In scl_cal_scale*(), if the dst parameter equals 1, then division by 0
will happen. We'll have to add a check for the destination rectangle's
width/height being < 2 in vop_plane_atomic_check(), just like the VOP2
driver has to check for the width/height being < 4...
Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.
Fixes: 4c156c21c794 ("drm/rockchip: vop: support plane scale")
Signed-off-by: Sergey Shtylyov <[email protected]>
Cc: [email protected]
---
The patch is against the drm-misc-fixes branch of the DRM kernel.git repo
on gitlab.freedesktop.org. It replaces [1] for which I've got no neither
feedback nor testing...
[1] https://lore.kernel.org/all/[email protected]/
drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 11 +++++++++++
1 file changed, 11 insertions(+)
Index: kernel/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
===================================================================
--- kernel.orig/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ kernel/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -817,6 +817,7 @@ static int vop_plane_atomic_check(struct
struct drm_framebuffer *fb = new_plane_state->fb;
struct vop_win *vop_win = to_vop_win(plane);
const struct vop_win_data *win = vop_win->data;
+ struct drm_rect *dest = &new_plane_state->dst;
int ret;
int min_scale = win->phy->scl ? FRAC_16_16(1, 8) :
DRM_PLANE_NO_SCALING;
@@ -844,6 +845,16 @@ static int vop_plane_atomic_check(struct
if (ret < 0)
return ret;
+ if (win->phy->scl) {
+ /* Disallow width/height < 2 to avoid division by 0. */
+ if (drm_rect_width(dest) < 2 || drm_rect_height(dest) < 2) {
+ DRM_DEBUG_KMS("Invalid dest size: %dx%d, min size is
2x2\n",
+ drm_rect_width(dest),
drm_rect_height(dest));
+ new_plane_state->visible = false;
+ return 0;
+ }
+ }
+
/*
* Src.x1 can be odd when do clip, but yuv plane start point
* need align with 2 pixel.
