diff options
Diffstat (limited to 'drivers/gpu/drm/drm_crtc.c')
-rw-r--r-- | drivers/gpu/drm/drm_crtc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index 0acb2de8e66e..ecd4e0b4c525 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c | |||
@@ -4731,8 +4731,9 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, | |||
4731 | return -EINVAL; | 4731 | return -EINVAL; |
4732 | 4732 | ||
4733 | /* overflow checks for 32bit size calculations */ | 4733 | /* overflow checks for 32bit size calculations */ |
4734 | /* NOTE: DIV_ROUND_UP() can overflow */ | ||
4734 | cpp = DIV_ROUND_UP(args->bpp, 8); | 4735 | cpp = DIV_ROUND_UP(args->bpp, 8); |
4735 | if (cpp > 0xffffffffU / args->width) | 4736 | if (!cpp || cpp > 0xffffffffU / args->width) |
4736 | return -EINVAL; | 4737 | return -EINVAL; |
4737 | stride = cpp * args->width; | 4738 | stride = cpp * args->width; |
4738 | if (args->height > 0xffffffffU / stride) | 4739 | if (args->height > 0xffffffffU / stride) |