[PATCH 3/4] drm/log: Fix infinite loop when scale is too large for display

[PATCH 3/4] drm/log: Fix infinite loop when scale is too large for display

[oushixiong1025]

From: Shixiong Ou <oushixiong@kylinos.cn>

When scale is large enough that scaled_font exceeds the display
dimensions, rows or columns become 0. A columns value of 0 causes
an infinite loop in drm_log_draw_kmsg_record() because the loop
never decrements len.

Check for zero rows/columns in drm_log_setup_modeset() and return
an error, cleaning up the already allocated buffer to avoid a leak.

Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
---
 drivers/gpu/drm/clients/drm_log.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
index a04f651e8265..63577aeb705c 100644
--- a/drivers/gpu/drm/clients/drm_log.c
+++ b/drivers/gpu/drm/clients/drm_log.c
@@ -240,6 +240,12 @@ static int drm_log_setup_modeset(struct drm_client_dev *client,
 	scanout->scaled_font_w = scanout->font->width * scale;
 	scanout->rows = height / scanout->scaled_font_h;
 	scanout->columns = width / scanout->scaled_font_w;
+	if (!scanout->rows || !scanout->columns) {
+		drm_client_buffer_delete(scanout->buffer);
+		scanout->buffer = NULL;
+		mode_set->fb = NULL;
+		return -EINVAL;
+	}
 	scanout->front_color = drm_draw_color_from_xrgb8888(0xffffff, format);
 	scanout->prefix_color = drm_draw_color_from_xrgb8888(0x4e9a06, format);
 	return 0;
-- 
2.25.1


No virus found
		Checked by Hillstone Network AntiVirus

Re: [PATCH 3/4] drm/log: Fix infinite loop when scale is too large for display

[Jocelyn Falempe]

On 29/07/2026 10:48, oushixiong1025@163.com wrote:
> From: Shixiong Ou <oushixiong@kylinos.cn>
> 
> When scale is large enough that scaled_font exceeds the display
> dimensions, rows or columns become 0. A columns value of 0 causes
> an infinite loop in drm_log_draw_kmsg_record() because the loop
> never decrements len.
> 
> Check for zero rows/columns in drm_log_setup_modeset() and return
> an error, cleaning up the already allocated buffer to avoid a leak.

Thanks, it looks good to me.

Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
> 
> Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
> ---
>   drivers/gpu/drm/clients/drm_log.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/gpu/drm/clients/drm_log.c b/drivers/gpu/drm/clients/drm_log.c
> index a04f651e8265..63577aeb705c 100644
> --- a/drivers/gpu/drm/clients/drm_log.c
> +++ b/drivers/gpu/drm/clients/drm_log.c
> @@ -240,6 +240,12 @@ static int drm_log_setup_modeset(struct drm_client_dev *client,
>   	scanout->scaled_font_w = scanout->font->width * scale;
>   	scanout->rows = height / scanout->scaled_font_h;
>   	scanout->columns = width / scanout->scaled_font_w;
> +	if (!scanout->rows || !scanout->columns) {
> +		drm_client_buffer_delete(scanout->buffer);
> +		scanout->buffer = NULL;
> +		mode_set->fb = NULL;
> +		return -EINVAL;
> +	}
>   	scanout->front_color = drm_draw_color_from_xrgb8888(0xffffff, format);
>   	scanout->prefix_color = drm_draw_color_from_xrgb8888(0x4e9a06, format);
>   	return 0;