diff options
| author | Mark Brown <broonie@kernel.org> | 2018-05-22 10:28:38 +0100 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2018-05-22 10:28:38 +0100 |
| commit | e1c51aa8705fd78e5259e0515aad3b5003e18550 (patch) | |
| tree | 3728628142a24460d6b488e5331f421f902e5d3a /drivers/gpu/drm/udl/udl_fb.c | |
| parent | 6e49b7fa3083c30688b7fff1b37ed891cd1c30af (diff) | |
| parent | 08556e03ad36b2c6219aba90de88ccf58038e208 (diff) | |
Merge branch 'linux-linaro-lsk-v4.9' into linux-linaro-lsk-v4.9-rtlinux-linaro-lsk-v4.9-rt-test
Diffstat (limited to 'drivers/gpu/drm/udl/udl_fb.c')
| -rw-r--r-- | drivers/gpu/drm/udl/udl_fb.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c index 611b6b9bb3cb..67ea2ce03a23 100644 --- a/drivers/gpu/drm/udl/udl_fb.c +++ b/drivers/gpu/drm/udl/udl_fb.c @@ -158,10 +158,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) { unsigned long start = vma->vm_start; unsigned long size = vma->vm_end - vma->vm_start; - unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; + unsigned long offset; unsigned long page, pos; - if (offset + size > info->fix.smem_len) + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + + offset = vma->vm_pgoff << PAGE_SHIFT; + + if (offset > info->fix.smem_len || size > info->fix.smem_len - offset) return -EINVAL; pos = (unsigned long)info->fix.smem_start + offset; |