diff options
| author | David S. Miller <davem@davemloft.net> | 2014-09-07 21:41:53 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-09-07 21:41:53 -0700 |
| commit | eb84d6b60491a3ca3d90d62ee5346b007770d40d (patch) | |
| tree | 22aadf9ada15e1ae5ba4c400aafab6f2541996e6 /drivers/gpu/drm/drm_crtc.c | |
| parent | 97a13e5289baa96eaddd06e61d277457d837af3a (diff) | |
| parent | d030671f3f261e528dc6e396a13f10859a74ae7c (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Diffstat (limited to 'drivers/gpu/drm/drm_crtc.c')
| -rw-r--r-- | drivers/gpu/drm/drm_crtc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index fa2be249999..90e773019ea 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -4696,8 +4696,9 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, return -EINVAL; /* overflow checks for 32bit size calculations */ + /* NOTE: DIV_ROUND_UP() can overflow */ cpp = DIV_ROUND_UP(args->bpp, 8); - if (cpp > 0xffffffffU / args->width) + if (!cpp || cpp > 0xffffffffU / args->width) return -EINVAL; stride = cpp * args->width; if (args->height > 0xffffffffU / stride) |