From: Jianqiang Zou <[email protected]>
radeonfb_set_par() derives the dot clock from the user supplied
struct fb_var_screeninfo:
dotClock = 1000000000 / pixClock;
where pixClock is copied from mode->pixclock. A zero pixclock
bypasses the existing validation and makes the kernel divide by zero
in radeonfb_set_par().
The driver does have a check for this: fb_validate_mode() returns
-EINVAL when pixclock is 0, but radeon_match_mode() only calls it when
the output has no scaler and an EDID-derived mode database is
available:
if (has_rmx == 0 && rinfo->mon1_modedb)
if (fb_validate_mode(...))
return -EINVAL;
mon1_modedb is only filled in when an EDID is read, so when no
EDID-derived mode database is available the validation is skipped and
the invalid mode reaches radeonfb_set_par().
Reject a zero pixclock in radeonfb_check_var() before matching the
mode. fb_set_var() calls it on the FBIOPUT_VSCREENINFO path before
->fb_set_par(), so the invalid value is rejected before the mode is
applied. This is the same check other fbdev drivers use (i740fb,
arkfb, s3fb).
Reproduced on Linux 7.3.0 using a custom QEMU PCI stub device with
vendor/device ID 1002:5955; no physical Radeon hardware was used. A
single FBIOPUT_VSCREENINFO with pixclock = 0 is enough to trigger the
divide error.
Signed-off-by: Jianqiang Zou <[email protected]>
---
drivers/video/fbdev/aty/radeon_base.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/video/fbdev/aty/radeon_base.c
b/drivers/video/fbdev/aty/radeon_base.c
index b6b058cee..a69e58914 100644
--- a/drivers/video/fbdev/aty/radeon_base.c
+++ b/drivers/video/fbdev/aty/radeon_base.c
@@ -836,6 +836,9 @@ static int radeonfb_check_var (struct fb_var_screeninfo
*var, struct fb_info *in
int nom, den;
unsigned int pitch;
+ if (!var->pixclock)
+ return -EINVAL;
+
if (radeon_match_mode(rinfo, &v, var))
return -EINVAL;
--
2.43.0
