drm/log: Fix infinite loop when scale is too large for display

When scale is large enough that scaled_font exceeds the display
dimensions, rows or columns become 0. A columns value of 0 causes
an infinite loop in drm_log_draw_kmsg_record() because the loop
never decrements len.

Check for zero rows/columns in drm_log_setup_modeset() and return
an error, cleaning up the already allocated buffer to avoid a leak.

Fixes: 8a4b913df427 ("drm/log: Add integer scaling support")
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Link: https://patch.msgid.link/20260729084815.692944-1-oushixiong1025@163.com
Signed-off-by: Jocelyn Falempe <jfalempe@redhat.com>

diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
index f23a92f826c926a2723af3522c6c0e8a11593d8d..467cdce57dd3e162f4a14c559e72e7da162905de 100644 (file)
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -218,6 +218,12 @@ static int drm_log_setup_modeset(struct drm_client_dev *client,
        scanout->scaled_font_w = scanout->font->width * scale;
        scanout->rows = height / scanout->scaled_font_h;
        scanout->columns = width / scanout->scaled_font_w;
+       if (!scanout->rows || !scanout->columns) {
+               drm_client_buffer_delete(scanout->buffer);
+               scanout->buffer = NULL;
+               mode_set->fb = NULL;
+               return -EINVAL;
+       }
        scanout->front_color = drm_draw_color_from_xrgb8888(0xffffff, format);
        scanout->prefix_color = drm_draw_color_from_xrgb8888(0x4e9a06, format);
        return 0;