1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
index a41431edbf25..93d5bebf9572 100644
--- a/drivers/virt/fsl_hypervisor.c
+++ b/drivers/virt/fsl_hypervisor.c
@@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
          * hypervisor.
          */
         lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
+        if (param.count == 0 ||
+            param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
+                return -EINVAL;
         num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
         /* Allocate the buffers we need */