Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 04f8afbe authored Apr 18, 2013 by Tomi Valkeinen

fbdev: improve fb_mmap bounds checks



Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>

parent 11bd5933

drivers/video/gbefb.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1016,7 +1016,9 @@ static int gbefb_mmap(struct fb_info *info,
	/* check range */		/* check range */
	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))		if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
	return -EINVAL;		return -EINVAL;
	if (offset + size > gbe_mem_size)		if (size > gbe_mem_size)
			return -EINVAL;
			if (offset > gbe_mem_size - size)
	return -EINVAL;		return -EINVAL;

	/* remap using the fastest write-through mode on architecture */		/* remap using the fastest write-through mode on architecture */

drivers/video/smscufx.c

+5 −1

Original line number	Original line	Diff line number	Diff line
	@@ -782,7 +782,11 @@ static int ufx_ops_mmap(struct fb_info info, struct vm_area_struct vma)
	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;		unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
	unsigned long page, pos;		unsigned long page, pos;

	if (offset + size > info->fix.smem_len)		if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
			return -EINVAL;
			if (size > info->fix.smem_len)
			return -EINVAL;
			if (offset > info->fix.smem_len - size)
	return -EINVAL;		return -EINVAL;

	pos = (unsigned long)info->fix.smem_start + offset;		pos = (unsigned long)info->fix.smem_start + offset;

drivers/video/udlfb.c

+5 −1

Original line number	Original line	Diff line number	Diff line
	@@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info info, struct vm_area_struct vma)
	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;		unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
	unsigned long page, pos;		unsigned long page, pos;

	if (offset + size > info->fix.smem_len)		if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
			return -EINVAL;
			if (size > info->fix.smem_len)
			return -EINVAL;
			if (offset > info->fix.smem_len - size)
	return -EINVAL;		return -EINVAL;

	pos = (unsigned long)info->fix.smem_start + offset;		pos = (unsigned long)info->fix.smem_start + offset;

drivers/video/vfb.c

+5 −2

Original line number	Original line	Diff line number	Diff line
	@@ -420,9 +420,12 @@ static int vfb_mmap(struct fb_info *info,
	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;		unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
	unsigned long page, pos;		unsigned long page, pos;

	if (offset + size > info->fix.smem_len) {		if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
			return -EINVAL;
			if (size > info->fix.smem_len)
			return -EINVAL;
			if (offset > info->fix.smem_len - size)
	return -EINVAL;		return -EINVAL;
	}

	pos = (unsigned long)info->fix.smem_start + offset;		pos = (unsigned long)info->fix.smem_start + offset;