summaryrefslogtreecommitdiffstats
path: root/drivers/virt/fsl_hypervisor.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/virt/fsl_hypervisor.c')
-rw-r--r--drivers/virt/fsl_hypervisor.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
index a41431edbf25..93d5bebf9572 100644
--- a/drivers/virt/fsl_hypervisor.c
+++ b/drivers/virt/fsl_hypervisor.c
@@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
* hypervisor.
*/
lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
+ if (param.count == 0 ||
+ param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
+ return -EINVAL;
num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
/* Allocate the buffers we need */