Merge branch 'wip-2.6.34' into old-private-masterarchived-private-master

1 files changed, 2 insertions, 1 deletions

diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c
index d120cd8d7267..4b96296af321 100644
--- a/drivers/mtd/nand/fsl_upm.c
+++ b/drivers/mtd/nand/fsl_upm.c
@@ -21,6 +21,7 @@
 #include <linux/of_platform.h>
 #include <linux/of_gpio.h>
 #include <linux/io.h>
+#include <linux/slab.h>
 #include <asm/fsl_lbc.h>
 
 #define FSL_UPM_WAIT_RUN_PATTERN  0x1
@@ -112,7 +113,7 @@ static void fun_select_chip(struct mtd_info *mtd, int mchip_nr)
 
         if (mchip_nr == -1) {
                 chip->cmd_ctrl(mtd, NAND_CMD_NONE, 0 | NAND_CTRL_CHANGE);
-        } else if (mchip_nr >= 0) {
+        } else if (mchip_nr >= 0 && mchip_nr < NAND_MAX_CHIPS) {
                 fun->mchip_number = mchip_nr;
                 chip->IO_ADDR_R = fun->io_base + fun->mchip_offsets[mchip_nr];
                 chip->IO_ADDR_W = chip->IO_ADDR_R;