drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()

commit 9398332f23fab10c5ec57c168b44e72997d6318e upstream.

drm_mode_vrefresh() is trying to avoid divide by zero
by checking whether htotal or vtotal are zero. But we may
still end up with a div-by-zero of vtotal*htotal*...

Cc: stable@vger.kernel.org
Reported-by: syzbot+622bba18029bcde672e1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=622bba18029bcde672e1
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241129042629.18280-2-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 1c72208d81335765d1daf8efd761b9e9d774c614..2660f15a0e959a09e1f5d6114285f534c677b1be 100644 (file)
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -757,14 +757,11 @@ EXPORT_SYMBOL(drm_mode_set_name);
  */
 int drm_mode_vrefresh(const struct drm_display_mode *mode)
 {
-       unsigned int num, den;
+       unsigned int num = 1, den = 1;
 
        if (mode->htotal == 0 || mode->vtotal == 0)
                return 0;
 
-       num = mode->clock;
-       den = mode->htotal * mode->vtotal;
-
        if (mode->flags & DRM_MODE_FLAG_INTERLACE)
                num *= 2;
        if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
@@ -772,6 +769,12 @@ int drm_mode_vrefresh(const struct drm_display_mode *mode)
        if (mode->vscan > 1)
                den *= mode->vscan;
 
+       if (check_mul_overflow(mode->clock, num, &num))
+               return 0;
+
+       if (check_mul_overflow(mode->htotal * mode->vtotal, den, &den))
+               return 0;
+
        return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den);
 }
 EXPORT_SYMBOL(drm_mode_vrefresh);