Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (34 commits)
  [MIPS] tb0219: Update copyright message.
  [MIPS] MT: Fix bug in multithreaded kernels.
  [MIPS] Alchemy: Remove CONFIG_TS_AU1X00_ADS7846 from defconfigs.
  Author: Ralf Baechle <ralf@linux-mips.org>
  [MIPS] sb1250: Enable GenBus IDE in defconfig.
  [MIPS] vmlinux.ld.S: correctly indent .data section
  [MIPS] c-r3k: Implement flush_cache_range()
  [MIPS] Store sign-extend register values for PTRACE_GETREGS
  [MIPS] Alchemy: Register platform devices
  [MIPS] Add len and addr validation for MAP_FIXED mappings.
  [MIPS] IRIX: Fix off-by-one error in signal compat code.
  [MIPS] time: Replace plat_timer_setup with modern APIs.
  [MIPS] time: Fix cut'n'paste bug in Sibyte clockevent driver.
  [MIPS] time: Make c0_compare_int_usable faster
  [MIPS] time: Fix cevt-r4k.c for 64-bit kernel
  [MIPS] Sibyte: Delete {sb1250,bcm1480}_steal_irq().
  [MIPS] txx9tmr clockevent/clocksource driver
  [MIPS] Add mips_hpt_frequency check to mips_clockevent_init().
  [MIPS] IP32: Fixes after interrupt renumbering.
  [MIPS] IP27: Fix slice logic to work for arbitrary number of slices.
  ...

1 files changed, 7 insertions, 2 deletions

diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index b95fe93dd646..af1bdc897488 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -73,7 +73,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
 
         task_size = STACK_TOP;
 
+        if (len > task_size)
+                return -ENOMEM;
+
         if (flags & MAP_FIXED) {
+                /* Even MAP_FIXED mappings must reside within task_size.  */
+                if (task_size - len < addr)
+                        return -EINVAL;
+
                 /*
                  * We do not accept a shared mapping if it would violate
                  * cache aliasing constraints.
@@ -83,8 +90,6 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
                 return addr;
         }
 
-        if (len > task_size)
-                return -ENOMEM;
         do_color_align = 0;
         if (filp || (flags & MAP_SHARED))
                 do_color_align = 1;