openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity
linux/drivers/staging
History
Ivaylo Dimitrov 559c71fe5d Staging: TIDSPBRIDGE: Use vm_iomap_memory for mmap-ing instead of remap_pfn_range 
This fixes the following bug:

----  Bug Report ----

source file: drivers/staging/tidspbridge/rmgr/drv_interface.c
issue      : mapping of physical memory without address range checks

259 static int bridge_mmap(struct file *filp, struct vm_area_struct *vma)
260 {
261         u32 status;
262
263         /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by remap_pfn_range() */
264         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
265
266         dev_dbg(bridge, "%s: vm filp %p start %lx end %lx page_prot %ulx "
267                 "flags %lx\n", __func__, filp,
268                 vma->vm_start, vma->vm_end, vma->vm_page_prot,
269                 vma->vm_flags);
270
271         status = remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff,
272                                  vma->vm_end - vma->vm_start,
273                                  vma->vm_page_prot);
274         if (status != 0)
275                 status = -EAGAIN;
276
277         return status;
278 }

The function provides an interface to remap physical memory to user space, but
does not provide any checks to ensure that the memory is within the region that
should be accessible.

Reported-by: Nico Golde <nico@ngolde.de>
Reported-by: Fabian Yamaguchi <fabs@goesec.de>
Signed-off-by: Ivaylo Dimitrov <freemangordon@abv.bg>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2013-12-03 09:42:45 -08:00
..
android staging: ashmem: Fix ASHMEM_PURGE_ALL_CACHES return value 2013-10-25 06:22:39 +01:00
bcm Staging driver update for 3.13-rc1 2013-11-07 15:07:58 +09:00
btmtk_usb Staging: btmtk_usb: Add hdev parameter to hdev->send driver callback 2013-11-25 12:15:58 -08:00
ced1401 ced1401: Convert driver to use get_user_pages_fast() 2013-10-05 17:52:58 -07:00
comedi staging: comedi: s626: fix value written by s626_set_dac() 2013-11-25 09:09:07 -08:00
cptm1217 staging: Remove OOM message after input_allocate_device 2013-10-29 09:05:21 -07:00
crystalhd Staging: crystalhd: use vfree() instead of kfree() 2013-10-11 15:47:06 -07:00
cxt1e1 Staging: cxt1e1: remove space between function name and '(' 2013-10-14 09:27:14 -07:00
dgap staging: dgap: dgap_tty: Do not use 0 for pointers 2013-10-11 15:36:30 -07:00
dgnc Staging: dgnc: avoiding buffer overflow 2013-10-19 14:35:05 -07:00
dgrp staging: dgrp: Remove casting the return value which is a void pointer 2013-09-17 07:47:43 -07:00
dwc2 Merge branch 'for-linus-dma-masks' of git://git.linaro.org/people/rmk/linux-arm 2013-11-14 07:55:21 +09:00
echo
…
et131x PCI changes for the v3.13 merge window: 2013-11-14 14:02:00 +09:00
frontier staging: frontier: use better DEVICE_ATTR_ macros 2013-08-24 10:30:28 -07:00
ft1000 staging: ft1000: fix use of potentially uninitialized variable 2013-11-25 09:25:18 -08:00
fwserial Staging: fwserial: wrap a line that exceeds 80 characters 2013-09-17 07:47:44 -07:00
gdm72xx
…
gdm724x staging: gdm724x: kzalloc should be used instead of kmalloc/memset 2013-10-27 20:34:46 -07:00
goldfish
…
iio First round of fixes for IIO in the 3.13 cycle. 2013-11-25 12:50:11 -08:00
imx-drm staging: imx-drm: Fix modular build of DRM_IMX_IPUV3 2013-11-25 09:25:18 -08:00
keucr Staging: keucr: fix quoted string split across lines 2013-10-06 22:07:30 -07:00
line6 Staging:line6: fix line over 80 characters 2013-10-27 20:43:46 -07:00
lustre staging/lustre/ptlrpc: fix ptlrpc_stop_pinger logic 2013-11-25 12:52:45 -08:00
media Staging: go7007: fix up some remaining go->dev issues 2013-11-25 09:29:32 -08:00
mt29f_spinand staging/mt29f_spinand: fix build error when ONDIEECC not enabled 2013-10-15 12:19:48 -07:00
netlogic staging:netlogic:Fixes commenting style in xlr_net.c 2013-10-15 12:27:11 -07:00
nvec staging: nvec: potential NULL dereference on error path 2013-11-25 09:14:29 -08:00
octeon staging: octeon: drop redundant mac address check 2013-10-29 09:05:21 -07:00
octeon-usb staging: octeon-usb: use list.h for transactions 2013-10-11 15:46:00 -07:00
olpc_dcon staging/olpc_dcon: fix kconfig to fix build errors 2013-10-15 12:25:30 -07:00
ozwpan staging: ozwpan: prevent overflow in oz_cdev_write() 2013-10-30 12:24:49 -07:00
panel
…
phison
…
quickstart Staging / quickstart: remove reduplicate if(acpi_disabled) check 2013-09-25 16:48:45 -07:00
rtl8187se Staging: rtl8187se: space prohibited before semicolon in r8185b_init.c 2013-10-30 09:26:44 -07:00
rtl8188eu staging: r8188eu: Fix AP mode 2013-11-25 12:52:45 -08:00
rtl8192e staging: rtl8192e: remove unneeded semicolons 2013-10-30 09:08:45 -07:00
rtl8192u staging: rtl8192u: use memdup_user to simplify code 2013-10-28 14:28:35 -07:00
rtl8712 Staging: rtl8712: fix spaces before semicolons 2013-10-03 13:50:54 -07:00
rts5139 staging: rts5139: Replaced min() with min_t() in 2013-10-27 20:43:46 -07:00
sb105x Staging driver update for 3.13-rc1 2013-11-07 15:07:58 +09:00
sbe-2t3e3 Staging: sbe-2t3e3: Fix smatch warning of function definition with external linkage 2013-10-28 14:54:49 -07:00
sep staging: sep: do not use comparisons on bool tests 2013-10-28 14:32:51 -07:00
serqt_usb2
…
silicom staging: silicom: fix space prohibited before semicolon 2013-10-02 16:22:01 -07:00
slicoss Staging: slicoss: Replace seq_printf with seq_puts 2013-10-27 07:03:19 -07:00
sm7xxfb Staging: sm7xxfb: fix line over 80 characters in sm7xxfb.c 2013-10-11 13:52:01 -07:00
speakup Staging: speakup: replacing simple_strtoul with kstrtoul 2013-10-19 14:51:06 -07:00
ste_rmi4 staging: Remove OOM message after input_allocate_device 2013-10-29 09:05:21 -07:00
tidspbridge Staging: TIDSPBRIDGE: Use vm_iomap_memory for mmap-ing instead of remap_pfn_range 2013-12-03 09:42:45 -08:00
usbip staging: usbip: Fix man-pages for usbip userspace utilities 2013-09-25 16:58:32 -07:00
vme
…
vt6655 Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd() 2013-11-25 09:14:29 -08:00
vt6656 staging: vt6656: [BUG] Fix for TX USB resets from vendors driver. 2013-11-25 09:14:29 -08:00
winbond Staging: winbond: Fix Sparse Warnings in reg.c 2013-10-29 08:43:05 -07:00
wlags49_h2 Staging driver update for 3.13-rc1 2013-11-07 15:07:58 +09:00
wlags49_h25 staging: wlags49_h2: remove sysfs file 2013-08-24 10:24:40 -07:00
wlan-ng Staging: wlan-ng: changing "* dev" to "*dev" 2013-10-17 09:12:15 -07:00
xgifb Staging: xgifb: fix braces {} are not necessary for any arm of this statement 2013-10-30 09:22:05 -07:00
xillybus staging: xillybus: Use dev_* functions instead of pr_* in xillybus_core 2013-10-19 13:41:34 -07:00
zram Staging: zram: Fix memory leak by refcount mismatch 2013-11-25 09:14:29 -08:00
zsmalloc staging: zsmalloc: Ensure handle is never 0 on success 2013-11-25 12:52:45 -08:00
Kconfig staging: ktap: remove code from tree 2013-10-27 14:05:02 -07:00
Makefile staging: ktap: remove code from tree 2013-10-27 14:05:02 -07:00
staging.c
…