diff options
| -rw-r--r-- | arch/mips/kernel/linux32.c | 4 | ||||
| -rw-r--r-- | arch/mips/kernel/syscall.c | 5 |
2 files changed, 8 insertions, 1 deletions
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c index 1e8d24823d39..013bc93688e8 100644 --- a/arch/mips/kernel/linux32.c +++ b/arch/mips/kernel/linux32.c @@ -106,6 +106,10 @@ sys32_mmap2(unsigned long addr, unsigned long len, unsigned long prot, unsigned long error; error = -EINVAL; + if (pgoff & (~PAGE_MASK >> 12)) + goto out; + pgoff >>= PAGE_SHIFT-12; + if (!(flags & MAP_ANONYMOUS)) { error = -EBADF; file = fget(fd); diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c index 55f2bc09529c..2aeaa2fd4b32 100644 --- a/arch/mips/kernel/syscall.c +++ b/arch/mips/kernel/syscall.c @@ -162,7 +162,10 @@ asmlinkage unsigned long sys_mmap2(unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, unsigned long fd, unsigned long pgoff) { - return do_mmap2(addr, len, prot, flags, fd, pgoff); + if (pgoff & (~PAGE_MASK >> 12)) + return -EINVAL; + + return do_mmap2(addr, len, prot, flags, fd, pgoff >> (PAGE_SHIFT-12)); } save_static_function(sys_fork); |