From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Herrmann Subject: [PATCH v2] drm: fix division-by-zero on dumb_create() Date: Thu, 28 Aug 2014 15:50:01 +0200 Message-ID: <1409233801-11928-1-git-send-email-dh.herrmann@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-wg0-f41.google.com (mail-wg0-f41.google.com [74.125.82.41]) by gabe.freedesktop.org (Postfix) with ESMTP id E57486E257 for ; Thu, 28 Aug 2014 06:50:24 -0700 (PDT) Received: by mail-wg0-f41.google.com with SMTP id l18so761784wgh.0 for ; Thu, 28 Aug 2014 06:50:21 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org Cc: Daniel Vetter List-Id: dri-devel@lists.freedesktop.org Kinda unexpected, but DIV_ROUND_UP() can overflow if passed an argument bigger than UINT_MAX - DIVISOR. Fix this by testing for "!cpp" before using it in the following division. Note that DIV_ROUND_UP() is defined as: #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d)) ..this will obviously overflow if (n + d - 1) is bigger than UINT_MAX. Reported-by: Tommi Rantala Signed-off-by: David Herrmann Reviewed-by: Rob Clark --- v2: add comment that DIV_ROUND_UP() might overflow add Rob's r-b drivers/gpu/drm/drm_crtc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index f09b752..61b6978 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -4720,8 +4720,8 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, return -EINVAL; /* overflow checks for 32bit size calculations */ - cpp = DIV_ROUND_UP(args->bpp, 8); - if (cpp > 0xffffffffU / args->width) + cpp = DIV_ROUND_UP(args->bpp, 8); /* might overflow! */ + if (!cpp || cpp > 0xffffffffU / args->width) return -EINVAL; stride = cpp * args->width; if (args->height > 0xffffffffU / stride) -- 2.1.0