diff options
| -rw-r--r-- | drivers/video/fbmem.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c index 8d8eadb64853..372aa1776827 100644 --- a/drivers/video/fbmem.c +++ b/drivers/video/fbmem.c | |||
| @@ -674,13 +674,19 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) | |||
| 674 | total_size = info->fix.smem_len; | 674 | total_size = info->fix.smem_len; |
| 675 | 675 | ||
| 676 | if (p > total_size) | 676 | if (p > total_size) |
| 677 | return 0; | 677 | return -EFBIG; |
| 678 | 678 | ||
| 679 | if (count >= total_size) | 679 | if (count > total_size) { |
| 680 | err = -EFBIG; | ||
| 680 | count = total_size; | 681 | count = total_size; |
| 682 | } | ||
| 683 | |||
| 684 | if (count + p > total_size) { | ||
| 685 | if (!err) | ||
| 686 | err = -ENOSPC; | ||
| 681 | 687 | ||
| 682 | if (count + p > total_size) | ||
| 683 | count = total_size - p; | 688 | count = total_size - p; |
| 689 | } | ||
| 684 | 690 | ||
| 685 | buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, | 691 | buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, |
| 686 | GFP_KERNEL); | 692 | GFP_KERNEL); |
| @@ -722,7 +728,7 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) | |||
| 722 | 728 | ||
| 723 | kfree(buffer); | 729 | kfree(buffer); |
| 724 | 730 | ||
| 725 | return (err) ? err : cnt; | 731 | return (cnt) ? cnt : err; |
| 726 | } | 732 | } |
| 727 | 733 | ||
| 728 | #ifdef CONFIG_KMOD | 734 | #ifdef CONFIG_KMOD |
