fbdev: improve fb_mmap bounds checks

Improve fb_mmap bounds checks in gbefb, smscufx, udlfb and vfb drivers to
prevent possible uint overflows.

Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Steve Glendinning <steve.glendinning@smsc.com>
Cc: Bernie Thompson <bernie@plugable.com>

1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/video/vfb.c b/drivers/video/vfb.c
index 8bc1f9398945..ee5985efa15c 100644
--- a/drivers/video/vfb.c
+++ b/drivers/video/vfb.c
@@ -420,9 +420,12 @@ static int vfb_mmap(struct fb_info *info,
         unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
         unsigned long page, pos;
 
-        if (offset + size > info->fix.smem_len) {
+        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+                return -EINVAL;
+        if (size > info->fix.smem_len)
+                return -EINVAL;
+        if (offset > info->fix.smem_len - size)
                 return -EINVAL;
-        }
 
         pos = (unsigned long)info->fix.smem_start + offset;