Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S968132Ab3DSJrP (ORCPT ); Fri, 19 Apr 2013 05:47:15 -0400 Received: from mail-pd0-f172.google.com ([209.85.192.172]:47198 "EHLO mail-pd0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758536Ab3DSJrN (ORCPT ); Fri, 19 Apr 2013 05:47:13 -0400 From: Prabhakar lad To: LMML Cc: Mauro Carvalho Chehab , DLOS , LKML , Hans Verkuil , Pawel Osciak , Kyungmin Park , "Lad, Prabhakar" , Laurent Pinchart , Marek Szyprowski , Seung-Woo Kim Subject: [PATCH RFC] media: videobuf2: fix the length check for mmap Date: Fri, 19 Apr 2013 15:16:56 +0530 Message-Id: <1366364816-3567-1-git-send-email-prabhakar.csengg@gmail.com> X-Mailer: git-send-email 1.7.4.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2361 Lines: 60 From: Lad, Prabhakar >From commit 068a0df76023926af958a336a78bef60468d2033 "[media] media: vb2: add length check for mmap" patch verifies that the mmap() size requested by userspace doesn't exceed the buffer size. As the mmap() size is rounded up to the next page boundary the check will fail for buffer sizes that are not multiple of the page size. This patch fixes the check by aligning the buffer size to page size during the check. Alongside fixes the vmalloc allocator to round up the size. Signed-off-by: Lad, Prabhakar Cc: Laurent Pinchart Cc: Marek Szyprowski Cc: Seung-Woo Kim Cc: Hans Verkuil Cc: Mauro Carvalho Chehab --- drivers/media/v4l2-core/videobuf2-core.c | 2 +- drivers/media/v4l2-core/videobuf2-vmalloc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index 58c1744..223fcd4 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -1886,7 +1886,7 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) vb = q->bufs[buffer]; - if (vb->v4l2_planes[plane].length < (vma->vm_end - vma->vm_start)) { + if (PAGE_ALIGN(vb->v4l2_planes[plane].length) < (vma->vm_end - vma->vm_start)) { dprintk(1, "Invalid length\n"); return -EINVAL; } diff --git a/drivers/media/v4l2-core/videobuf2-vmalloc.c b/drivers/media/v4l2-core/videobuf2-vmalloc.c index 313d977..bf3b95c 100644 --- a/drivers/media/v4l2-core/videobuf2-vmalloc.c +++ b/drivers/media/v4l2-core/videobuf2-vmalloc.c @@ -44,7 +44,7 @@ static void *vb2_vmalloc_alloc(void *alloc_ctx, unsigned long size, gfp_t gfp_fl return NULL; buf->size = size; - buf->vaddr = vmalloc_user(buf->size); + buf->vaddr = vmalloc_user(PAGE_ALIGN(buf->size)); buf->handler.refcount = &buf->refcount; buf->handler.put = vb2_vmalloc_put; buf->handler.arg = buf; -- 1.7.4.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/