diff options
author | 2013-04-18 08:39:47 +0300 | |
---|---|---|
committer | 2013-04-26 08:28:56 +0300 | |
commit | 04f8afbec37f63fafce16e454a7848426aa36202 (patch) | |
tree | 1c761c03f67ebdc71163aaaf0389a092f29916c6 /drivers/video/gbefb.c | |
parent | fbdev/ps3fb: use vm_iomap_memory() (diff) | |
download | linux-04f8afbec37f63fafce16e454a7848426aa36202.tar.gz linux-04f8afbec37f63fafce16e454a7848426aa36202.tar.bz2 linux-04f8afbec37f63fafce16e454a7848426aa36202.zip |
fbdev: improve fb_mmap bounds checks
Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>
Diffstat (limited to 'drivers/video/gbefb.c')
-rw-r--r-- | drivers/video/gbefb.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c index bda5e3941510..ceab37020fff 100644 --- a/drivers/video/gbefb.c +++ b/drivers/video/gbefb.c @@ -1016,7 +1016,9 @@ static int gbefb_mmap(struct fb_info *info, /* check range */ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) return -EINVAL; - if (offset + size > gbe_mem_size) + if (size > gbe_mem_size) + return -EINVAL; + if (offset > gbe_mem_size - size) return -EINVAL; /* remap using the fastest write-through mode on architecture */ |