cirrusfb division by zero

cirrusfb division by zero

[Marcelo Tosatti]

Anthony, 

The following sequence crashes F9 guests, when using VNC:

# modprobe cirrusfb
# vbetool post

Results in Floating point exception at:

cirrus_do_copy()
{

    depth = s->get_bpp((VGAState *)s) / 8 
    ...
    sx = (src % (width * depth)) / depth;
    ...
}

Problem is that ->get_bpp returns 0.

Following band-aid "fixes it" (coff). I have no idea if its correct
though ?

"vbetool post" corrupts both SDL and VNC displays when using cirrusfb,
but seems a separate problem.


diff --git a/qemu/hw/cirrus_vga.c b/qemu/hw/cirrus_vga.c
index e14ec35..9f860ff 100644
--- a/qemu/hw/cirrus_vga.c
+++ b/qemu/hw/cirrus_vga.c
@@ -709,6 +709,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, in     int notify = 0;

     depth = s->get_bpp((VGAState *)s) / 8;
+    if (!depth)
+        depth = 1;
     s->get_resolution((VGAState *)s, &width, &height);

     /* extra x, y */


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone

Re: cirrusfb division by zero

[Anthony Liguori]

Marcelo Tosatti wrote:
> Anthony, 
>
> The following sequence crashes F9 guests, when using VNC:
>
> # modprobe cirrusfb
> # vbetool post
>
> Results in Floating point exception at:
>
> cirrus_do_copy()
> {
>
>     depth = s->get_bpp((VGAState *)s) / 8 
>     ...
>     sx = (src % (width * depth)) / depth;
>     ...
> }
>
> Problem is that ->get_bpp returns 0.
>
> Following band-aid "fixes it" (coff). I have no idea if its correct
> though ?
>   

It suggests something is very broken.  get_bpp only is supposed to 
return 0 when in VGA mode.  I don't think blitting should happen when in 
VGA mode.  Applying the patch is not a bad idea but what was the guest 
doing when this happened?  Was it in the process of transitioning from 
one mode to another?

Regards,

Anthony Liguori

> "vbetool post" corrupts both SDL and VNC displays when using cirrusfb,
> but seems a separate problem.
>
>
> diff --git a/qemu/hw/cirrus_vga.c b/qemu/hw/cirrus_vga.c
> index e14ec35..9f860ff 100644
> --- a/qemu/hw/cirrus_vga.c
> +++ b/qemu/hw/cirrus_vga.c
> @@ -709,6 +709,8 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, in     int notify = 0;
>
>      depth = s->get_bpp((VGAState *)s) / 8;
> +    if (!depth)
> +        depth = 1;
>      s->get_resolution((VGAState *)s, &width, &height);
>
>      /* extra x, y */
>
>   


-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference 
Don't miss this year's exciting event. There's still time to save $100. 
Use priority code J8TL2D2. 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone