From nobody Sat Jul 25 23:05:54 2026 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEE1B30498E for ; Sat, 11 Jul 2026 23:07:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783811255; cv=none; b=IsyNVqW6QkRDX8YsZkPVeS22ZA145/V22pSXSTamBkGBVy9XLFogWVJg3MIflvChU3e1a4TyP/QnBqkYEZFAoQcNULH164GO1DfBIkDbwa6b5fDRgPjgt5N3LxZ9gmRfbnij4W3Z2XC9D+tdFgBXxENWbWhbGQGxThHuHZpZPW8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783811255; c=relaxed/simple; bh=go+r7k3Ka+vyOo1LixPTAznfwrFT7Qdj3J5BPCAr07I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=b3CxR73XtC5FK03Q7U5XGlt64cnkt+FeCFjjNJR4V1txy2YuqtZ1Eu5yK3Q/KCBLpxYPfD47BUwSTXi9kQEcgr5RqTJ2fw5RUC5qos0ULyDiUPwIBC/gllJRbHbNzakLPgPwJ//EOrEoS7R2ZnQiFt0wwf2I60Y0xRPn+IP8FoA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=AC0UuAcC; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="AC0UuAcC" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso2391765a91.2 for ; Sat, 11 Jul 2026 16:07:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1783811253; x=1784416053; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=b01MPLPFUTPl/FZxo6tsZL3gbo3NnjDL9LbETEmQYys=; b=AC0UuAcCE0due1XKlDvRxih2LwG2ZuT2lFcTobi/ajAhOyNVfP8SM1YhAjbCPIiKDj 824D7fU/JAM4MODg0JA1EaSS/B48voRrRMI5Wddq2VejzHDPlX5MlWYy6/dPOGw5eiQe D/CCUY+8D1ryWcrlyMXl3uLKgEqBpPOEb/4apx2Dt42zDowB0VcWRJbM8jSuwwHC0MLn Jsd9lQsGUfTjjhioS5UJoQuPLhGjpNhImfEiwGSBFlh1zv20hYt11TSTR/KUDJ8Upx/k m4jbnfJBCH5Q+lBdzsW3n2f9Qn6ooehdvg26VkA/bYCbQHTJizPxaXkab+IWVwHIbvR1 YEsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783811253; x=1784416053; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=b01MPLPFUTPl/FZxo6tsZL3gbo3NnjDL9LbETEmQYys=; b=BBEI60TPVqxhoEqaFjXIFIt8aBJuWgPwy3RbYEMUeRl1M2+oLPl7dUlDcC6cfBjRNY jmNqhm1W1a63L8hp81Vkk1Sz50kiYZPQNWYR8x1Lv2tAMaiFiMO2zk3HOESFnQhoQbPA YLcH+4FUXG95sj3FvgYp79+E+syO1dL0Oox1nErx+/72+EMKJqz/hQVrK6OG/lK3x7kH 5BK7I/5PKQIw0LhAOPYLrDsCJWFwr6/EmlBmANYkrI7AKNifgeEQMPDI9LITr1jqHIu9 aKrDJ3dYosMwumA7w3/yiUi/LyqOuGXWYWaZbHI099iJdHOBzNnIsDWIiC4l0Ls9nDxT zKqQ== X-Forwarded-Encrypted: i=1; AHgh+Rqq7bUGAkurtUJiaOpHeo8451HDemiLebL1+CN9JQi0Zck0fkT+NBjr9itmeCyI+IOf/ywK2JYXT21yb+8=@vger.kernel.org X-Gm-Message-State: AOJu0YzyGilCXGDoCJsbr1usse2R1cQ8ca3VniiilIel0Es/8EdNDAqh h6WqZ/ewrDcksqqx06x1PBJpyZVdVHbWsja8IgBc2kShPkEkGSKwIrkS5UMF44SPUCJH9UHqAQe gp4eh1g== X-Gm-Gg: AfdE7cna+ZbIgL+dQ1RCValBQZsy+DaaR3YKaJygM0OFbHjxIND0oAEZzKjzzD+mMnG nD+yNPQOYUUyBGjA8vztxtnQNnsMVIupyBksVyNUIFF9DAc2CWFCVdrovF7mkPZyNfCzE5ljNsS GO59Gyf3mtPQgKcwedkMfkTlYMGGTEza+91eEohtougq7lxna1R/df8vQqXa6N3Zpzg/9mDwuT3 47h5AZnkzpFL90BY3ct/uDZ52YtbJccmzQs02QwArjTPVThhRWtLwA1LgBWncKCMrIsGWTgW9N+ EZ3dOhgum0/g8W+QG0VjW0+5Dejnu3fIiBEFWqdFoNu6OlkQGSLTLz8EaFuKEJjBtREPIHXcqBc P2QCxhXBvy+UK2ykS6kKuepa3ZrVOo1sFAtz4G4veWn58CeJ4I1foUXRT98gBwyFBdmvDDnHmDg == X-Received: by 2002:a17:90b:1c88:b0:38d:b36e:9824 with SMTP id 98e67ed59e1d1-38dc7736eb2mr3773848a91.20.1783811253273; Sat, 11 Jul 2026 16:07:33 -0700 (PDT) Received: from p1.. ([2607:fb90:ecae:8611:d369:525c:ef37:7318]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38a583a16c2sm4447555a91.13.2026.07.11.16.07.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 11 Jul 2026 16:07:32 -0700 (PDT) From: Xiang Mei To: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Dave Airlie , Zhao Yakui , Weiming Shi , Xiang Mei Subject: [PATCH] drm/modes: reject out-of-range GTF blanking duty cycle Date: Sat, 11 Jul 2026 16:07:28 -0700 Message-ID: <20260711230728.2250485-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" drm_gtf_mode_complex() derives the blanking duty cycle from the GTF C/M/K/J coefficients and divides by its complement: ideal_duty_cycle =3D GTF_C_PRIME * 1000 - (GTF_M_PRIME * 1000000 / hfreq_est); hblank =3D total_active_pixels * ideal_duty_cycle / (100000 - ideal_duty_cycle); ideal_duty_cycle is an unsigned per-mille percentage that must stay below 100000, but nothing enforces it. Via drm_gtf2_mode() the coefficients come straight from an EDID secondary-GTF range descriptor, so a crafted monitor (or an edid_override re-probed with DRM_IOCTL_MODE_GETCONNECTOR) can set ideal_duty_cycle to exactly 100000, making the divisor 0 and trapping with a divide error; a larger value wraps the unsigned subtraction and yields a garbage modeline. Reject a duty cycle of 100% or more, which is never a valid GTF result. drm_gtf2_mode() and the inferred-mode helpers already handle a NULL return. Crash: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:drm_gtf_mode_complex (drivers/gpu/drm/drm_modes.c:972) Call Trace: drm_gtf2_mode (drivers/gpu/drm/drm_edid.c:3365) drm_mode_std (drivers/gpu/drm/drm_edid.c:3464) _drm_edid_connector_add_modes.part.0 (drivers/gpu/drm/drm_edid.c:4024) drm_edid_connector_add_modes (drivers/gpu/drm/drm_edid.c:7020) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:575) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helpe= r.c:426) drm_mode_getconnector (drivers/gpu/drm/drm_connector.c:3376) ... __x64_sys_ioctl (fs/ioctl.c:597) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception Fixes: 26bbdadad356 ("drm/mode: add the GTF algorithm in kernel space") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei --- drivers/gpu/drm/drm_modes.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c index 3f8e025fd6d9..b6f263e9ba86 100644 --- a/drivers/gpu/drm/drm_modes.c +++ b/drivers/gpu/drm/drm_modes.c @@ -966,6 +966,10 @@ drm_gtf_mode_complex(struct drm_device *dev, int hdisp= lay, int vdisplay, /* 18.Find the ideal blanking duty cycle from blanking duty cycle */ ideal_duty_cycle =3D GTF_C_PRIME * 1000 - (GTF_M_PRIME * 1000000 / hfreq_est); + if (ideal_duty_cycle >=3D 100000) { + drm_mode_destroy(dev, drm_mode); + return NULL; + } /* 19.Find the number of pixels in the blanking time to the nearest * double character cell: */ hblank =3D total_active_pixels * ideal_duty_cycle / --=20 2.43.0