[PATCH] fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[PATCH] fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Greg Kroah-Hartman]

Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide
by zero error"), we also need to prevent that same crash from happening
in the udlfb driver as it uses pixclock directly when dividing, which
will crash.

Cc: Helge Deller <deller@gmx.de>
Assisted-by: gregkh_clanker_t1000
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/tdfxfb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/tdfxfb.c b/drivers/video/fbdev/tdfxfb.c
index 51ebe78359ec..531fb8478e20 100644
--- a/drivers/video/fbdev/tdfxfb.c
+++ b/drivers/video/fbdev/tdfxfb.c
@@ -496,6 +496,9 @@ static int tdfxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 		}
 	}
 
+	if (!var->pixclock)
+		return -EINVAL;
+
 	if (PICOS2KHZ(var->pixclock) > par->max_pixclock) {
 		DPRINTK("pixclock too high (%ldKHz)\n",
 			PICOS2KHZ(var->pixclock));
-- 
2.53.0

Re: [PATCH] fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Helge Deller]

On 4/9/26 15:23, Greg Kroah-Hartman wrote:
> Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide
> by zero error"), we also need to prevent that same crash from happening
> in the udlfb driver as it uses pixclock directly when dividing, which
> will crash.
> 
> Cc: Helge Deller <deller@gmx.de>
> Assisted-by: gregkh_clanker_t1000
> Cc: stable <stable@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>   drivers/video/fbdev/tdfxfb.c | 3 +++
>   1 file changed, 3 insertions(+)

applied.

Thanks!
Helge

Claude review: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Claude Code Review Bot]

Overall Series Review

Subject: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Patches: 2
Reviewed: 2026-04-12T11:09:30.726142

---

This is a single patch from Greg Kroah-Hartman that adds a divide-by-zero guard for `pixclock` in the `tdfxfb` driver's `tdfxfb_check_var()` function. The fix itself is correct and straightforward — `PICOS2KHZ(a)` is defined as `1000000000UL/(a)` (in `include/uapi/linux/fb.h:240`), so passing `pixclock == 0` would cause a division by zero. The patch places the check at the right location (before the first use of `PICOS2KHZ(var->pixclock)` at line 499).

There is one notable issue with the commit message.

---
Generated by Claude Code Patch Reviewer

Claude review: fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Claude Code Review Bot]

Patch Review

**Commit message bug — wrong driver name referenced:**

The commit message says:

> we also need to prevent that same crash from happening in the **udlfb** driver as it uses pixclock directly when dividing

But the patch modifies `drivers/video/fbdev/tdfxfb.c`, not `udlfb`. The subject line correctly says `tdfxfb`, but the body references the wrong driver. This is a copy-paste error from what appears to be a templated series fixing the same issue across multiple fbdev drivers. Should be fixed before merging.

**Code change is correct:**

```c
+	if (!var->pixclock)
+		return -EINVAL;
+
 	if (PICOS2KHZ(var->pixclock) > par->max_pixclock) {
```

This is the right fix. The guard is placed immediately before the first `PICOS2KHZ(var->pixclock)` call in `tdfxfb_check_var()`, which would divide by zero. Returning `-EINVAL` is the appropriate error code, consistent with other validation failures in the same function.

**Coverage note:** There is a second use of `PICOS2KHZ(info->var.pixclock)` at line 565 in `tdfxfb_set_par()`, but that call path goes through `tdfxfb_check_var()` first (the fbdev core calls `check_var` before `set_par`), so the guard here protects both sites.

**Minor:** The `Assisted-by: gregkh_clanker_t1000` tag is non-standard — the kernel typically uses `Co-developed-by:` or similar recognized tags. Not a blocking issue but worth noting.

**Verdict:** The fix is correct and appropriate for stable. The commit message should be fixed to say "tdfxfb" instead of "udlfb" before applying.

---
Generated by Claude Code Patch Reviewer