---

yaml
---
r: 54942
b: refs/heads/master
c: 38b4982
h: refs/heads/master
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ff388ad05bc67163124ac74126bbc16faa2fb771
+refs/heads/master: 38b4982c6388ae9596f959e3d7fef91affbd181d

trunk/drivers/video/console/fbcon.c

@@ -685,6 +685,17 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
 		fbcon_set_bitops(ops);
 	}
 }
+
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
+{
+	int err = 0;
+
+	if (info->flags & FBINFO_MISC_TILEBLITTING &&
+	    info->tileops->fb_get_tilemax(info) < charcount)
+		err = 1;
+
+	return err;
+}
 #else
 static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
 {
@@ -695,6 +706,12 @@ static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
 	fbcon_set_rotation(info);
 	fbcon_set_bitops(ops);
 }
+
+static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
+{
+	return 0;
+}
+
 #endif /* CONFIG_MISC_TILEBLITTING */
 
 
@@ -2518,6 +2535,10 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne
 	    !(info->pixmap.blit_y & (1 << (font->height - 1))))
 		return -EINVAL;
 
+	/* Make sure driver can handle the font length */
+	if (fbcon_invalid_charcount(info, charcount))
+		return -EINVAL;
+
 	size = h * pitch * charcount;
 
 	new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);