diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_gem.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_gem.c index 206ba636efb..928a224b065 100644 --- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_gem.c +++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_gem.c @@ -1194,6 +1194,11 @@ int amdgpu_gem_op_ioctl(struct drm_device *dev, void *data, * If that number is larger than the size of the array, the ioctl must * be retried. */ + if (args->num_entries > INT_MAX / sizeof(*vm_entries)) { + r = -EINVAL; + goto out_exec; + } + vm_entries = kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL); if (!vm_entries) { r = -ENOMEM;