Check for zero in drm_calloc() to prevent divide-by-zero. Also rearrange

the two calls to drm_calloc() that had nmemb and size the wrong way
around.

diff --git a/sys/dev/pci/drm/drm_drawable.c b/sys/dev/pci/drm/drm_drawable.c
index 2c963d6..06225dc 100644 (file)
--- a/sys/dev/pci/drm/drm_drawable.c
+++ b/sys/dev/pci/drm/drm_drawable.c
@@ -154,8 +154,8 @@ drm_update_draw(struct drm_device *dev, void *data, struct drm_file *file_priv)
                        return 0;
                }
                if (info->rects == NULL) {
-                       info->rects = drm_calloc(sizeof(*info->rects),
-                           update->num, DRM_MEM_DRAWABLE);
+                       info->rects = drm_calloc(update->num,
+                           sizeof(*info->rects), DRM_MEM_DRAWABLE);
                        if (info->rects == NULL) {
                                DRM_SPINUNLOCK(&dev->drw_lock);
                                return ENOMEM;

diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c
index b613d27..769b853 100644 (file)
--- a/sys/dev/pci/drm/drm_memory.c
+++ b/sys/dev/pci/drm/drm_memory.c
@@ -57,7 +57,7 @@ drm_alloc(size_t size, int area)
 void *
 drm_calloc(size_t nmemb, size_t size, int area)
 {
-       if (SIZE_MAX / nmemb < size)
+       if (nmemb == 0 || SIZE_MAX / nmemb < size)
                return (NULL);
        else
                return malloc(size * nmemb, M_DRM, M_NOWAIT | M_ZERO);

diff --git a/sys/dev/pci/drm/drm_scatter.c b/sys/dev/pci/drm/drm_scatter.c
index 6cccbee..d0a2c02 100644 (file)
--- a/sys/dev/pci/drm/drm_scatter.c
+++ b/sys/dev/pci/drm/drm_scatter.c
@@ -152,7 +152,7 @@ drm_sg_dmamem_alloc(struct drm_device *dev, size_t pages)
        if (dsd == NULL)
                return (NULL);
 
-       dsd->sg_segs = drm_calloc(sizeof(*dsd->sg_segs), pages,
+       dsd->sg_segs = drm_calloc(pages, sizeof(*dsd->sg_segs),
            DRM_MEM_SGLISTS);
        if (dsd->sg_segs == NULL)
                goto dsdfree;