2 files changed, 8 insertions, 1 deletions

diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 1e8d24823d39..013bc93688e8 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -106,6 +106,10 @@ sys32_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
         unsigned long error;
 
         error = -EINVAL;
+        if (pgoff & (~PAGE_MASK >> 12))
+                goto out;
+        pgoff >>= PAGE_SHIFT-12;
+
         if (!(flags & MAP_ANONYMOUS)) {
                 error = -EBADF;
                 file = fget(fd);
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 55f2bc09529c..2aeaa2fd4b32 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -162,7 +162,10 @@ asmlinkage unsigned long
 sys_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
           unsigned long flags, unsigned long fd, unsigned long pgoff)
 {
-        return do_mmap2(addr, len, prot, flags, fd, pgoff);
+        if (pgoff & (~PAGE_MASK >> 12))
+                return -EINVAL;
+
+        return do_mmap2(addr, len, prot, flags, fd, pgoff >> (PAGE_SHIFT-12));
 }
 
 save_static_function(sys_fork);