diff options
Diffstat (limited to 'drivers/gpu/drm/drm_crtc.c')
-rw-r--r-- | drivers/gpu/drm/drm_crtc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index fa2be249999c..90e773019eac 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c | |||
@@ -4696,8 +4696,9 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, | |||
4696 | return -EINVAL; | 4696 | return -EINVAL; |
4697 | 4697 | ||
4698 | /* overflow checks for 32bit size calculations */ | 4698 | /* overflow checks for 32bit size calculations */ |
4699 | /* NOTE: DIV_ROUND_UP() can overflow */ | ||
4699 | cpp = DIV_ROUND_UP(args->bpp, 8); | 4700 | cpp = DIV_ROUND_UP(args->bpp, 8); |
4700 | if (cpp > 0xffffffffU / args->width) | 4701 | if (!cpp || cpp > 0xffffffffU / args->width) |
4701 | return -EINVAL; | 4702 | return -EINVAL; |
4702 | stride = cpp * args->width; | 4703 | stride = cpp * args->width; |
4703 | if (args->height > 0xffffffffU / stride) | 4704 | if (args->height > 0xffffffffU / stride) |