[Intel-gfx] [PATCH 1/3] drm/i915: add SNB and IVB video sprite support v2

[Lan, Hai]

> +	/*
> +	 * We can take a larger source and scale it down, but
> +	 * only so much...  16x is the max on SNB.
> +	 */
> +	if (((src_w * src_h) / (crtc_w * crtc_h)) > intel_plane->max_downscale)
> +		return -EINVAL;
> +
[Lan, Hai] if crtc_w or crtc_h = 0, the drm driver will crash. 


From 778327daa3451f3c5f41c5db8bdccdcbf484267b Mon Sep 17 00:00:00 2001
From: Hai Lan <hai.lan at intel.com>
Date: Fri, 4 Nov 2011 18:08:11 +0800
Subject: [PATCH] drm/i915:fix the overflow for overlay when crtc_w or crtc_h =0

When the crtc_w = 0 or crtc_h = 0, it should not be divided.
Besides, when (crtc_x+<crtc_w)<0 or (crtc_y+crtc_h)<0, it should be handled.

Signed-off-by: Hai Lan <hai.lan at intel.com>
---
 drivers/gpu/drm/i915/intel_sprite.c |   14 +++++++++++---
 1 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 0891bda..d62e8ca 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -268,17 +268,23 @@ intel_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
 	 * try to scale the source if part of the visible region is offscreen.
 	 * The caller must handle that by adjusting source offset and size.
 	 */
-	if (crtc_x < 0) {
+	if ((crtc_x < 0) && ((crtc_x + crtc_w)>0)) {
 		crtc_w += crtc_x;
 		crtc_x = 0;
 	}
+	if ((crtc_x + crtc_w)<0) {
+		return -EINVAL;
+	}
 	if (crtc_x + crtc_w > primary_w)
 		crtc_w = primary_w - crtc_x;
 
-	if (crtc_y < 0) {
+	if ((crtc_y < 0) && ((crtc_y+crtc_h)>0)) {
 		crtc_h += crtc_y;
 		crtc_y = 0;
 	}
+	if ((crtc_y+crtc_h)<0) {
+		return -EINVAL;
+	}
 	if (crtc_y + crtc_h > primary_h)
 		crtc_h = primary_h - crtc_y;
 
@@ -286,7 +292,9 @@ intel_update_plane(struct drm_plane *plane, struct drm_crtc *crtc,
 	 * We can take a larger source and scale it down, but
 	 * only so much...  16x is the max on SNB.
 	 */
-	if (((src_w * src_h) / (crtc_w * crtc_h)) > intel_plane->max_downscale)
+	if (crtc_w == 0 || crtc_h == 0)
+		return -EINVAL;
+	else if (((src_w * src_h) / (crtc_w * crtc_h)) > intel_plane->max_downscale)
 		return -EINVAL;
 
 	/*
-- 
1.7.4.1