diff options
| -rw-r--r-- | drivers/staging/tidspbridge/rmgr/drv_interface.c | 28 |
1 files changed, 25 insertions, 3 deletions
diff --git a/drivers/staging/tidspbridge/rmgr/drv_interface.c b/drivers/staging/tidspbridge/rmgr/drv_interface.c index 17afc2b..80c2ee5 100644 --- a/drivers/staging/tidspbridge/rmgr/drv_interface.c +++ b/drivers/staging/tidspbridge/rmgr/drv_interface.c @@ -617,6 +617,8 @@ err: static int bridge_mmap(struct file *filp, struct vm_area_struct *vma) { u32 offset = vma->vm_pgoff << PAGE_SHIFT; + unsigned long base_pgoff; + int status; struct omap_dsp_platform_data *pdata = omap_dspbridge_dev->dev.platform_data; @@ -630,9 +632,29 @@ static int bridge_mmap(struct file *filp, struct vm_area_struct *vma) "%lx flags %lx\n", __func__, filp, offset, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma->vm_flags); - return vm_iomap_memory(vma, - pdata->phys_mempool_base, - pdata->phys_mempool_size); + /* + * vm_iomap_memory() expects vma->vm_pgoff to be expressed as an offset + * from the start of the physical memory pool, but we're called with + * a pfn (physical page number) stored there instead. + * + * To avoid duplicating lots of tricky overflow checking logic, + * temporarily convert vma->vm_pgoff to the offset vm_iomap_memory() + * expects, but restore the original value once the mapping has been + * created. + */ + base_pgoff = pdata->phys_mempool_base >> PAGE_SHIFT; + if (vma->vm_pgoff < base_pgoff) + return -EINVAL; + vma->vm_pgoff -= base_pgoff; + + status = vm_iomap_memory(vma, + pdata->phys_mempool_base, + pdata->phys_mempool_size); + + /* Restore the original value of vma->vm_pgoff */ + vma->vm_pgoff += base_pgoff; + + return status; } /* To remove all process resources before removing the process from the |