1 files changed, 10 insertions, 6 deletions

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 51fe1795d5a8..d2efe823c20d 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -381,7 +381,13 @@ static int uio_get_minor(struct uio_device *idev)
                         retval = -ENOMEM;
                 goto exit;
         }
-        idev->minor = id & MAX_ID_MASK;
+        if (id < UIO_MAX_DEVICES) {
+                idev->minor = id;
+        } else {
+                dev_err(idev->dev, "too many uio devices\n");
+                retval = -EINVAL;
+                idr_remove(&uio_idr, id);
+        }
 exit:
         mutex_unlock(&minor_lock);
         return retval;
@@ -587,14 +593,12 @@ static ssize_t uio_write(struct file *filep, const char __user *buf,
 
 static int uio_find_mem_index(struct vm_area_struct *vma)
 {
-        int mi;
         struct uio_device *idev = vma->vm_private_data;
 
-        for (mi = 0; mi < MAX_UIO_MAPS; mi++) {
-                if (idev->info->mem[mi].size == 0)
+        if (vma->vm_pgoff < MAX_UIO_MAPS) {
+                if (idev->info->mem[vma->vm_pgoff].size == 0)
                         return -1;
-                if (vma->vm_pgoff == mi)
-                        return mi;
+                return (int)vma->vm_pgoff;
         }
         return -1;
 }