On 29/07/2026 10:48, [email protected] wrote:
From: Shixiong Ou <[email protected]>
When scale is large enough that scaled_font exceeds the display
dimensions, rows or columns become 0. A columns value of 0 causes
an infinite loop in drm_log_draw_kmsg_record() because the loop
never decrements len.
Check for zero rows/columns in drm_log_setup_modeset() and return
an error, cleaning up the already allocated buffer to avoid a leak.
Thanks, it looks good to me.
Reviewed-by: Jocelyn Falempe <[email protected]>
Signed-off-by: Shixiong Ou <[email protected]>
---
drivers/gpu/drm/clients/drm_log.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/clients/drm_log.c
b/drivers/gpu/drm/clients/drm_log.c
index a04f651e8265..63577aeb705c 100644
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -240,6 +240,12 @@ static int drm_log_setup_modeset(struct drm_client_dev
*client,
scanout->scaled_font_w = scanout->font->width * scale;
scanout->rows = height / scanout->scaled_font_h;
scanout->columns = width / scanout->scaled_font_w;
+ if (!scanout->rows || !scanout->columns) {
+ drm_client_buffer_delete(scanout->buffer);
+ scanout->buffer = NULL;
+ mode_set->fb = NULL;
+ return -EINVAL;
+ }
scanout->front_color = drm_draw_color_from_xrgb8888(0xffffff, format);
scanout->prefix_color = drm_draw_color_from_xrgb8888(0x4e9a06, format);
return 0;
