diff options
| author | Espen Fjellvær Olsen <espen@mrfjo.org> | 2013-01-08 21:30:59 +0100 |
|---|---|---|
| committer | Espen Fjellvær Olsen <espen@mrfjo.org> | 2013-01-09 18:46:56 +0100 |
| commit | 49017aa9e80dbdb44cbfe8f4aa3b5edd9466705c (patch) | |
| tree | 8a22b8d121d4ce41c2f4a590eb9fbf186af5f368 /drivers/char | |
| parent | 5528b5d5c43f0c38903db0e672581ec4176ae523 (diff) | |
| download | kernel_samsung_smdk4412-49017aa9e80dbdb44cbfe8f4aa3b5edd9466705c.zip kernel_samsung_smdk4412-49017aa9e80dbdb44cbfe8f4aa3b5edd9466705c.tar.gz kernel_samsung_smdk4412-49017aa9e80dbdb44cbfe8f4aa3b5edd9466705c.tar.bz2 | |
Update to the exynos-mem security issue from Samsung I9300 Update7
p2: includes the secmem changes as well as Andreis MFC addition as well
Change-Id: I144c2b42586f07b737fba09742315683cbab36ef
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/Kconfig | 1 | ||||
| -rw-r--r-- | drivers/char/exynos_mem.c | 14 | ||||
| -rw-r--r-- | drivers/char/s3c_mem.c | 17 |
3 files changed, 28 insertions, 4 deletions
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig index ea75975..ed0ddff 100644 --- a/drivers/char/Kconfig +++ b/drivers/char/Kconfig @@ -638,6 +638,7 @@ config S3C_MEM config EXYNOS_MEM bool "Support for /dev/exynos-mem" + depends on CMA default y help If you do say Y here, you can mmap using physically linear memories. diff --git a/drivers/char/exynos_mem.c b/drivers/char/exynos_mem.c index 85c7a29..cf546a1 100644 --- a/drivers/char/exynos_mem.c +++ b/drivers/char/exynos_mem.c @@ -18,6 +18,7 @@ #include <linux/uaccess.h> #include <linux/highmem.h> #include <linux/dma-mapping.h> +#include <linux/cma.h> #include <asm/cacheflush.h> #include <plat/cpu.h> @@ -83,6 +84,12 @@ static void cache_maint_phys(phys_addr_t start, size_t length, enum cacheop op) size_t left = length; phys_addr_t begin = start; + if (!cma_is_registered_region(start, length)) { + pr_err("[%s] handling non-cma region (%#x@%#x) is prohibited\n", + __func__, length, start); + return; + } + if (!soc_is_exynos5250() && !soc_is_exynos5210()) { if (length > (size_t) L1_FLUSH_ALL) { flush_cache_all(); @@ -257,10 +264,9 @@ int exynos_mem_mmap(struct file *filp, struct vm_area_struct *vma) pfn = mem->phybase; } - /* TODO: currently lowmem is only avaiable */ - if ((phys_to_virt(start) < (void *)PAGE_OFFSET) || - (phys_to_virt(start) >= high_memory)) { - pr_err("[%s] invalid paddr(0x%08x)\n", __func__, start); + if (!cma_is_registered_region(start, size)) { + pr_err("[%s] handling non-cma region (%#x@%#x) is prohibited\n", + __func__, size, start); return -EINVAL; } diff --git a/drivers/char/s3c_mem.c b/drivers/char/s3c_mem.c index 3e09dda..a8546d0 100644 --- a/drivers/char/s3c_mem.c +++ b/drivers/char/s3c_mem.c @@ -32,6 +32,7 @@ #include <linux/slab.h> #include <linux/mman.h> #include <linux/dma-mapping.h> +#include <linux/cma.h> #include <linux/unistd.h> #include <linux/version.h> @@ -324,6 +325,14 @@ long s3c_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) mutex_unlock(&mem_share_alloc_lock); return -EFAULT; } + + if (!cma_is_registered_region(param.phy_addr, param.size)) { + pr_err("%s: %#x@%#x is allowed to map\n", + __func__, param.size, param.phy_addr); + mutex_unlock(&mem_cacheable_share_alloc_lock); + return -EINVAL; + } + flag = MEM_ALLOC_SHARE; physical_address = param.phy_addr; DEBUG("param.phy_addr = %08x, %d\n", @@ -361,6 +370,14 @@ long s3c_mem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) mutex_unlock(&mem_cacheable_share_alloc_lock); return -EFAULT; } + + if (!cma_is_registered_region(param.phy_addr, param.size)) { + pr_err("%s: %#x@%#x is allowed to map\n", + __func__, param.size, param.phy_addr); + mutex_unlock(&mem_cacheable_share_alloc_lock); + return -EINVAL; + } + flag = MEM_ALLOC_CACHEABLE_SHARE; physical_address = param.phy_addr; DEBUG("param.phy_addr = %08x, %d\n", |