diff options
| author | Mark Brown <broonie@kernel.org> | 2018-01-08 15:54:50 +0000 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2018-01-08 15:54:50 +0000 |
| commit | 498495dba268b20e8eadd7fe93c140c68b6cc9d2 (patch) | |
| tree | 00d1562049d8bc2194fddd9ba0cbbe0812ad6f68 /drivers/char/mem.c | |
| parent | d5cc0a1fcbb5ddbef9fdd4c4a978da3254ddbf37 (diff) | |
| parent | 5c256045b87b8aa8e5bc9d2e2fdc0802351c1f99 (diff) | |
| download | linux-stable-498495dba268b20e8eadd7fe93c140c68b6cc9d2.tar.gz linux-stable-498495dba268b20e8eadd7fe93c140c68b6cc9d2.tar.bz2 linux-stable-498495dba268b20e8eadd7fe93c140c68b6cc9d2.zip | |
Merge branch 'fix/intel' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into asoc-intel
Diffstat (limited to 'drivers/char/mem.c')
| -rw-r--r-- | drivers/char/mem.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/char/mem.c b/drivers/char/mem.c index 593a8818aca9..6aefe5370e5b 100644 --- a/drivers/char/mem.c +++ b/drivers/char/mem.c @@ -1,3 +1,4 @@ +// SPDX-License-Identifier: GPL-2.0 /* * linux/drivers/char/mem.c * @@ -342,6 +343,10 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma) size_t size = vma->vm_end - vma->vm_start; phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT; + /* Does it even fit in phys_addr_t? */ + if (offset >> PAGE_SHIFT != vma->vm_pgoff) + return -EINVAL; + /* It's illegal to wrap around the end of the physical address space. */ if (offset + (phys_addr_t)size - 1 < offset) return -EINVAL; |