aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/video
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/video')
-rw-r--r--drivers/video/fbmem.c14
1 files changed, 10 insertions, 4 deletions
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 8d8eadb64853..372aa1776827 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -674,13 +674,19 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
674 total_size = info->fix.smem_len; 674 total_size = info->fix.smem_len;
675 675
676 if (p > total_size) 676 if (p > total_size)
677 return 0; 677 return -EFBIG;
678 678
679 if (count >= total_size) 679 if (count > total_size) {
680 err = -EFBIG;
680 count = total_size; 681 count = total_size;
682 }
683
684 if (count + p > total_size) {
685 if (!err)
686 err = -ENOSPC;
681 687
682 if (count + p > total_size)
683 count = total_size - p; 688 count = total_size - p;
689 }
684 690
685 buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, 691 buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count,
686 GFP_KERNEL); 692 GFP_KERNEL);
@@ -722,7 +728,7 @@ fb_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
722 728
723 kfree(buffer); 729 kfree(buffer);
724 730
725 return (err) ? err : cnt; 731 return (cnt) ? cnt : err;
726} 732}
727 733
728#ifdef CONFIG_KMOD 734#ifdef CONFIG_KMOD