From patchwork Fri Mar 29 17:34:27 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Davis X-Patchwork-Id: 10877617 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CF7D315AC for ; Fri, 29 Mar 2019 17:34:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A0E7B28987 for ; Fri, 29 Mar 2019 17:34:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9232D28A86; Fri, 29 Mar 2019 17:34:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 301FC28987 for ; Fri, 29 Mar 2019 17:34:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729791AbfC2Re3 (ORCPT ); Fri, 29 Mar 2019 13:34:29 -0400 Received: from lelv0143.ext.ti.com ([198.47.23.248]:33714 "EHLO lelv0143.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729483AbfC2Re3 (ORCPT ); Fri, 29 Mar 2019 13:34:29 -0400 Received: from fllv0035.itg.ti.com ([10.64.41.0]) by lelv0143.ext.ti.com (8.15.2/8.15.2) with ESMTP id x2THYRZ6032730; Fri, 29 Mar 2019 12:34:27 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1553880867; bh=QxQfcfn0O/wNidZNs+QiyQ7UbiBLTB0CeLj+vHNmjtQ=; h=From:To:CC:Subject:Date; b=O1D2CevQd2RlwEgJWNY31c3nYR7z7ZDE/RnsHVOw8Nlq4t2oeffFOvW6hfR+rbnx8 7N1I3vkgL0eAdxZ7gA6QgRSjlI1h+cjv9ECqHq06NoHmag+gS8SgYYODZ+aOin1d4r Td9kgYtJgnOZnq+Zx+k3f4a+1iexcEfrs+WaJm6Y= Received: from DLEE111.ent.ti.com (dlee111.ent.ti.com [157.170.170.22]) by fllv0035.itg.ti.com (8.15.2/8.15.2) with ESMTPS id x2THYRW6093662 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 29 Mar 2019 12:34:27 -0500 Received: from DLEE111.ent.ti.com (157.170.170.22) by DLEE111.ent.ti.com (157.170.170.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 29 Mar 2019 12:34:27 -0500 Received: from fllv0040.itg.ti.com (10.64.41.20) by DLEE111.ent.ti.com (157.170.170.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5 via Frontend Transport; Fri, 29 Mar 2019 12:34:27 -0500 Received: from legion.dal.desgin.ti.com (legion.dal.design.ti.com [128.247.22.53]) by fllv0040.itg.ti.com (8.15.2/8.15.2) with ESMTP id x2THYRr0097091; Fri, 29 Mar 2019 12:34:27 -0500 Received: from localhost ([10.250.67.168]) by legion.dal.desgin.ti.com (8.11.7p1+Sun/8.11.7) with ESMTP id x2THYQU16108; Fri, 29 Mar 2019 12:34:26 -0500 (CDT) From: "Andrew F. Davis" To: Mauro Carvalho Chehab CC: , , "Andrew F . Davis" Subject: [PATCH] [media] videobuf-dma-contig: Use size of buffer in mmap not vma size Date: Fri, 29 Mar 2019 12:34:27 -0500 Message-ID: <20190329173427.18238-1-afd@ti.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The size of the vma can be larger than the size of the backing buffer. Use the buffer size over vma size to prevent exposing extra memory to userspace. Signed-off-by: Andrew F. Davis Reviewed-by: Sakari Ailus --- drivers/media/v4l2-core/videobuf-dma-contig.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c index e1bf50df4c70..65e2655d22b7 100644 --- a/drivers/media/v4l2-core/videobuf-dma-contig.c +++ b/drivers/media/v4l2-core/videobuf-dma-contig.c @@ -280,7 +280,6 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q, struct videobuf_dma_contig_memory *mem; struct videobuf_mapping *map; int retval; - unsigned long size; dev_dbg(q->dev, "%s\n", __func__); @@ -303,7 +302,6 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q, goto error; /* Try to remap memory */ - size = vma->vm_end - vma->vm_start; vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); /* the "vm_pgoff" is just used in v4l2 to find the @@ -314,7 +312,7 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q, */ vma->vm_pgoff = 0; - retval = vm_iomap_memory(vma, mem->dma_handle, size); + retval = vm_iomap_memory(vma, mem->dma_handle, mem->size); if (retval) { dev_err(q->dev, "mmap: remap failed with error %d. ", retval);