From cef006aef7b8ee73a5296b803a791ba8b2f91277 Mon Sep 17 00:00:00 2001
From: Roel Kluin <roel.kluin@gmail.com>
Date: Mon, 19 Jan 2009 00:15:13 +0100
Subject: [PATCH] --- yaml --- r: 131828 b: refs/heads/master c:
 3afd522de8d8ec446efe957b86e4f63e3dd8ce9d h: refs/heads/master v: v3

---
 [refs]                            |  2 +-
 trunk/drivers/mtd/devices/slram.c | 14 ++++++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/[refs] b/[refs]
index 6606592bd7e4..dc9020279d30 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5f877607cdfe8b60bf96fb96e527e0ce2a21e68b
+refs/heads/master: 3afd522de8d8ec446efe957b86e4f63e3dd8ce9d
diff --git a/trunk/drivers/mtd/devices/slram.c b/trunk/drivers/mtd/devices/slram.c
index a425d09f35a0..00248e81ecd5 100644
--- a/trunk/drivers/mtd/devices/slram.c
+++ b/trunk/drivers/mtd/devices/slram.c
@@ -267,22 +267,28 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
 	if (*(szlength) != '+') {
 		devlength = simple_strtoul(szlength, &buffer, 0);
 		devlength = handle_unit(devlength, buffer) - devstart;
+		if (devlength < devstart)
+			goto err_out;
+
+		devlength -= devstart;
 	} else {
 		devlength = simple_strtoul(szlength + 1, &buffer, 0);
 		devlength = handle_unit(devlength, buffer);
 	}
 	T("slram: devname=%s, devstart=0x%lx, devlength=0x%lx\n",
 			devname, devstart, devlength);
-	if ((devstart < 0) || (devlength < 0) || (devlength % SLRAM_BLK_SZ != 0)) {
-		E("slram: Illegal start / length parameter.\n");
-		return(-EINVAL);
-	}
+	if (devlength % SLRAM_BLK_SZ != 0)
+		goto err_out;
 
 	if ((devstart = register_device(devname, devstart, devlength))){
 		unregister_devices();
 		return((int)devstart);
 	}
 	return(0);
+
+err_out:
+	E("slram: Illegal length parameter.\n");
+	return(-EINVAL);
 }
 
 #ifndef MODULE