[PATCH] fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[PATCH] fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Greg Kroah-Hartman]

Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide
by zero error"), we also need to prevent that same crash from happening
in the udlfb driver as it uses pixclock directly when dividing, which
will crash.

Cc: Bernie Thompson <bernie@plugable.com>
Cc: Helge Deller <deller@gmx.de>
Fixes: 59277b679f8b ("Staging: udlfb: add dynamic modeset support")
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/udlfb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 3c6a9b5758d9..c341d76bc564 100644
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1018,6 +1018,9 @@ static int dlfb_ops_check_var(struct fb_var_screeninfo *var,
 	struct fb_videomode mode;
 	struct dlfb_data *dlfb = info->par;
 
+	if (!var->pixclock)
+		return -EINVAL;
+
 	/* set device-specific elements of var unrelated to mode */
 	dlfb_var_color_format(var);
 
-- 
2.53.0

Re: [PATCH] fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Helge Deller]

On 4/9/26 15:23, Greg Kroah-Hartman wrote:
> Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide
> by zero error"), we also need to prevent that same crash from happening
> in the udlfb driver as it uses pixclock directly when dividing, which
> will crash.
> 
> Cc: Bernie Thompson <bernie@plugable.com>
> Cc: Helge Deller <deller@gmx.de>
> Fixes: 59277b679f8b ("Staging: udlfb: add dynamic modeset support")
> Assisted-by: gregkh_clanker_t1000
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>   drivers/video/fbdev/udlfb.c | 3 +++
>   1 file changed, 3 insertions(+)applied.

applied.

Thanks!
Helge

Claude review: fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Claude Code Review Bot]

Overall Series Review

Subject: fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Patches: 2
Reviewed: 2026-04-12T11:08:13.381342

---

This is a single-patch series from Greg Kroah-Hartman that adds a divide-by-zero guard in the udlfb framebuffer driver's `check_var` callback. The fix is straightforward, correct, and follows an established pattern already applied to other fbdev drivers (e.g., `pm2fb` in commit 19f953e74356). The divide-by-zero can be triggered from userspace via the `FBIOPUT_VSCREENINFO` ioctl, which passes a user-controlled `fb_var_screeninfo` into the driver. The patch is minimal, well-placed, and appropriate for stable backporting.

**Verdict: Looks good.**

---
Generated by Claude Code Patch Reviewer

Claude review: fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

[Claude Code Review Bot]

Patch Review

**Issue being fixed:** In `dlfb_set_video_mode()` at line 271 of `udlfb.c`, the driver computes:
```c
200*1000*1000/var->pixclock
```
If `var->pixclock` is zero, this is a divide-by-zero crash. The `var` struct originates from userspace via `FBIOPUT_VSCREENINFO`, so a malicious or buggy application can trigger this. The fbdev core calls `check_var` before `set_par`, so validating in `dlfb_ops_check_var()` is the correct place to catch it early.

**The fix:**
```c
+	if (!var->pixclock)
+		return -EINVAL;
```

This is placed at the top of `dlfb_ops_check_var()`, before `dlfb_var_color_format(var)` and `fb_var_to_videomode()`. This is correct — there's no reason to proceed with any mode validation if pixclock is zero, since the mode would be unusable regardless.

**Minor observations:**

1. The placement before `dlfb_var_color_format()` is fine — that function only touches color fields, not pixclock — but placing it first is slightly more defensive and avoids unnecessary work on an invalid input. Good choice.

2. There's a second call site for `dlfb_set_video_mode()` at line 1106 (in `dlfb_ops_open()` which re-sets the current mode). That path uses `info->var` which should have already passed through `check_var`, so it's covered. Correct.

3. The `Fixes:` tag pointing to commit 59277b679f8b ("Staging: udlfb: add dynamic modeset support") is appropriate — that's the commit that introduced `dlfb_ops_check_var()` and the division via `dlfb_set_video_mode()`.

4. The `Assisted-by: gregkh_clanker_t1000` tag is a non-standard tag (not in the usual kernel tag vocabulary). This likely indicates AI assistance. There's been ongoing discussion in the kernel community about the appropriate tag for AI-assisted contributions; this may want to follow whatever convention the community settles on, but it's not a blocking issue.

**Verdict: Reviewed-by worthy.** The patch is correct, minimal, and well-targeted. No issues found.

---
Generated by Claude Code Patch Reviewer