diff options
| author | Seung-Woo Kim <sw0312.kim@samsung.com> | 2013-04-12 06:57:57 +0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2013-04-15 05:37:26 +0400 |
| commit | 068a0df76023926af958a336a78bef60468d2033 (patch) | |
| tree | 63d57cb1b0851deaea9ce55981baf095c9d15fca | |
| parent | 27a0aacf3ee4e7f91b95d69c954a6ba6540a5c0a (diff) | |
| download | linux-068a0df76023926af958a336a78bef60468d2033.tar.xz | |
[media] media: vb2: add length check for mmap
The length of mmap() can be bigger than length of vb2 buffer, so
it should be checked.
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
| -rw-r--r-- | drivers/media/v4l2-core/videobuf2-core.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c index 02bb5e721657..58c17444d22f 100644 --- a/drivers/media/v4l2-core/videobuf2-core.c +++ b/drivers/media/v4l2-core/videobuf2-core.c @@ -1886,6 +1886,11 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma) vb = q->bufs[buffer]; + if (vb->v4l2_planes[plane].length < (vma->vm_end - vma->vm_start)) { + dprintk(1, "Invalid length\n"); + return -EINVAL; + } + ret = call_memop(q, mmap, vb->planes[plane].mem_priv, vma); if (ret) return ret; |