1 files changed, 8 insertions, 0 deletions

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index cb72d9675ab1..dafc645b2e4e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -531,6 +531,7 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
         struct drm_gem_object *obj;
         struct amdgpu_framebuffer *amdgpu_fb;
         int ret;
+        int height;
         struct amdgpu_device *adev = dev->dev_private;
         int cpp = drm_format_plane_cpp(mode_cmd->pixel_format, 0);
         int pitch = mode_cmd->pitches[0] / cpp;
@@ -555,6 +556,13 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
                 return ERR_PTR(-EINVAL);
         }
 
+        height = ALIGN(mode_cmd->height, 8);
+        if (obj->size < pitch * height) {
+                DRM_DEBUG_KMS("Invalid GEM size: expecting >= %d but got %zu\n",
+                              pitch * height, obj->size);
+                return ERR_PTR(-EINVAL);
+        }
+
         amdgpu_fb = kzalloc(sizeof(*amdgpu_fb), GFP_KERNEL);
         if (amdgpu_fb == NULL) {
                 drm_gem_object_put_unlocked(obj);