Commit 068a0df7 authored Apr 11, 2013 by Seung-Woo Kim Committed by Mauro Carvalho Chehab Apr 14, 2013

[media] media: vb2: add length check for mmap



The length of mmap() can be bigger than length of vb2 buffer, so
it should be checked.

Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 27a0aacf

drivers/media/v4l2-core/videobuf2-core.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1886,6 +1886,11 @@ int vb2_mmap(struct vb2_queue q, struct vm_area_struct vma)

		vb = q->bufs[buffer];

		if (vb->v4l2_planes[plane].length < (vma->vm_end - vma->vm_start)) {
		dprintk(1, "Invalid length\n");
		return -EINVAL;
		}

		ret = call_memop(q, mmap, vb->planes[plane].mem_priv, vma);
		if (ret)
		return ret;