From patchwork Fri Apr 19 09:46:56 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Lad, Prabhakar" X-Patchwork-Id: 2464171 Return-Path: X-Original-To: patchwork-davinci@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from comal.ext.ti.com (comal.ext.ti.com [198.47.26.152]) by patchwork1.kernel.org (Postfix) with ESMTP id 636E63FD1A for ; Fri, 19 Apr 2013 09:51:26 +0000 (UTC) Received: from dflxv15.itg.ti.com ([128.247.5.124]) by comal.ext.ti.com (8.13.7/8.13.7) with ESMTP id r3J9lJVE005654; Fri, 19 Apr 2013 04:47:19 -0500 Received: from DFLE72.ent.ti.com (dfle72.ent.ti.com [128.247.5.109]) by dflxv15.itg.ti.com (8.14.3/8.13.8) with ESMTP id r3J9lIW5004654; Fri, 19 Apr 2013 04:47:18 -0500 Received: from dlelxv24.itg.ti.com (172.17.1.199) by DFLE72.ent.ti.com (128.247.5.109) with Microsoft SMTP Server id 14.2.342.3; Fri, 19 Apr 2013 04:47:18 -0500 Received: from linux.omap.com (dlelxs01.itg.ti.com [157.170.227.31]) by dlelxv24.itg.ti.com (8.13.8/8.13.8) with ESMTP id r3J9lI9T015445; Fri, 19 Apr 2013 04:47:18 -0500 Received: from linux.omap.com (localhost [127.0.0.1]) by linux.omap.com (Postfix) with ESMTP id D382880627; Fri, 19 Apr 2013 04:47:17 -0500 (CDT) X-Original-To: davinci-linux-open-source@linux.davincidsp.com Delivered-To: davinci-linux-open-source@linux.davincidsp.com Received: from dflp51.itg.ti.com (dflp51.itg.ti.com [128.247.22.94]) by linux.omap.com (Postfix) with ESMTP id D548980626 for ; Fri, 19 Apr 2013 04:47:16 -0500 (CDT) Received: from red.ext.ti.com (red.ext.ti.com [192.94.93.37]) by dflp51.itg.ti.com (8.13.7/8.13.8) with ESMTP id r3J9lFx2019154 for ; Fri, 19 Apr 2013 04:47:15 -0500 (CDT) Received: from mail6.bemta7.messagelabs.com (mail6.bemta7.messagelabs.com [216.82.255.55]) by red.ext.ti.com (8.13.7/8.13.7) with ESMTP id r3J9lFt1001342 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Fri, 19 Apr 2013 04:47:15 -0500 Received: from [216.82.253.67:4443] by server-9.bemta-7.messagelabs.com id 1F/49-18192-3A211715; Fri, 19 Apr 2013 09:47:15 +0000 X-Env-Sender: prabhakar.csengg@gmail.com X-Msg-Ref: server-7.tower-158.messagelabs.com!1366364833!3491153!1 X-Originating-IP: [209.85.192.178] X-SpamReason: No, hits=0.0 required=7.0 tests=ML_RADAR_SPEW_LINKS_14, spamassassin: X-StarScan-Received: X-StarScan-Version: 6.8.6.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 32423 invoked from network); 19 Apr 2013 09:47:14 -0000 Received: from mail-pd0-f178.google.com (HELO mail-pd0-f178.google.com) (209.85.192.178) by server-7.tower-158.messagelabs.com with RC4-SHA encrypted SMTP; 19 Apr 2013 09:47:14 -0000 Received: by mail-pd0-f178.google.com with SMTP id w11so2131065pde.9 for ; Fri, 19 Apr 2013 02:47:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:from:to:cc:subject:date:message-id:x-mailer; bh=YFSO2BDaB8wGPfKhxgdR3fYcBWG6CEpiDVgQAasNhfY=; b=cSeW33Uyu+1AfTBWMPoYo3uFYjDXhXlOlFtTdu5YryJNUGI8ucN/o9piwXUgtenpHu Bd1grU+6M7D+yP985pCLsR6Q0FxB4ueMpf+MFaAG24C99jpO7EsqNZs8Zf6k4AHBIy9B wCB4njw3ZSF6/ZRHYZHRNXOhamusnRYxQyHFgQBxves3V1zMaUrRinRm+q/Nw+h+lvfX 6oowRKZ7bum42j9OJk9WrEpN0kuBoO/aSoXZY4xsEo4M0KVaYi2P2Yk6tzB1L/0PcW0o JO+H/48Nc37TMZRsXk5Q0MXiIrcmtvVpTB1NOHLE23nV4Rgr9l1yA77b4amJXyZnClbO UzGQ== X-Received: by 10.68.176.197 with SMTP id ck5mr17893929pbc.165.1366364833359; Fri, 19 Apr 2013 02:47:13 -0700 (PDT) Received: from localhost.localdomain ([59.98.240.95]) by mx.google.com with ESMTPS id t1sm14157156pab.12.2013.04.19.02.47.03 (version=TLSv1 cipher=RC4-SHA bits=128/128); Fri, 19 Apr 2013 02:47:12 -0700 (PDT) From: Prabhakar lad To: LMML Subject: [PATCH RFC] media: videobuf2: fix the length check for mmap Date: Fri, 19 Apr 2013 15:16:56 +0530 Message-ID: <1366364816-3567-1-git-send-email-prabhakar.csengg@gmail.com> X-Mailer: git-send-email 1.7.4.1 CC: DLOS , Mauro Carvalho Chehab , Pawel Osciak , Seung-Woo Kim , LKML , Kyungmin Park , Hans Verkuil , Laurent Pinchart , Marek Szyprowski X-BeenThere: davinci-linux-open-source@linux.davincidsp.com X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: Errors-To: davinci-linux-open-source-bounces@linux.davincidsp.com From: Lad, Prabhakar >From commit 068a0df76023926af958a336a78bef60468d2033 "[media] media: vb2: add length check for mmap" patch verifies that the mmap() size requested by userspace doesn't exceed the buffer size. As the mmap() size is rounded up to the next page boundary the check will fail for buffer sizes that are not multiple of the page size. This patch fixes the check by aligning the buffer size to page size during the check. Alongside fixes the vmalloc allocator to round up the size. Signed-off-by: Lad, Prabhakar Cc: Laurent Pinchart Cc: Marek Szyprowski Cc: Seung-Woo Kim Cc: Hans Verkuil Cc: Mauro Carvalho Chehab --- drivers/media/v4l2-core/videobuf2-core.c | 2 +- drivers/media/v4l2-core/videobuf2-vmalloc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index 58c1744..223fcd4 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -1886,7 +1886,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) vb = q->bufs[buffer]; - if (vb->v4l2_planes[plane].length < (vma->vm_end - vma->vm_start)) { + if (PAGE_ALIGN(vb->v4l2_planes[plane].length) < (vma->vm_end - vma->vm_start)) { dprintk(1, "Invalid length\n"); return -EINVAL; } diff --git a/drivers/media/v4l2-core/videobuf2-vmalloc.c b/drivers/media/v4l2-core/videobuf2-vmalloc.c index 313d977..bf3b95c 100644 --- a/drivers/media/v4l2-core/videobuf2-vmalloc.c +++ b/drivers/media/v4l2-core/videobuf2-vmalloc.c @@ -44,7 +44,7 @@ static void *vb2_vmalloc_alloc(void *alloc_ctx, unsigned long size, gfp_t gfp_fl return NULL; buf->size = size; - buf->vaddr = vmalloc_user(buf->size); + buf->vaddr = vmalloc_user(PAGE_ALIGN(buf->size)); buf->handler.refcount = &buf->refcount; buf->handler.put = vb2_vmalloc_put; buf->handler.arg = buf;