1 files changed, 18 insertions, 5 deletions

diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 5ab15e643be7..84fa91392a8c 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -1,6 +1,6 @@
 /*======================================================================
 
-  $Id: slram.c,v 1.33 2005/01/05 18:05:13 dwmw2 Exp $
+  $Id: slram.c,v 1.34 2005/01/06 21:16:42 jwboyer Exp $
 
   This driver provides a method to access memory not used by the kernel
   itself (i.e. if the kernel commandline mem=xxx is used). To actually
@@ -50,6 +50,7 @@
 #include <linux/mtd/mtd.h>
 
 #define SLRAM_MAX_DEVICES_PARAMS 6              /* 3 parameters / device */
+#define SLRAM_BLK_SZ 0x4000
 
 #define T(fmt, args...) printk(KERN_DEBUG fmt, ## args)
 #define E(fmt, args...) printk(KERN_NOTICE fmt, ## args)
@@ -108,6 +109,9 @@ static int slram_point(struct mtd_info *mtd, loff_t from, size_t len,
 {
         slram_priv_t *priv = mtd->priv;
 
+        if (from + len > mtd->size)
+                return -EINVAL;
+
         *mtdbuf = priv->start + from;
         *retlen = len;
         return(0);
@@ -121,7 +125,13 @@ static int slram_read(struct mtd_info *mtd, loff_t from, size_t len,
                 size_t *retlen, u_char *buf)
 {
         slram_priv_t *priv = mtd->priv;
-        
+
+        if (from > mtd->size)
+                return -EINVAL;
+
+        if (from + len > mtd->size)
+                len = mtd->size - from;
+
         memcpy(buf, priv->start + from, len);
 
         *retlen = len;
@@ -133,6 +143,9 @@ static int slram_write(struct mtd_info *mtd, loff_t to, size_t len,
 {
         slram_priv_t *priv = mtd->priv;
 
+        if (to + len > mtd->size)
+                return -EINVAL;
+
         memcpy(priv->start + to, buf, len);
 
         *retlen = len;
@@ -188,7 +201,7 @@ static int register_device(char *name, unsigned long start, unsigned long length
         (*curmtd)->mtdinfo->name = name;
         (*curmtd)->mtdinfo->size = length;
         (*curmtd)->mtdinfo->flags = MTD_CLEAR_BITS | MTD_SET_BITS |
-                                        MTD_WRITEB_WRITEABLE | MTD_VOLATILE;
+                                        MTD_WRITEB_WRITEABLE | MTD_VOLATILE | MTD_CAP_RAM;
         (*curmtd)->mtdinfo->erase = slram_erase;
         (*curmtd)->mtdinfo->point = slram_point;
         (*curmtd)->mtdinfo->unpoint = slram_unpoint;
@@ -196,7 +209,7 @@ static int register_device(char *name, unsigned long start, unsigned long length
         (*curmtd)->mtdinfo->write = slram_write;
         (*curmtd)->mtdinfo->owner = THIS_MODULE;
         (*curmtd)->mtdinfo->type = MTD_RAM;
-        (*curmtd)->mtdinfo->erasesize = 0x0;
+        (*curmtd)->mtdinfo->erasesize = SLRAM_BLK_SZ;
 
         if (add_mtd_device((*curmtd)->mtdinfo)) {
                 E("slram: Failed to register new device\n");
@@ -261,7 +274,7 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
         }
         T("slram: devname=%s, devstart=0x%lx, devlength=0x%lx\n",
                         devname, devstart, devlength);
-        if ((devstart < 0) || (devlength < 0)) {
+        if ((devstart < 0) || (devlength < 0) || (devlength % SLRAM_BLK_SZ != 0)) {
                 E("slram: Illegal start / length parameter.\n");
                 return(-EINVAL);
         }