Hi Jesse, It sees that there might be an overflow when crtc_w or crtc_h =0. Following is my patch. Thanks and best regards.
Hai Lan
From 778327daa3451f3c5f41c5db8bdccdcbf484267b Mon Sep 17 00:00:00 2001 From: Hai Lan hai.lan@intel.com Date: Fri, 4 Nov 2011 18:08:11 +0800 Subject: [PATCH] drm/i915:fix the overflow for overlay when crtc_w or crtc_h =0
When the crtc_w = 0 or crtc_h = 0, it should not be divided. Besides, when (crtc_x+<crtc_w)<0 or (crtc_y+crtc_h)<0, it should be handled.
Signed-off-by: Hai Lan hai.lan@intel.com --- drivers/gpu/drm/i915/intel_sprite.c | 14 +++++++++++--- 1 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c index 0891bda..d62e8ca 100644 --- a/drivers/gpu/drm/i915/intel_sprite.c +++ b/drivers/gpu/drm/i915/intel_sprite.c @@ -268,17 +268,23 @@ intel_update_plane(struct drm_plane *plane, struct drm_crtc *crtc, * try to scale the source if part of the visible region is offscreen. * The caller must handle that by adjusting source offset and size. */ - if (crtc_x < 0) { + if ((crtc_x < 0) && ((crtc_x + crtc_w)>0)) { crtc_w += crtc_x; crtc_x = 0; } + if ((crtc_x + crtc_w)<0) { + return -EINVAL; + } if (crtc_x + crtc_w > primary_w) crtc_w = primary_w - crtc_x;
- if (crtc_y < 0) { + if ((crtc_y < 0) && ((crtc_y+crtc_h)>0)) { crtc_h += crtc_y; crtc_y = 0; } + if ((crtc_y+crtc_h)<0) { + return -EINVAL; + } if (crtc_y + crtc_h > primary_h) crtc_h = primary_h - crtc_y;
@@ -286,7 +292,9 @@ intel_update_plane(struct drm_plane *plane, struct drm_crtc *crtc, * We can take a larger source and scale it down, but * only so much... 16x is the max on SNB. */ - if (((src_w * src_h) / (crtc_w * crtc_h)) > intel_plane->max_downscale) + if (crtc_w == 0 || crtc_h == 0) + return -EINVAL; + else if (((src_w * src_h) / (crtc_w * crtc_h)) > intel_plane->max_downscale) return -EINVAL;
/*