[PATCH] fbdev: radeonfb: reject a zero pixclock in radeonfb_check_var()

[Zou Jianqiang]

From: Jianqiang Zou <jq.zou@xxxxxxxxxxx>

radeonfb_set_par() derives the dot clock from the user supplied
struct fb_var_screeninfo:

	dotClock = 1000000000 / pixClock;

where pixClock is copied from mode->pixclock.  A zero pixclock
bypasses the existing validation and makes the kernel divide by zero
in radeonfb_set_par().

The driver does have a check for this: fb_validate_mode() returns
-EINVAL when pixclock is 0, but radeon_match_mode() only calls it when
the output has no scaler and an EDID-derived mode database is
available:

	if (has_rmx == 0 && rinfo->mon1_modedb)
		if (fb_validate_mode(...))
			return -EINVAL;

mon1_modedb is only filled in when an EDID is read, so when no
EDID-derived mode database is available the validation is skipped and
the invalid mode reaches radeonfb_set_par().

Reject a zero pixclock in radeonfb_check_var() before matching the
mode.  fb_set_var() calls it on the FBIOPUT_VSCREENINFO path before
->fb_set_par(), so the invalid value is rejected before the mode is
applied.  This is the same check other fbdev drivers use (i740fb,
arkfb, s3fb).

Reproduced on Linux 7.3.0 using a custom QEMU PCI stub device with
vendor/device ID 1002:5955; no physical Radeon hardware was used.  A
single FBIOPUT_VSCREENINFO with pixclock = 0 is enough to trigger the
divide error.

Signed-off-by: Jianqiang Zou <jq.zou@xxxxxxxxxxx>
---
 drivers/video/fbdev/aty/radeon_base.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c
index b6b058cee..a69e58914 100644
--- a/drivers/video/fbdev/aty/radeon_base.c
+++ b/drivers/video/fbdev/aty/radeon_base.c
@@ -836,6 +836,9 @@ static int radeonfb_check_var (struct fb_var_screeninfo *var, struct fb_info *in
         int nom, den;
 	unsigned int pitch;
 
+	if (!var->pixclock)
+		return -EINVAL;
+
 	if (radeon_match_mode(rinfo, &v, var))
 		return -EINVAL;
 
-- 
2.43.0