diff options
| author | David S. Miller | 2018-05-21 22:01:54 +0200 |
|---|---|---|
| committer | David S. Miller | 2018-05-21 22:01:54 +0200 |
| commit | 6f6e434aa267a6030477876d89444fe3a6b7a48d (patch) | |
| tree | 67755c422f1e85451aa646eae21d4c6f3f389d9f /drivers/gpu/drm/drm_dumb_buffers.c | |
| parent | vmcore: move get_vmcore_size out of __init (diff) | |
| parent | Merge tag 'mips_fixes_4.17_2' of git://git.kernel.org/pub/scm/linux/kernel/gi... (diff) | |
| download | kernel-qcow2-linux-6f6e434aa267a6030477876d89444fe3a6b7a48d.tar.gz kernel-qcow2-linux-6f6e434aa267a6030477876d89444fe3a6b7a48d.tar.xz kernel-qcow2-linux-6f6e434aa267a6030477876d89444fe3a6b7a48d.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
S390 bpf_jit.S is removed in net-next and had changes in 'net',
since that code isn't used any more take the removal.
TLS data structures split the TX and RX components in 'net-next',
put the new struct members from the bug fix in 'net' into the RX
part.
The 'net-next' tree had some reworking of how the ERSPAN code works in
the GRE tunneling code, overlapping with a one-line headroom
calculation fix in 'net'.
Overlapping changes in __sock_map_ctx_update_elem(), keep the bits
that read the prog members via READ_ONCE() into local variables
before using them.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/gpu/drm/drm_dumb_buffers.c')
| -rw-r--r-- | drivers/gpu/drm/drm_dumb_buffers.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c index 39ac15ce4702..9e2ae02f31e0 100644 --- a/drivers/gpu/drm/drm_dumb_buffers.c +++ b/drivers/gpu/drm/drm_dumb_buffers.c @@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, return -EINVAL; /* overflow checks for 32bit size calculations */ - /* NOTE: DIV_ROUND_UP() can overflow */ + if (args->bpp > U32_MAX - 8) + return -EINVAL; cpp = DIV_ROUND_UP(args->bpp, 8); - if (!cpp || cpp > 0xffffffffU / args->width) + if (cpp > U32_MAX / args->width) return -EINVAL; stride = cpp * args->width; - if (args->height > 0xffffffffU / stride) + if (args->height > U32_MAX / stride) return -EINVAL; /* test for wrap-around */ |