1 files changed, 13 insertions, 6 deletions

diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 48788db4e280..e3f5577cbce3 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -708,16 +708,23 @@ static loff_t memory_lseek(struct file * file, loff_t offset, int orig)
 
         mutex_lock(&file->f_path.dentry->d_inode->i_mutex);
         switch (orig) {
-                case 0:
+                case SEEK_CUR:
+                        offset += file->f_pos;
+                        if ((unsigned long long)offset <
+                            (unsigned long long)file->f_pos) {
+                                ret = -EOVERFLOW;
+                                break;
+                        }
+                case SEEK_SET:
+                        /* to avoid userland mistaking f_pos=-9 as -EBADF=-9 */
+                        if ((unsigned long long)offset >= ~0xFFFULL) {
+                                ret = -EOVERFLOW;
+                                break;
+                        }
                         file->f_pos = offset;
                         ret = file->f_pos;
                         force_successful_syscall_return();
                         break;
-                case 1:
-                        file->f_pos += offset;
-                        ret = file->f_pos;
-                        force_successful_syscall_return();
-                        break;
                 default:
                         ret = -EINVAL;
         }