summaryrefslogtreecommitdiffstats
path: root/drivers/uio
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2013-12-02 11:50:37 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2013-12-02 11:50:37 -0800
commitb65502879556d041b45104c6a35abbbba28c8f2d (patch)
tree33dc13740f3a0e00a960a2eb9e78afe523f1e8c4 /drivers/uio
parenta45299e72737c528975546a0680cace5d7364d27 (diff)
downloadlinux-b65502879556d041b45104c6a35abbbba28c8f2d.tar.gz
linux-b65502879556d041b45104c6a35abbbba28c8f2d.tar.bz2
linux-b65502879556d041b45104c6a35abbbba28c8f2d.zip
uio: we cannot mmap unaligned page contents
In commit 7314e613d5ff ("Fix a few incorrectly checked [io_]remap_pfn_range() calls") the uio driver started more properly checking the passed-in user mapping arguments against the size of the actual uio driver data. That in turn exposed that some driver authors apparently didn't realize that mmap can only work on a page granularity, and had tried to use it with smaller mappings, with the new size check catching that out. So since it's not just the user mmap() arguments that can be confused, make the uio mmap code also verify that the uio driver has the memory allocated at page boundaries in order for mmap to work. If the device memory isn't properly aligned, we return [ENODEV] The fildes argument refers to a file whose type is not supported by mmap(). as per the open group documentation on mmap. Reported-by: Holger Brunck <holger.brunck@keymile.com> Acked-by: Greg KH <gregkh@linuxfoundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/uio')
-rw-r--r--drivers/uio/uio.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 67beb8444930..f7beb6eb40c7 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -653,6 +653,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
return -EINVAL;
mem = idev->info->mem + mi;
+ if (mem->addr & ~PAGE_MASK)
+ return -ENODEV;
if (vma->vm_end - vma->vm_start > mem->size)
return -EINVAL;