target/linux/bcm27xx/patches-5.4/950-0666-driver-char-rpivid-Don-t-map-more-than-wanted.patch

   1 From 8c2369b39b1dafe7a26907173bb47d37ec53bfa2 Mon Sep 17 00:00:00 2001
   2 From: Phil Elwell <phil@raspberrypi.com>
   3 Date: Tue, 21 Apr 2020 11:30:23 +0100
   4 Subject: [PATCH] driver: char: rpivid: Don't map more than wanted
   5
   6 Limit mappings to the permitted range, but don't map more than asked
   7 for otherwise we walk off the end of the allocated VMA.
   8
   9 Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  10 ---
  11  drivers/char/broadcom/rpivid-mem.c | 12 ++++++------
  12  1 file changed, 6 insertions(+), 6 deletions(-)
  13
  14 --- a/drivers/char/broadcom/rpivid-mem.c
  15 +++ b/drivers/char/broadcom/rpivid-mem.c
  16 @@ -100,6 +100,7 @@ static int rpivid_mem_mmap(struct file *
  17  {
  18         struct rpivid_mem_priv *priv;
  19         unsigned long pages;
  20 +       unsigned long len;
  21
  22         priv = file->private_data;
  23         pages = priv->regs_phys >> PAGE_SHIFT;
  24 @@ -107,14 +108,13 @@ static int rpivid_mem_mmap(struct file *
  25          * The address decode is far larger than the actual number of registers.
  26          * Just map the whole lot in.
  27          */
  28 -       vma->vm_page_prot = phys_mem_access_prot(file, pages,
  29 -                                                priv->mem_window_len,
  30 +       len = min(vma->vm_end - vma->vm_start, priv->mem_window_len);
  31 +       vma->vm_page_prot = phys_mem_access_prot(file, pages, len,
  32                                                  vma->vm_page_prot);
  33         vma->vm_ops = &rpivid_mem_vm_ops;
  34         if (remap_pfn_range(vma, vma->vm_start,
  35 -                       pages,
  36 -                       priv->mem_window_len,
  37 -                       vma->vm_page_prot)) {
  38 +                           pages, len,
  39 +                           vma->vm_page_prot)) {
  40                 return -EAGAIN;
  41         }
  42         return 0;
  43 @@ -156,7 +156,7 @@ static int rpivid_mem_probe(struct platf
  44         ioresource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
  45         if (ioresource) {
  46                 priv->regs_phys = ioresource->start;
  47 -               priv->mem_window_len = ioresource->end - ioresource->start;
  48 +               priv->mem_window_len = (ioresource->end + 1) - ioresource->start;
  49         } else {
  50                 dev_err(priv->dev, "failed to get IO resource");
  51                 err = -ENOENT;