From 24b51892b863ad23a9fcb2a28a45e5cc15c2f3b5 Mon Sep 17 00:00:00 2001 From: Manoj Rao Date: Tue, 16 Apr 2013 17:42:38 -0700 Subject: mdss: mdss_fb: remove mmio access through mmap Disable access to mm io and add appropriate range checks to ensure valid accesses through framebuffer mmap. This prevents illegal access into memory. Change-Id: Ic6e47ec726d330d48ce9a7a708418492a553543b CRs-Fixed: 474706 Signed-off-by: Manoj Rao --- drivers/video/msm/mdss/mdss_fb.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/video/msm/mdss/mdss_fb.c b/drivers/video/msm/mdss/mdss_fb.c index e2d8cf6..f42df2a 100644 --- a/drivers/video/msm/mdss/mdss_fb.c +++ b/drivers/video/msm/mdss/mdss_fb.c @@ -669,22 +669,16 @@ static int mdss_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) } mdss_fb_pan_idle(mfd); - if (off >= len) { - /* memory mapped io */ - off -= len; - if (info->var.accel_flags) { - mutex_unlock(&info->lock); - return -EINVAL; - } - start = info->fix.mmio_start; - len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len); - } /* Set VM flags. */ start &= PAGE_MASK; - if ((vma->vm_end - vma->vm_start + off) > len) + if ((vma->vm_end <= vma->vm_start) || + (off >= len) || + ((vma->vm_end - vma->vm_start) > (len - off))) return -EINVAL; off += start; + if (off < start) + return -EINVAL; vma->vm_pgoff = off >> PAGE_SHIFT; /* This is an IO map - tell maydump to skip this VMA */ vma->vm_flags |= VM_IO | VM_RESERVED; -- cgit v1.1