From 04f8afbec37f63fafce16e454a7848426aa36202 Mon Sep 17 00:00:00 2001 From: Tomi Valkeinen Date: Thu, 18 Apr 2013 08:39:47 +0300 Subject: fbdev: improve fb_mmap bounds checks Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to prevent possible uint overflows. Signed-off-by: Tomi Valkeinen Cc: Steve Glendinning Cc: Bernie Thompson --- drivers/video/smscufx.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'drivers/video/smscufx.c') diff --git a/drivers/video/smscufx.c b/drivers/video/smscufx.c index 97bd6620c364..b2b33fc1ac3f 100644 --- a/drivers/video/smscufx.c +++ b/drivers/video/smscufx.c @@ -782,7 +782,11 @@ static int ufx_ops_mmap(struct fb_info *info, struct vm_area_struct *vma) unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; unsigned long page, pos; - if (offset + size > info->fix.smem_len) + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + if (size > info->fix.smem_len) + return -EINVAL; + if (offset > info->fix.smem_len - size) return -EINVAL; pos = (unsigned long)info->fix.smem_start + offset; -- cgit v1.2.3