--- drivers/video/msm/msm_fb.c

+++ drivers/video/msm/msm_fb.c

@@ -137,7 +137,7 @@ struct dentry *msm_fb_debugfs_file[MSM_F

static int bl_scale, bl_min_lvl;

DEFINE_MUTEX(msm_fb_notify_update_sem);

-DEFINE_MUTEX(power_state_chagne);

+static DEFINE_MUTEX(power_state_chagne);

void msmfb_no_update_notify_timer_cb(unsigned long data)

{

@@ -1111,22 +1111,14 @@ static int msm_fb_mmap(struct fb_info *i

u32 len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len);

unsigned long off = vma->vm_pgoff << PAGE_SHIFT;

struct msm_fb_data_type *mfd = (struct msm_fb_data_type *)info->par;

+

+ if ((vma->vm_end <= vma->vm_start) || (off >= len) ||

+ ((vma->vm_end - vma->vm_start) > (len - off)))

+ return -EINVAL;

msm_fb_pan_idle(mfd);

- if (off >= len) {

- /* memory mapped io */

- off -= len;

- if (info->var.accel_flags) {

- mutex_unlock(&info->lock);

- return -EINVAL;

- }

- start = info->fix.mmio_start;

- len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);

- }

/* Set VM flags. */

start &= PAGE_MASK;

- if ((vma->vm_end - vma->vm_start + off) > len)

- return -EINVAL;

off += start;

vma->vm_pgoff = off >> PAGE_SHIFT;

/* This is an IO map - tell maydump to skip this VMA */

@@ -1380,9 +1372,7 @@ static int msm_fb_register(struct msm_fb

var->xres = panel_info->xres;

var->yres = panel_info->yres;

-

-#if defined (CONFIG_FB_MSM_MIPI_SAMSUNG_OCTA_VIDEO_FULL_HD_PT) \

- || defined (CONFIG_FB_MSM_MIPI_RENESAS_TFT_VIDEO_FULL_HD_PT_PANEL)

+#ifdef CONFIG_FB_MSM_MIPI_SAMSUNG_OCTA_VIDEO_FULL_HD_PT

var->height = panel_info->height; /* height of picture in mm*/

var->width = panel_info->width; /* width of picture in mm*/

#else