Merge tag 'sunxi-clocks-for-4.4' of https://git.kernel.org/pub/scm/linux/kernel/git...

[linux.git] / drivers / gpu / drm / amd / amdgpu / amdgpu_gem.c

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index 2f39fea10bd1f881a8b8c6ee167405dc6c1fdb8e..7297ca3a0ba795d37bd7f294705411611e2cf2ef 100644 (file)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -427,6 +427,10 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data,
                                           &args->data.data_size_bytes,
                                           &args->data.flags);
        } else if (args->op == AMDGPU_GEM_METADATA_OP_SET_METADATA) {
+               if (args->data.data_size_bytes > sizeof(args->data.data)) {
+                       r = -EINVAL;
+                       goto unreserve;
+               }
                r = amdgpu_bo_set_tiling_flags(robj, args->data.tiling_info);
                if (!r)
                        r = amdgpu_bo_set_metadata(robj, args->data.data,
@@ -434,6 +438,7 @@ int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data,
                                                   args->data.flags);
        }
 
+unreserve:
        amdgpu_bo_unreserve(robj);
 out:
        drm_gem_object_unreference_unlocked(gobj);
@@ -654,7 +659,7 @@ int amdgpu_mode_dumb_create(struct drm_file *file_priv,
        int r;
 
        args->pitch = amdgpu_align_pitch(adev, args->width, args->bpp, 0) * ((args->bpp + 1) / 8);
-       args->size = args->pitch * args->height;
+       args->size = (u64)args->pitch * args->height;
        args->size = ALIGN(args->size, PAGE_SIZE);
 
        r = amdgpu_gem_object_create(adev, args->size, 0,