Commit 04f8afbe authored by Tomi Valkeinen's avatar Tomi Valkeinen

fbdev: improve fb_mmap bounds checks

Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.
Signed-off-by: default avatarTomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>
parent 11bd5933
...@@ -1016,7 +1016,9 @@ static int gbefb_mmap(struct fb_info *info, ...@@ -1016,7 +1016,9 @@ static int gbefb_mmap(struct fb_info *info,
/* check range */ /* check range */
if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
return -EINVAL; return -EINVAL;
if (offset + size > gbe_mem_size) if (size > gbe_mem_size)
return -EINVAL;
if (offset > gbe_mem_size - size)
return -EINVAL; return -EINVAL;
/* remap using the fastest write-through mode on architecture */ /* remap using the fastest write-through mode on architecture */
......
...@@ -782,7 +782,11 @@ static int ufx_ops_mmap(struct fb_info *info, struct vm_area_struct *vma) ...@@ -782,7 +782,11 @@ static int ufx_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos; unsigned long page, pos;
if (offset + size > info->fix.smem_len) if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
return -EINVAL;
if (size > info->fix.smem_len)
return -EINVAL;
if (offset > info->fix.smem_len - size)
return -EINVAL; return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset; pos = (unsigned long)info->fix.smem_start + offset;
......
...@@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma) ...@@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos; unsigned long page, pos;
if (offset + size > info->fix.smem_len) if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
return -EINVAL;
if (size > info->fix.smem_len)
return -EINVAL;
if (offset > info->fix.smem_len - size)
return -EINVAL; return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset; pos = (unsigned long)info->fix.smem_start + offset;
......
...@@ -420,9 +420,12 @@ static int vfb_mmap(struct fb_info *info, ...@@ -420,9 +420,12 @@ static int vfb_mmap(struct fb_info *info,
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos; unsigned long page, pos;
if (offset + size > info->fix.smem_len) { if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
return -EINVAL;
if (size > info->fix.smem_len)
return -EINVAL;
if (offset > info->fix.smem_len - size)
return -EINVAL; return -EINVAL;
}
pos = (unsigned long)info->fix.smem_start + offset; pos = (unsigned long)info->fix.smem_start + offset;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment