From mboxrd@z Thu Jan 1 00:00:00 1970 From: Gerd Hoffmann Subject: [PATCH v3 23/23] drm/qxl: add overflow checks to qxl_mode_dumb_create() Date: Fri, 18 Jan 2019 13:20:20 +0100 Message-ID: <20190118122020.27596-24-kraxel@redhat.com> References: <20190118122020.27596-1-kraxel@redhat.com> Return-path: In-Reply-To: <20190118122020.27596-1-kraxel@redhat.com> Sender: linux-kernel-owner@vger.kernel.org To: dri-devel@lists.freedesktop.org Cc: Gerd Hoffmann , Dave Airlie , David Airlie , Daniel Vetter , "open list:DRM DRIVER FOR QXL VIRTUAL GPU" , "open list:DRM DRIVER FOR QXL VIRTUAL GPU" , open list List-Id: dri-devel@lists.freedesktop.org Signed-off-by: Gerd Hoffmann --- drivers/gpu/drm/qxl/qxl_dumb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c index 272d19b677..bed6d06ee4 100644 --- a/drivers/gpu/drm/qxl/qxl_dumb.c +++ b/drivers/gpu/drm/qxl/qxl_dumb.c @@ -37,11 +37,13 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, uint32_t handle; int r; struct qxl_surface surf; - uint32_t pitch, format; + uint32_t pitch, size, format; - pitch = args->width * ((args->bpp + 1) / 8); - args->size = pitch * args->height; - args->size = ALIGN(args->size, PAGE_SIZE); + if (check_mul_overflow(args->width, ((args->bpp + 1) / 8), &pitch)) + return -EINVAL; + if (check_mul_overflow(pitch, args->height, &size)) + return -EINVAL; + args->size = ALIGN(size, PAGE_SIZE); switch (args->bpp) { case 16: -- 2.9.3