Commit 70b3778f authored by Ville Syrjälä's avatar Ville Syrjälä Committed by Guo Mengqi
Browse files

drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() 

stable inclusion
from stable-v6.6.68
commit b39de5a71bac5641d0fda33d1cf5682d82cf1ae5
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBISDQ
CVE: CVE-2024-56369

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b39de5a71bac5641d0fda33d1cf5682d82cf1ae5



--------------------------------

commit 9398332f23fab10c5ec57c168b44e72997d6318e upstream.

drm_mode_vrefresh() is trying to avoid divide by zero
by checking whether htotal or vtotal are zero. But we may
still end up with a div-by-zero of vtotal*htotal*...

Cc: stable@vger.kernel.org
Reported-by: default avatar <syzbot+622bba18029bcde672e1@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=622bba18029bcde672e1


Signed-off-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241129042629.18280-2-ville.syrjala@linux.intel.com


Reviewed-by: default avatarJani Nikula <jani.nikula@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
Signed-off-by: default avatarGuo Mengqi <guomengqi3@huawei.com>
parent ba86cb63

drivers/gpu/drm/drm_modes.c

+7 −4
Original line number Diff line number Diff line
@@ -1285,14 +1285,11 @@ EXPORT_SYMBOL(drm_mode_set_name); 
 */

int drm_mode_vrefresh(const struct drm_display_mode *mode)

{

	unsigned int num, den;

	unsigned int num = 1, den = 1;



	if (mode->htotal == 0 || mode->vtotal == 0)

		return 0;



	num = mode->clock;

	den = mode->htotal * mode->vtotal;



	if (mode->flags & DRM_MODE_FLAG_INTERLACE)

		num *= 2;

	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
@@ -1300,6 +1297,12 @@ int drm_mode_vrefresh(const struct drm_display_mode *mode) 
	if (mode->vscan > 1)

		den *= mode->vscan;



	if (check_mul_overflow(mode->clock, num, &num))

		return 0;



	if (check_mul_overflow(mode->htotal * mode->vtotal, den, &den))

		return 0;



	return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den);

}

EXPORT_SYMBOL(drm_mode_vrefresh);