diff options
| author | Sean Paul <seanpaul@chromium.org> | 2018-03-30 18:35:45 +0200 |
|---|---|---|
| committer | Sean Paul <seanpaul@chromium.org> | 2018-03-30 18:35:45 +0200 |
| commit | 83fd26c3f32afe38bb2ab8cc00e313ec5c2edbce (patch) | |
| tree | b2d2719c998bc2bcba99f2ecf2d164ee9b7ad75a /drivers/gpu/drm/udl | |
| parent | drm/i915: Make force_load_detect effective even w/ DMI quirks/hotplug (diff) | |
| parent | Merge branch 'drm-misc-next-fixes' of git://anongit.freedesktop.org/drm/drm-m... (diff) | |
| download | linux-83fd26c3f32afe38bb2ab8cc00e313ec5c2edbce.tar.xz linux-83fd26c3f32afe38bb2ab8cc00e313ec5c2edbce.zip | |
Merge airlied/drm-next into drm-misc-next
Backmerging to pick up a fix from drm-misc-next-fixes.
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Diffstat (limited to 'drivers/gpu/drm/udl')
| -rw-r--r-- | drivers/gpu/drm/udl/udl_fb.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c index b5b335c9b2bb..2ebdc6d5a76e 100644 --- a/drivers/gpu/drm/udl/udl_fb.c +++ b/drivers/gpu/drm/udl/udl_fb.c @@ -159,10 +159,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) { unsigned long start = vma->vm_start; unsigned long size = vma->vm_end - vma->vm_start; - unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; + unsigned long offset; unsigned long page, pos; - if (offset + size > info->fix.smem_len) + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + + offset = vma->vm_pgoff << PAGE_SHIFT; + + if (offset > info->fix.smem_len || size > info->fix.smem_len - offset) return -EINVAL; pos = (unsigned long)info->fix.smem_start + offset; |