@@ -192,6 +192,8 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
192192
193193 if (var -> xres_virtual != var -> xres || var -> yres_virtual != var -> yres )
194194 return - EINVAL ;
195+ if (var -> xres * var -> yres * (var -> bits_per_pixel >> 3 ) > info -> fix .smem_len )
196+ return - EINVAL ;
195197 if (var -> nonstd )
196198 return - EINVAL ;
197199 if (1000000000 / var -> pixclock > TGA_PLL_MAX_FREQ )
@@ -272,6 +274,7 @@ tgafb_set_par(struct fb_info *info)
272274 par -> yres = info -> var .yres ;
273275 par -> pll_freq = pll_freq = 1000000000 / info -> var .pixclock ;
274276 par -> bits_per_pixel = info -> var .bits_per_pixel ;
277+ info -> fix .line_length = par -> xres * (par -> bits_per_pixel >> 3 );
275278
276279 tga_type = par -> tga_type ;
277280
@@ -1318,28 +1321,33 @@ tgafb_init_fix(struct fb_info *info)
13181321 int tga_bus_tc = TGA_BUS_TC (par -> dev );
13191322 u8 tga_type = par -> tga_type ;
13201323 const char * tga_type_name = NULL ;
1324+ unsigned memory_size ;
13211325
13221326 switch (tga_type ) {
13231327 case TGA_TYPE_8PLANE :
13241328 if (tga_bus_pci )
13251329 tga_type_name = "Digital ZLXp-E1" ;
13261330 if (tga_bus_tc )
13271331 tga_type_name = "Digital ZLX-E1" ;
1332+ memory_size = 2097152 ;
13281333 break ;
13291334 case TGA_TYPE_24PLANE :
13301335 if (tga_bus_pci )
13311336 tga_type_name = "Digital ZLXp-E2" ;
13321337 if (tga_bus_tc )
13331338 tga_type_name = "Digital ZLX-E2" ;
1339+ memory_size = 8388608 ;
13341340 break ;
13351341 case TGA_TYPE_24PLUSZ :
13361342 if (tga_bus_pci )
13371343 tga_type_name = "Digital ZLXp-E3" ;
13381344 if (tga_bus_tc )
13391345 tga_type_name = "Digital ZLX-E3" ;
1346+ memory_size = 16777216 ;
13401347 break ;
13411348 default :
13421349 tga_type_name = "Unknown" ;
1350+ memory_size = 16777216 ;
13431351 break ;
13441352 }
13451353
@@ -1351,9 +1359,8 @@ tgafb_init_fix(struct fb_info *info)
13511359 ? FB_VISUAL_PSEUDOCOLOR
13521360 : FB_VISUAL_DIRECTCOLOR );
13531361
1354- info -> fix .line_length = par -> xres * (par -> bits_per_pixel >> 3 );
13551362 info -> fix .smem_start = (size_t ) par -> tga_fb_base ;
1356- info -> fix .smem_len = info -> fix . line_length * par -> yres ;
1363+ info -> fix .smem_len = memory_size ;
13571364 info -> fix .mmio_start = (size_t ) par -> tga_regs_base ;
13581365 info -> fix .mmio_len = 512 ;
13591366
@@ -1478,6 +1485,9 @@ tgafb_register(struct device *dev)
14781485 modedb_tga = & modedb_tc ;
14791486 modedbsize_tga = 1 ;
14801487 }
1488+
1489+ tgafb_init_fix (info );
1490+
14811491 ret = fb_find_mode (& info -> var , info ,
14821492 mode_option ? mode_option : mode_option_tga ,
14831493 modedb_tga , modedbsize_tga , NULL ,
@@ -1495,7 +1505,6 @@ tgafb_register(struct device *dev)
14951505 }
14961506
14971507 tgafb_set_par (info );
1498- tgafb_init_fix (info );
14991508
15001509 if (register_framebuffer (info ) < 0 ) {
15011510 printk (KERN_ERR "tgafb: Could not register framebuffer\n" );
0 commit comments