diff --git a/sys/dev/drm/radeon/radeon_fb.c b/sys/dev/drm/radeon/radeon_fb.c
--- a/sys/dev/drm/radeon/radeon_fb.c
+++ b/sys/dev/drm/radeon/radeon_fb.c
@@ -151,7 +151,14 @@
 
 	if (rdev->family >= CHIP_R600)
 		height = ALIGN(mode_cmd->height, 8);
-	size = mode_cmd->pitches[0] * height;
+	{
+		u64 _tmp = (u64)mode_cmd->pitches[0] * height;
+		if (_tmp > UINT_MAX) {
+			DRM_ERROR("radeonfb: pitch*height overflow\n");
+			return -EINVAL;
+		}
+		size = (u32)_tmp;
+	}
 	aligned_size = ALIGN(size, PAGE_SIZE);
 	ret = radeon_gem_object_create(rdev, aligned_size, 0,
 				       RADEON_GEM_DOMAIN_VRAM,