1 files changed, 21 insertions, 0 deletions

diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index c71a88d531cd..6fc3501581d6 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -685,6 +685,17 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
                 fbcon_set_bitops(ops);
         }
 }
+
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
+{
+        int err = 0;
+
+        if (info->flags & FBINFO_MISC_TILEBLITTING &&
+            info->tileops->fb_get_tilemax(info) < charcount)
+                err = 1;
+
+        return err;
+}
 #else
 static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
 {
@@ -695,6 +706,12 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
         fbcon_set_rotation(info);
         fbcon_set_bitops(ops);
 }
+
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
+{
+        return 0;
+}
+
 #endif /* CONFIG_MISC_TILEBLITTING */
 
 
@@ -2518,6 +2535,10 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
             !(info->pixmap.blit_y & (1 << (font->height - 1))))
                 return -EINVAL;
 
+        /* Make sure driver can handle the font length */
+        if (fbcon_invalid_charcount(info, charcount))
+                return -EINVAL;
+
         size = h * pitch * charcount;
 
         new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);