diff options
| author | Mark Brown <broonie@kernel.org> | 2014-10-20 17:55:07 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2014-10-20 18:27:32 +0100 |
| commit | b7a40242c82cd73cfcea305f23e67d068dd8401a (patch) | |
| tree | 251b49d19cd7c371847ae1f951e1b537ca0e1c15 /drivers/gpu/drm/drm_crtc.c | |
| parent | d26833bfce5e56017bea9f1f50838f20e18e7b7e (diff) | |
| parent | 9c6de47d53a3ce8df1642ae67823688eb98a190a (diff) | |
Merge branch 'fix/dw' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi into spi-dw
Conflicts:
drivers/spi/spi-dw-mid.c
Diffstat (limited to 'drivers/gpu/drm/drm_crtc.c')
| -rw-r--r-- | drivers/gpu/drm/drm_crtc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index fa2be249999c..90e773019eac 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -4696,8 +4696,9 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, return -EINVAL; /* overflow checks for 32bit size calculations */ + /* NOTE: DIV_ROUND_UP() can overflow */ cpp = DIV_ROUND_UP(args->bpp, 8); - if (cpp > 0xffffffffU / args->width) + if (!cpp || cpp > 0xffffffffU / args->width) return -EINVAL; stride = cpp * args->width; if (args->height > 0xffffffffU / stride) |