diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2018-05-19 13:55:40 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2018-05-19 13:55:40 +0200 |
| commit | b563ea676a46f3a297b1e64b6ece25b934aafba5 (patch) | |
| tree | 7b18cca93a853b253375d0a3f1cb5af242771768 /drivers/gpu/drm/drm_dumb_buffers.c | |
| parent | 4fe581d7f114d56f31f392448477cff5a4394065 (diff) | |
| parent | 73fcb1a370c76b202d406e95d9dabb76eaccf484 (diff) | |
Merge branch 'linus' into timers/2038
Merge upstream to pick up changes on which pending patches depend on.
Diffstat (limited to 'drivers/gpu/drm/drm_dumb_buffers.c')
| -rw-r--r-- | drivers/gpu/drm/drm_dumb_buffers.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c index 39ac15ce4702..9e2ae02f31e0 100644 --- a/drivers/gpu/drm/drm_dumb_buffers.c +++ b/drivers/gpu/drm/drm_dumb_buffers.c @@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, return -EINVAL; /* overflow checks for 32bit size calculations */ - /* NOTE: DIV_ROUND_UP() can overflow */ + if (args->bpp > U32_MAX - 8) + return -EINVAL; cpp = DIV_ROUND_UP(args->bpp, 8); - if (!cpp || cpp > 0xffffffffU / args->width) + if (cpp > U32_MAX / args->width) return -EINVAL; stride = cpp * args->width; - if (args->height > 0xffffffffU / stride) + if (args->height > U32_MAX / stride) return -EINVAL; /* test for wrap-around */ |