From: Greg Kroah-Hartman Date: Tue, 8 May 2018 07:46:00 +0000 (+0200) Subject: drm: udl: Properly check framebuffer mmap offsets X-Git-Tag: Ubuntu-4.13.0-45.50~28 X-Git-Url: https://git.proxmox.com/?p=mirror_ubuntu-artful-kernel.git;a=commitdiff_plain;h=177e3cda1ddf6997dc16e03d2ad4a06360d1a469 drm: udl: Properly check framebuffer mmap offsets CVE-2018-8781 The memmap options sent to the udl framebuffer driver were not being checked for all sets of possible crazy values. Fix this up by properly bounding the allowed values. Reported-by: Eyal Itkin Cc: stable Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20180321154553.GA18454@kroah.com (cherry picked from commit 3b82a4db8eaccce735dffd50b4d4e1578099b8e8) Signed-off-by: Po-Hsu Lin Acked-by: Kleber Sacilotto de Souza Acked-by: Andy Whitcroft Signed-off-by: Stefan Bader --- diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c index 4a6500362564..f8c0997d880f 100644 --- a/drivers/gpu/drm/udl/udl_fb.c +++ b/drivers/gpu/drm/udl/udl_fb.c @@ -158,10 +158,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) { unsigned long start = vma->vm_start; unsigned long size = vma->vm_end - vma->vm_start; - unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; + unsigned long offset; unsigned long page, pos; - if (offset + size > info->fix.smem_len) + if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) + return -EINVAL; + + offset = vma->vm_pgoff << PAGE_SHIFT; + + if (offset > info->fix.smem_len || size > info->fix.smem_len - offset) return -EINVAL; pos = (unsigned long)info->fix.smem_start + offset;