvcnpmVzJtZkFNc3ZU?=
 =?utf-8?B?SmEzc2tQd0dTTmFDYVVCOENXc2JLdExJSThidmthdHVkQ2FuUXVIcjViZi9X?=
 =?utf-8?B?TXNRR0d4SWw0blFjVUlsRHloTmFMY1JSeEF5dDEyWnpFMGtzOVZacTk4V1NX?=
 =?utf-8?B?VEpKY2VyOUEvUXJvRVhoQTF6TzZML3BYTnZRWXdqZVlQWlIwUytaUytsMTli?=
 =?utf-8?B?U3BFeHNOYyt4QjExZ25qWXh0S1lKdU1nYjNWcGphS3pmZUtkU0NaRW9ROWlq?=
 =?utf-8?B?NTA0SEdvUXpvVG5lNjg3MUM1azBhbWRMcG5PcnZtaXBTb0dtSDZjb2ZHeFlE?=
 =?utf-8?B?SXluYVc1czEwd0dKZHo3V1RmWVR1cTdlRXJWWHovQ3hGamJ2OGxPdkppT1JN?=
 =?utf-8?B?UUc2WmdRNGNvZUQreGtuTC96RDZuaFlWUUpBUVhKTjVtakZ0N2lKN3c0eVk2?=
 =?utf-8?B?dEw1UXpKNktmRExqb2N3YU9wVnRLR1BMck93SEJ4NEdqNHFpSFN5V0Fab2Zm?=
 =?utf-8?B?c2Y5RVlFaE4rRkxzK3k2T0ZqNnAxVUdNa294N0ZaWUdXbkFsaS9PZ01STlIr?=
 =?utf-8?B?WVFyaUFDcG81VlFRclNIdCtiV3diSlBMcVh0dU9zNW0rSmJ6V3NLNzd4SEdp?=
 =?utf-8?B?dSt5WEIyNHFPSzdIYVNmY2Q4bDQ1OXJWcnR6ZUp2SW1tUHdnTWJZTmJkWm1E?=
 =?utf-8?B?cE5YVWpOUUhZcnFDM3p0QjFNZGtkdHV4b1d3a2xMRjlDR0NKN0tTYU9SMzVB?=
 =?utf-8?B?c2ZaTzFqQjdZTi9SRml0L0FEVnlsZTZpOHhuTmlzNDQzbDc4MlpIdnFtU3dQ?=
 =?utf-8?B?bUZoUUwrdmVnZVd4RE03cnlDZlUybWxZaHNyaU5UNXg1QnFXUTJFSTg3djB1?=
 =?utf-8?B?Q0VlckRPMFlqMUdOVWdtQzZ4WjB3PT0=?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c2bcfc88-0d83-4c67-27f4-08d998e6ebc8
X-MS-Exchange-CrossTenant-AuthSource: BN0PR10MB5192.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Oct 2021 01:13:01.7360
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: g1Klb2gvBq8bk97giTyybBhW/pZ4PW5fPyI8oLMkmhGI8R7y2E+RRYQJY46zYMR1G7re39dREY0ddU04xZjV/poDwaIbdZYUo2eKK4y7tZ8=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN7PR10MB2722
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10149 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 mlxlogscore=999
 bulkscore=0 phishscore=0 mlxscore=0 spamscore=0 adultscore=0
 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2110270004
X-Proofpoint-ORIG-GUID: a5k14Jr0i6BVqhqbg28r8A_5wYrwCfA5
X-Proofpoint-GUID: a5k14Jr0i6BVqhqbg28r8A_5wYrwCfA5
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Geert,

On 10/26/2021 1:12 PM, Geert Uytterhoeven wrote:
> Hi George,
>
> On Tue, Oct 26, 2021 at 5:48 PM George Kennedy
> <george.kennedy@oracle.com> wrote:
>> On 10/26/2021 10:11 AM, Geert Uytterhoeven wrote:
>>> On Tue, Oct 26, 2021 at 3:38 PM George Kennedy
>>> <george.kennedy@oracle.com> wrote:
>>>> On 10/26/2021 4:30 AM, Geert Uytterhoeven wrote:
>>>>> On Mon, Oct 25, 2021 at 9:37 PM George Kennedy
>>>>> <george.kennedy@oracle.com> wrote:
>>>>>> On 10/25/2021 3:07 PM, Greg KH wrote:
>>>>>>> On Mon, Oct 25, 2021 at 02:01:30PM -0500, George Kennedy wrote:
>>>>>>>> Do a sanity check on pixclock value before using it as a divisor.
>>>>>>>>
>>>>>>>> Syzkaller reported a divide error in cirrusfb_check_pixclock.
>>>>>>>>
>>>>>>>> divide error: 0000 [#1] SMP KASAN PTI
>>>>>>>> CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1
>>>>>>>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2
>>>>>>>> RIP: 0010:cirrusfb_check_var+0x6f1/0x1260
>>>>>>>>
>>>>>>>> Call Trace:
>>>>>>>>      fb_set_var+0x398/0xf90
>>>>>>>>      do_fb_ioctl+0x4b8/0x6f0
>>>>>>>>      fb_ioctl+0xeb/0x130
>>>>>>>>      __x64_sys_ioctl+0x19d/0x220
>>>>>>>>      do_syscall_64+0x3a/0x80
>>>>>>>>      entry_SYSCALL_64_after_hwframe+0x44/0xae
>>>>>>>>
>>>>>>>> Signed-off-by: George Kennedy <george.kennedy@oracle.com>
>>>>>>>> --- a/drivers/video/fbdev/cirrusfb.c
>>>>>>>> +++ b/drivers/video/fbdev/cirrusfb.c
>>>>>>>> @@ -477,6 +477,9 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var,
>>>>>>>>         struct cirrusfb_info *cinfo = info->par;
>>>>>>>>         unsigned maxclockidx = var->bits_per_pixel >> 3;
>>>>>>>>
>>>>>>>> +    if (!var->pixclock)
>>>>>>>> +            return -EINVAL;
>>>>> This is not correct: fbdev drivers should round up invalid values,
>>>>> and only return an error if rounding up cannot yield a valid value.
>>>> What default value would you recommend? Here are examples of some of the
>>>> possible cirrusfb pixclock values:
>>>> 40000: 25MHz
>>>> 20000: 50Mhz
>>>> 12500: 80Mhz
>>> You should pick the lowest supported value.
>> In bestclock() the frequency value ("freq") is not allowed to go below 8000.
>>
>>           if (freq < 8000)
>>                   freq = 8000;
>>
>> If pixclock is passed in as zero to cirrusfb_check_pixclock(), is it ok
>> to then set the value of pixclock to 125000, which will result in "freq"
>> being set to 8000 (or adjust the passed in pixclock value to make sure
>> "freq" does not get below 8000)?
> No, clock rate is the inverse of clock period.
> So the smallest clock period (fb_var_screeninfo.pixclock) corresponds
> to the largest clock rate (freq in bestclock()).

How about this?

This gets the frequency derived from pixclock to maxclock or rounds up 
pixclock to get the frequency as close to maxclock as possible.

diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c
index 93802ab..2e8e620 100644
--- a/drivers/video/fbdev/cirrusfb.c
+++ b/drivers/video/fbdev/cirrusfb.c
@@ -620,6 +620,18 @@ static int cirrusfb_check_var(struct 
fb_var_screeninfo *var,
                 return -EINVAL;
         }

+       if (!var->pixclock) {
+               long maxclock;
+               unsigned maxclockidx = var->bits_per_pixel >> 3;
+
+               maxclock = 
cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx];
+
+               var->pixclock = KHZ2PICOS(maxclock);
+               while (PICOS2KHZ(var->pixclock) > maxclock) {
+                       var->pixclock++;
+               }
+       }
+
         if (cirrusfb_check_pixclock(var, info))
                 return -EINVAL;

The work can't be done in cirrusfb_check_pixclock() as var->pixclock is 
read-only because "var" is "const struct fb_var_screeninfo *var".

Thank you,
George
>
> Gr{oetje,eeting}s,
>
>                          Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
>                                  -- Linus Torvalds