1 files changed, 3 insertions, 0 deletions

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 1d981a5c1b13..5895de7018d4 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -546,6 +546,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
                 if (get_user(ur_idx, &(ur->regionindex)))
                         return -EFAULT;
 
+                if (ur_idx >= mtd->numeraseregions)
+                        return -EINVAL;
+
                 kr = &(mtd->eraseregions[ur_idx]);
 
                 if (put_user(kr->offset, &(ur->offset))