summaryrefslogtreecommitdiff
path: root/drivers/gpu/drm/udl
diff options
context:
space:
mode:
authorSean Paul <seanpaul@chromium.org>2018-03-30 19:35:45 +0300
committerSean Paul <seanpaul@chromium.org>2018-03-30 19:35:45 +0300
commit83fd26c3f32afe38bb2ab8cc00e313ec5c2edbce (patch)
treeb2d2719c998bc2bcba99f2ecf2d164ee9b7ad75a /drivers/gpu/drm/udl
parent4165791d29f64e01860a064f3c649447dbac41c3 (diff)
parent694f54f680f7fd8e9561928fbfc537d9afbc3d79 (diff)
downloadlinux-83fd26c3f32afe38bb2ab8cc00e313ec5c2edbce.tar.xz
Merge airlied/drm-next into drm-misc-next
Backmerging to pick up a fix from drm-misc-next-fixes. Signed-off-by: Sean Paul <seanpaul@chromium.org>
Diffstat (limited to 'drivers/gpu/drm/udl')
-rw-r--r--drivers/gpu/drm/udl/udl_fb.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index b5b335c9b2bb..2ebdc6d5a76e 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -159,10 +159,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
{
unsigned long start = vma->vm_start;
unsigned long size = vma->vm_end - vma->vm_start;
- unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+ unsigned long offset;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len)
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+
+ offset = vma->vm_pgoff << PAGE_SHIFT;
+
+ if (offset > info->fix.smem_len || size > info->fix.smem_len - offset)
return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset;