Merge branch 'misc.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

[linux-2.6-microblaze.git] / drivers / video / fbdev / core / fbmem.c

diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 1c85514..7420d2c 100644 (file)
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -67,7 +67,7 @@ static struct fb_info *get_fb_info(unsigned int idx)
        mutex_lock(&registration_lock);
        fb_info = registered_fb[idx];
        if (fb_info)
-               atomic_inc(&fb_info->count);
+               refcount_inc(&fb_info->count);
        mutex_unlock(&registration_lock);
 
        return fb_info;
@@ -75,7 +75,7 @@ static struct fb_info *get_fb_info(unsigned int idx)
 
 static void put_fb_info(struct fb_info *fb_info)
 {
-       if (!atomic_dec_and_test(&fb_info->count))
+       if (!refcount_dec_and_test(&fb_info->count))
                return;
        if (fb_info->fbops->fb_destroy)
                fb_info->fbops->fb_destroy(fb_info);
@@ -962,6 +962,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
        struct fb_var_screeninfo old_var;
        struct fb_videomode mode;
        struct fb_event event;
+       u32 unused;
 
        if (var->activate & FB_ACTIVATE_INV_MODE) {
                struct fb_videomode mode1, mode2;
@@ -1008,6 +1009,11 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
        if (var->xres < 8 || var->yres < 8)
                return -EINVAL;
 
+       /* Too huge resolution causes multiplication overflow. */
+       if (check_mul_overflow(var->xres, var->yres, &unused) ||
+           check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused))
+               return -EINVAL;
+
        ret = info->fbops->fb_check_var(var, info);
 
        if (ret)
@@ -1592,7 +1598,7 @@ static int do_register_framebuffer(struct fb_info *fb_info)
                if (!registered_fb[i])
                        break;
        fb_info->node = i;
-       atomic_set(&fb_info->count, 1);
+       refcount_set(&fb_info->count, 1);
        mutex_init(&fb_info->lock);
        mutex_init(&fb_info->mm_lock);