[PATCH] drm/rockchip: vop: avoid division by 0 in scl_cal_scale*()

Sergey Shtylyov s.shtylyov at omp.ru
Thu Nov 27 06:43:55 PST 2025


In scl_cal_scale*(), if the dst parameter equals 1, then division by 0
will happen. We'll have to add a check for the destination rectangle's
width/height being < 2 in vop_plane_atomic_check(), just like the VOP2
driver has to check for the width/height being < 4...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: 4c156c21c794 ("drm/rockchip: vop: support plane scale")
Signed-off-by: Sergey Shtylyov <s.shtylyov at omp.ru>
Cc: stable at vger.kernel.org

---
The patch is against the drm-misc-fixes branch of the DRM kernel.git repo
on gitlab.freedesktop.org.  It replaces [1] for which I've got no neither
feedback nor testing...

[1] https://lore.kernel.org/all/40da59f8-10e9-49b0-9f25-1474067625f6@omp.ru/

 drivers/gpu/drm/rockchip/rockchip_drm_vop.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

Index: kernel/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
===================================================================
--- kernel.orig/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ kernel/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -817,6 +817,7 @@ static int vop_plane_atomic_check(struct
 	struct drm_framebuffer *fb = new_plane_state->fb;
 	struct vop_win *vop_win = to_vop_win(plane);
 	const struct vop_win_data *win = vop_win->data;
+	struct drm_rect *dest = &new_plane_state->dst;
 	int ret;
 	int min_scale = win->phy->scl ? FRAC_16_16(1, 8) :
 					DRM_PLANE_NO_SCALING;
@@ -844,6 +845,16 @@ static int vop_plane_atomic_check(struct
 	if (ret < 0)
 		return ret;
 
+	if (win->phy->scl) {
+		/* Disallow width/height < 2 to avoid division by 0. */
+		if (drm_rect_width(dest) < 2 || drm_rect_height(dest) < 2) {
+			DRM_DEBUG_KMS("Invalid dest size: %dx%d, min size is 2x2\n",
+				      drm_rect_width(dest), drm_rect_height(dest));
+			new_plane_state->visible = false;
+			return 0;
+		}
+	}
+
 	/*
 	 * Src.x1 can be odd when do clip, but yuv plane start point
 	 * need align with 2 pixel.



More information about the Linux-rockchip mailing list