shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 19:30:30 +09:00
Code Issues Packages Projects Releases Wiki Activity

gpu: ion: Fix bug in ion_system_heap map_user

Browse Source 
When the requested mmap length was not an integer number of
chunks or the buffer, or if an offset was provided, a bug
would cause extra or incorrect pages of the buffer to be mapped.

Change-Id: I2766763d86048f026eeef0e0388b7de0e25c2093
Signed-off-by: Rebecca Schultz Zavin <rebecca@android.com>
This commit is contained in:
Rebecca Schultz Zavin
2012-10-23 10:47:04 -07:00
committed by Arve Hjønnevåg
parent a4194824b1
commit e2486d0bcf
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/gpu/ion/ion_system_heap.c
View File

@@ -292,18 +292,27 @@ int ion_system_heap_map_user(struct ion_heap *heap, struct ion_buffer *buffer,
{
struct sg_table *table = buffer->priv_virt;
unsigned long addr = vma->vm_start;
unsigned long offset = vma->vm_pgoff;
unsigned long offset = vma->vm_pgoff * PAGE_SIZE;
struct scatterlist *sg;
int i;
for_each_sg(table->sgl, sg, table->nents, i) {
if (offset) {
offset--;
struct page *page = sg_page(sg);
unsigned long remainder = vma->vm_end - addr;
unsigned long len = sg_dma_len(sg);
if (offset >= sg_dma_len(sg)) {
offset -= sg_dma_len(sg);
continue;
} else if (offset) {
page += offset / PAGE_SIZE;
len = sg_dma_len(sg) - offset;
offset = 0;
}
remap_pfn_range(vma, addr, page_to_pfn(sg_page(sg)),
sg_dma_len(sg), vma->vm_page_prot);
addr += sg_dma_len(sg);
len = min(len, remainder);
remap_pfn_range(vma, addr, page_to_pfn(page), len,
vma->vm_page_prot);
addr += len;
if (addr >= vma->vm_end)
return 0;
}