lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 10 Feb 2020 04:32:53 -0800 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-kernel@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org, Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>, Benjamin Gaignard <benjamin.gaignard@...com>, Daniel Vetter <daniel@...ll.ch>, Ville Syrjälä <ville.syrjala@...ux.intel.com>, Daniel Vetter <daniel.vetter@...ll.ch> Subject: [PATCH 4.19 115/195] drm/rect: Avoid division by zero From: Ville Syrjälä <ville.syrjala@...ux.intel.com> commit 433480c1afd44f3e1e664b85063d98cefeefa0ed upstream. Check for zero width/height destination rectangle in drm_rect_clip_scaled() to avoid a division by zero. Cc: stable@...r.kernel.org Fixes: f96bdf564f3e ("drm/rect: Handle rounding errors in drm_rect_clip_scaled, v3.") Cc: Maarten Lankhorst <maarten.lankhorst@...ux.intel.com> Cc: Benjamin Gaignard <benjamin.gaignard@...com> Cc: Daniel Vetter <daniel@...ll.ch> Testcase: igt/kms_selftest/drm_rect_clip_scaled_div_by_zero Signed-off-by: Ville Syrjälä <ville.syrjala@...ux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20191122175623.13565-2-ville.syrjala@linux.intel.com Reviewed-by: Daniel Vetter <daniel.vetter@...ll.ch> Reviewed-by: Benjamin Gaignard <benjamin.gaignard@...com> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org> --- drivers/gpu/drm/drm_rect.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/drm_rect.c +++ b/drivers/gpu/drm/drm_rect.c @@ -52,7 +52,12 @@ EXPORT_SYMBOL(drm_rect_intersect); static u32 clip_scaled(u32 src, u32 dst, u32 clip) { - u64 tmp = mul_u32_u32(src, dst - clip); + u64 tmp; + + if (dst == 0) + return 0; + + tmp = mul_u32_u32(src, dst - clip); /* * Round toward 1.0 when clipping so that we don't accidentally
Powered by blists - more mailing lists