--- aecfa65a2bf90eacf65514b22c41ea556f6ee08b +++ ca72218099d3afe35e5f841a6f8006c4b843aafa @@ -137,7 +137,7 @@ struct dentry *msm_fb_debugfs_file[MSM_F static int bl_scale, bl_min_lvl; DEFINE_MUTEX(msm_fb_notify_update_sem); -DEFINE_MUTEX(power_state_chagne); +static DEFINE_MUTEX(power_state_chagne); void msmfb_no_update_notify_timer_cb(unsigned long data) { @@ -1111,22 +1111,14 @@ static int msm_fb_mmap(struct fb_info *i u32 len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len); unsigned long off = vma->vm_pgoff << PAGE_SHIFT; struct msm_fb_data_type *mfd = (struct msm_fb_data_type *)info->par; + + if ((vma->vm_end <= vma->vm_start) || (off >= len) || + ((vma->vm_end - vma->vm_start) > (len - off))) + return -EINVAL; msm_fb_pan_idle(mfd); - if (off >= len) { - /* memory mapped io */ - off -= len; - if (info->var.accel_flags) { - mutex_unlock(&info->lock); - return -EINVAL; - } - start = info->fix.mmio_start; - len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len); - } /* Set VM flags. */ start &= PAGE_MASK; - if ((vma->vm_end - vma->vm_start + off) > len) - return -EINVAL; off += start; vma->vm_pgoff = off >> PAGE_SHIFT; /* This is an IO map - tell maydump to skip this VMA */ @@ -1380,9 +1372,7 @@ static int msm_fb_register(struct msm_fb var->xres = panel_info->xres; var->yres = panel_info->yres; - -#if defined (CONFIG_FB_MSM_MIPI_SAMSUNG_OCTA_VIDEO_FULL_HD_PT) \ - || defined (CONFIG_FB_MSM_MIPI_RENESAS_TFT_VIDEO_FULL_HD_PT_PANEL) +#ifdef CONFIG_FB_MSM_MIPI_SAMSUNG_OCTA_VIDEO_FULL_HD_PT var->height = panel_info->height; /* height of picture in mm*/ var->width = panel_info->width; /* width of picture in mm*/ #else