commit 04f8afbec37f63fafce16e454a7848426aa36202
author Tomi Valkeinen <tomi.valkeinen@ti.com> Thu Apr 18 08:39:47 2013 +0300
committer Tomi Valkeinen <tomi.valkeinen@ti.com> Fri Apr 26 08:28:56 2013 +0300
tree 1c761c03f67ebdc71163aaaf0389a092f29916c6
parent 11bd5933abe033fb7a3a0d1f1bd2cb4b6df8143f

fbdev: improve fb_mmap bounds checks

Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>

drivers/video/udlfb.c

diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
index 86d449e..ec03e72 100644
--- a/drivers/video/udlfb.c
+++ b/drivers/video/udlfb.c
@@ -324,7 +324,11 @@
 	unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
 	unsigned long page, pos;
 
-	if (offset + size > info->fix.smem_len)
+	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+		return -EINVAL;
+	if (size > info->fix.smem_len)
+		return -EINVAL;
+	if (offset > info->fix.smem_len - size)
 		return -EINVAL;
 
 	pos = (unsigned long)info->fix.smem_start + offset;