diff options
Diffstat (limited to 'drivers/video/udlfb.c')
| -rw-r--r-- | drivers/video/udlfb.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c index 86d449ea3169..ec03e726c940 100644 --- a/drivers/video/udlfb.c +++ b/drivers/video/udlfb.c @@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma) unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long page, pos; - if (offset + size > info->fix.smem_len) + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + if (size > info->fix.smem_len) + return -EINVAL; + if (offset > info->fix.smem_len - size) return -EINVAL; pos = (unsigned long)info->fix.smem_start + offset; |