aboutsummaryrefslogtreecommitdiffstats
path: root/target/linux/bcm27xx/patches-5.4/950-0664-driver-char-rpivid-Don-t-map-more-than-wanted.patch
diff options
context:
space:
mode:
Diffstat (limited to 'target/linux/bcm27xx/patches-5.4/950-0664-driver-char-rpivid-Don-t-map-more-than-wanted.patch')
-rw-r--r--target/linux/bcm27xx/patches-5.4/950-0664-driver-char-rpivid-Don-t-map-more-than-wanted.patch51
1 files changed, 51 insertions, 0 deletions
diff --git a/target/linux/bcm27xx/patches-5.4/950-0664-driver-char-rpivid-Don-t-map-more-than-wanted.patch b/target/linux/bcm27xx/patches-5.4/950-0664-driver-char-rpivid-Don-t-map-more-than-wanted.patch
new file mode 100644
index 0000000000..afc1a5a6a8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-5.4/950-0664-driver-char-rpivid-Don-t-map-more-than-wanted.patch
@@ -0,0 +1,51 @@
+From 8c2369b39b1dafe7a26907173bb47d37ec53bfa2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 21 Apr 2020 11:30:23 +0100
+Subject: [PATCH] driver: char: rpivid: Don't map more than wanted
+
+Limit mappings to the permitted range, but don't map more than asked
+for otherwise we walk off the end of the allocated VMA.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/char/broadcom/rpivid-mem.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/broadcom/rpivid-mem.c
++++ b/drivers/char/broadcom/rpivid-mem.c
+@@ -100,6 +100,7 @@ static int rpivid_mem_mmap(struct file *
+ {
+ struct rpivid_mem_priv *priv;
+ unsigned long pages;
++ unsigned long len;
+
+ priv = file->private_data;
+ pages = priv->regs_phys >> PAGE_SHIFT;
+@@ -107,14 +108,13 @@ static int rpivid_mem_mmap(struct file *
+ * The address decode is far larger than the actual number of registers.
+ * Just map the whole lot in.
+ */
+- vma->vm_page_prot = phys_mem_access_prot(file, pages,
+- priv->mem_window_len,
++ len = min(vma->vm_end - vma->vm_start, priv->mem_window_len);
++ vma->vm_page_prot = phys_mem_access_prot(file, pages, len,
+ vma->vm_page_prot);
+ vma->vm_ops = &rpivid_mem_vm_ops;
+ if (remap_pfn_range(vma, vma->vm_start,
+- pages,
+- priv->mem_window_len,
+- vma->vm_page_prot)) {
++ pages, len,
++ vma->vm_page_prot)) {
+ return -EAGAIN;
+ }
+ return 0;
+@@ -156,7 +156,7 @@ static int rpivid_mem_probe(struct platf
+ ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (ioresource) {
+ priv->regs_phys = ioresource->start;
+- priv->mem_window_len = ioresource->end - ioresource->start;
++ priv->mem_window_len = (ioresource->end + 1) - ioresource->start;
+ } else {
+ dev_err(priv->dev, "failed to get IO resource");
+ err = -ENOENT;