[patch 4/4] drm/qxl: integer overflow in qxl_alloc_surf_ioctl()

[Dan Carpenter]

The size calculation can overflow.

Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>

diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 552dc06..5da9a60 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -401,6 +401,8 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, 
void *data,

        /* work out size allocate bo with handle */
        actual_stride = param->stride < 0 ? -param->stride : param->stride;
+       if (actual_stride > (INT_MAX - actual_stride) / param->height)
+               return -EINVAL;
        size = actual_stride * param->height + actual_stride;

        surf.format = param->format;