media: videobuf-dma-contig: Use size of buffer in mmap not vma size

The size of the vma can be larger than the size of the backing buffer.
Use the buffer size over vma size to prevent exposing extra memory
to userspace.

Signed-off-by: Andrew F. Davis <afd@ti.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
index e1bf50df4c70f4682857ef30325abbad1aa506aa..65e2655d22b753f9596f333ac6a3c9fbdd43742c 100644 (file)
--- a/drivers/media/v4l2-core/videobuf-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -280,7 +280,6 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
        struct videobuf_dma_contig_memory *mem;
        struct videobuf_mapping *map;
        int retval;
-       unsigned long size;
 
        dev_dbg(q->dev, "%s\n", __func__);
 
@@ -303,7 +302,6 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
                goto error;
 
        /* Try to remap memory */
-       size = vma->vm_end - vma->vm_start;
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 
        /* the "vm_pgoff" is just used in v4l2 to find the
@@ -314,7 +312,7 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
         */
        vma->vm_pgoff = 0;
 
-       retval = vm_iomap_memory(vma, mem->dma_handle, size);
+       retval = vm_iomap_memory(vma, mem->dma_handle, mem->size);
        if (retval) {
                dev_err(q->dev, "mmap: remap failed with error %d. ",
                        retval);