Commit 54ef0b54 authored by Dan Carpenter's avatar Dan Carpenter Committed by Alex Deucher

drm/amdgpu: integer overflow in amdgpu_mode_dumb_create()

args->size is a u64.  arg->pitch and args->height are u32.  The
multiplication will overflow instead of using the high 32 bits as
intended.
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent 0913eab6
...@@ -659,7 +659,7 @@ int amdgpu_mode_dumb_create(struct drm_file *file_priv, ...@@ -659,7 +659,7 @@ int amdgpu_mode_dumb_create(struct drm_file *file_priv,
int r; int r;
args->pitch = amdgpu_align_pitch(adev, args->width, args->bpp, 0) * ((args->bpp + 1) / 8); args->pitch = amdgpu_align_pitch(adev, args->width, args->bpp, 0) * ((args->bpp + 1) / 8);
args->size = args->pitch * args->height; args->size = (u64)args->pitch * args->height;
args->size = ALIGN(args->size, PAGE_SIZE); args->size = ALIGN(args->size, PAGE_SIZE);
r = amdgpu_gem_object_create(adev, args->size, 0, r = amdgpu_gem_object_create(adev, args->size, 0,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment