mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-13 01:44:26 -05:00
53 lines
1.6 KiB
Diff
53 lines
1.6 KiB
Diff
|
From 24b51892b863ad23a9fcb2a28a45e5cc15c2f3b5 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Manoj Rao <manojraj@codeaurora.org>
|
||
|
|
Date: Tue, 16 Apr 2013 17:42:38 -0700
|
||
|
|
Subject: mdss: mdss_fb: remove mmio access through mmap
|
||
|
|
|
||
|
|
Disable access to mm io and add
|
||
|
|
appropriate range checks to ensure valid accesses
|
||
|
|
through framebuffer mmap. This prevents illegal
|
||
|
|
access into memory.
|
||
|
|
|
||
|
|
Change-Id: Ic6e47ec726d330d48ce9a7a708418492a553543b
|
||
|
|
CRs-Fixed: 474706
|
||
|
|
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>
|
||
|
|
---
|
||
|
|
drivers/video/msm/mdss/mdss_fb.c | 16 +++++-----------
|
||
|
|
1 file changed, 5 insertions(+), 11 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/drivers/video/msm/mdss/mdss_fb.c b/drivers/video/msm/mdss/mdss_fb.c
|
||
|
|
index e2d8cf6..f42df2a 100644
|
||
|
|
--- a/drivers/video/msm/mdss/mdss_fb.c
|
||
|
|
+++ b/drivers/video/msm/mdss/mdss_fb.c
|
||
|
|
@@ -669,22 +669,16 @@ static int mdss_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
|
||
|
|
}
|
||
|
|
|
||
|
|
mdss_fb_pan_idle(mfd);
|
||
|
|
- if (off >= len) {
|
||
|
|
- /* memory mapped io */
|
||
|
|
- off -= len;
|
||
|
|
- if (info->var.accel_flags) {
|
||
|
|
- mutex_unlock(&info->lock);
|
||
|
|
- return -EINVAL;
|
||
|
|
- }
|
||
|
|
- start = info->fix.mmio_start;
|
||
|
|
- len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);
|
||
|
|
- }
|
||
|
|
|
||
|
|
/* Set VM flags. */
|
||
|
|
start &= PAGE_MASK;
|
||
|
|
- if ((vma->vm_end - vma->vm_start + off) > len)
|
||
|
|
+ if ((vma->vm_end <= vma->vm_start) ||
|
||
|
|
+ (off >= len) ||
|
||
|
|
+ ((vma->vm_end - vma->vm_start) > (len - off)))
|
||
|
|
return -EINVAL;
|
||
|
|
off += start;
|
||
|
|
+ if (off < start)
|
||
|
|
+ return -EINVAL;
|
||
|
|
vma->vm_pgoff = off >> PAGE_SHIFT;
|
||
|
|
/* This is an IO map - tell maydump to skip this VMA */
|
||
|
|
vma->vm_flags |= VM_IO | VM_RESERVED;
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|