From: Ville Syrjälä ville.syrjala@linux.intel.com
commit 433480c1afd44f3e1e664b85063d98cefeefa0ed upstream.
Check for zero width/height destination rectangle in drm_rect_clip_scaled() to avoid a division by zero.
Cc: stable@vger.kernel.org Fixes: f96bdf564f3e ("drm/rect: Handle rounding errors in drm_rect_clip_scaled, v3.") Cc: Maarten Lankhorst maarten.lankhorst@linux.intel.com Cc: Benjamin Gaignard benjamin.gaignard@st.com Cc: Daniel Vetter daniel@ffwll.ch Testcase: igt/kms_selftest/drm_rect_clip_scaled_div_by_zero Signed-off-by: Ville Syrjälä ville.syrjala@linux.intel.com Link: https://patchwork.freedesktop.org/patch/msgid/20191122175623.13565-2-ville.s... Reviewed-by: Daniel Vetter daniel.vetter@ffwll.ch Reviewed-by: Benjamin Gaignard benjamin.gaignard@st.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- drivers/gpu/drm/drm_rect.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_rect.c b/drivers/gpu/drm/drm_rect.c index 8c05782..0f5a0c64 100644 --- a/drivers/gpu/drm/drm_rect.c +++ b/drivers/gpu/drm/drm_rect.c @@ -52,7 +52,12 @@ bool drm_rect_intersect(struct drm_rect *r1, const struct drm_rect *r2)
static u32 clip_scaled(u32 src, u32 dst, u32 clip) { - u64 tmp = mul_u32_u32(src, dst - clip); + u64 tmp; + + if (dst == 0) + return 0; + + tmp = mul_u32_u32(src, dst - clip);
/* * Round toward 1.0 when clipping so that we don't accidentally