summaryrefslogtreecommitdiff
path: root/drivers/video/udlfb.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/video/udlfb.c')
-rw-r--r--drivers/video/udlfb.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
index 86d449ea3169..ec03e726c940 100644
--- a/drivers/video/udlfb.c
+++ b/drivers/video/udlfb.c
@@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len)
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+ if (size > info->fix.smem_len)
+ return -EINVAL;
+ if (offset > info->fix.smem_len - size)
return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset;