From: Tomi Valkeinen <tomi.valkeinen@ti.com>
To: linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>,
Steve Glendinning <steve.glendinning@smsc.com>,
Bernie Thompson <bernie@plugable.com>
Subject: [PATCH 11/11] fbdev: improve fb_mmap bounds checks
Date: Tue, 23 Apr 2013 06:36:58 +0000 [thread overview]
Message-ID: <1366699018-5439-11-git-send-email-tomi.valkeinen@ti.com> (raw)
In-Reply-To: <1366699018-5439-1-git-send-email-tomi.valkeinen@ti.com>
Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>
---
drivers/video/gbefb.c | 4 +++-
drivers/video/smscufx.c | 6 +++++-
drivers/video/udlfb.c | 6 +++++-
drivers/video/vfb.c | 7 +++++--
4 files changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index bda5e39..ceab370 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -1016,7 +1016,9 @@ static int gbefb_mmap(struct fb_info *info,
/* check range */
if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
return -EINVAL;
- if (offset + size > gbe_mem_size)
+ if (size > gbe_mem_size)
+ return -EINVAL;
+ if (offset > gbe_mem_size - size)
return -EINVAL;
/* remap using the fastest write-through mode on architecture */
diff --git a/drivers/video/smscufx.c b/drivers/video/smscufx.c
index 97bd662..b2b33fc 100644
--- a/drivers/video/smscufx.c
+++ b/drivers/video/smscufx.c
@@ -782,7 +782,11 @@ static int ufx_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len)
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+ if (size > info->fix.smem_len)
+ return -EINVAL;
+ if (offset > info->fix.smem_len - size)
return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset;
diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
index 86d449e..ec03e72 100644
--- a/drivers/video/udlfb.c
+++ b/drivers/video/udlfb.c
@@ -324,7 +324,11 @@ static int dlfb_ops_mmap(struct fb_info *info, struct vm_area_struct *vma)
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len)
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+ if (size > info->fix.smem_len)
+ return -EINVAL;
+ if (offset > info->fix.smem_len - size)
return -EINVAL;
pos = (unsigned long)info->fix.smem_start + offset;
diff --git a/drivers/video/vfb.c b/drivers/video/vfb.c
index 8bc1f93..ee5985e 100644
--- a/drivers/video/vfb.c
+++ b/drivers/video/vfb.c
@@ -420,9 +420,12 @@ static int vfb_mmap(struct fb_info *info,
unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
unsigned long page, pos;
- if (offset + size > info->fix.smem_len) {
+ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+ return -EINVAL;
+ if (size > info->fix.smem_len)
+ return -EINVAL;
+ if (offset > info->fix.smem_len - size)
return -EINVAL;
- }
pos = (unsigned long)info->fix.smem_start + offset;
--
1.7.10.4
prev parent reply other threads:[~2013-04-23 6:36 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-23 6:36 [PATCH 01/11] fbdev/fbmem: use vm_iomap_memory() Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 02/11] fbdev/omapfb: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 03/11] fbdev/au1100fb: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 04/11] fbdev/au1200fb: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 05/11] fbdev/controlfb: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 06/11] fbdev/fb-puv3: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 07/11] fbdev/sa1100fb: " Tomi Valkeinen
2013-04-23 18:53 ` Russell King - ARM Linux
2013-04-23 6:36 ` [PATCH 08/11] fbdev/vermillion: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 09/11] fbdev/sgivwfb: " Tomi Valkeinen
2013-04-23 6:36 ` [PATCH 10/11] fbdev/ps3fb: " Tomi Valkeinen
2013-04-23 6:36 ` Tomi Valkeinen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1366699018-5439-11-git-send-email-tomi.valkeinen@ti.com \
--to=tomi.valkeinen@ti.com \
--cc=bernie@plugable.com \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=steve.glendinning@smsc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).