diff options
| author | Tomi Valkeinen <tomi.valkeinen@ti.com> | 2013-04-18 08:39:47 +0300 |
|---|---|---|
| committer | Tomi Valkeinen <tomi.valkeinen@ti.com> | 2013-04-26 08:28:56 +0300 |
| commit | 04f8afbec37f63fafce16e454a7848426aa36202 (patch) | |
| tree | 1c761c03f67ebdc71163aaaf0389a092f29916c6 | |
| parent | 11bd5933abe033fb7a3a0d1f1bd2cb4b6df8143f (diff) | |
| download | lwn-04f8afbec37f63fafce16e454a7848426aa36202.tar.gz lwn-04f8afbec37f63fafce16e454a7848426aa36202.zip | |
fbdev: improve fb_mmap bounds checks
Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>
| -rw-r--r-- | drivers/video/gbefb.c | 4 | ||||
| -rw-r--r-- | drivers/video/smscufx.c | 6 | ||||
| -rw-r--r-- | drivers/video/udlfb.c | 6 | ||||
| -rw-r--r-- | drivers/video/vfb.c | 7 |
4 files changed, 18 insertions, 5 deletions
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c index bda5e3941510..ceab37020fff 100644 --- a/drivers/video/gbefb.c +++ b/drivers/video/gbefb.c @@ -1016,7 +1016,9 @@ static int gbefb_mmap(struct fb_info *info, /* check range */ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) return -EINVAL; - if (offset + size > gbe_mem_size) + if (size > gbe_mem_size) + return -EINVAL; + if (offset > gbe_mem_size - size) return -EINVAL; /* remap using the fastest write-through mode on architecture */ diff --git a/drivers/video/smscufx.c b/drivers/video/smscufx.c index 97bd6620c364..b2b33fc1ac3f 100644 --- a/drivers/video/smscufx.c +++ b/drivers/video/smscufx.c @@ -782,7 +782,11 @@ static int ufx_ops_mmap(struct fb_info *info, struct vm_area_struct *vma) unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long page, pos; - if (offset + size > info->fix.smem_len) + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + if (size > info->fix.smem_len) + return -EINVAL; + if (offset > info->fix.smem_len - size) return -EINVAL; pos = (unsigned long)info->fix.smem_start + offset; diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c index 86d449ea3169..ec03e726c940 100644 --- a/drivers/video/udlfb.c +++ b/drivers/video/udlfb.c @@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma) unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long page, pos; - if (offset + size > info->fix.smem_len) + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + if (size > info->fix.smem_len) + return -EINVAL; + if (offset > info->fix.smem_len - size) return -EINVAL; pos = (unsigned long)info->fix.smem_start + offset; diff --git a/drivers/video/vfb.c b/drivers/video/vfb.c index 8bc1f9398945..ee5985efa15c 100644 --- a/drivers/video/vfb.c +++ b/drivers/video/vfb.c @@ -420,9 +420,12 @@ static int vfb_mmap(struct fb_info *info, unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long page, pos; - if (offset + size > info->fix.smem_len) { + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + if (size > info->fix.smem_len) + return -EINVAL; + if (offset > info->fix.smem_len - size) return -EINVAL; - } pos = (unsigned long)info->fix.smem_start + offset; |