Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 73dad6a8 authored by Manoj Rao's avatar Manoj Rao Committed by Shalabh Jain
Browse files

msm: msm_fb: remove mmio access through mmap 



Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: default avatarManoj Rao <manojraj@codeaurora.org>
Signed-off-by: default avatarShalabh Jain <shalabhj@codeaurora.org>
parent 0cabfa0f

drivers/video/msm/msm_fb.c

+12 −13
Original line number Diff line number Diff line
@@ -1020,23 +1020,22 @@ static int msm_fb_mmap(struct fb_info *info, struct vm_area_struct * vma) 
	u32 len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len);

	unsigned long off = vma->vm_pgoff << PAGE_SHIFT;

	struct msm_fb_data_type *mfd = (struct msm_fb_data_type *)info->par;

	msm_fb_pan_idle(mfd);

	if (off >= len) {

		/* memory mapped io */

		off -= len;

		if (info->var.accel_flags) {

			mutex_unlock(&info->lock);



	if (!start)

		return -EINVAL;



	if ((vma->vm_end <= vma->vm_start) ||

	    (off >= len) ||

	    ((vma->vm_end - vma->vm_start) > (len - off)))

		return -EINVAL;

		}

		start = info->fix.mmio_start;

		len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);

	}



	msm_fb_pan_idle(mfd);

	/* Set VM flags. */

	start &= PAGE_MASK;

	if ((vma->vm_end - vma->vm_start + off) > len)

		return -EINVAL;

	off += start;

	if (off < start)

		return -EINVAL;



	vma->vm_pgoff = off >> PAGE_SHIFT;

	/* This is an IO map - tell maydump to skip this VMA */

	vma->vm_flags |= VM_IO | VM_RESERVED;