From 2654a8bbb815741fb1d4bc5482f3a33d9d71aad4 Mon Sep 17 00:00:00 2001
From: Seung-Woo Kim <sw0312.kim@samsung.com>
Date: Thu, 11 Apr 2013 23:57:57 -0300
Subject: [PATCH] --- yaml --- r: 367056 b: refs/heads/master c:
 068a0df76023926af958a336a78bef60468d2033 h: refs/heads/master v: v3

---
 [refs]                                         | 2 +-
 trunk/drivers/media/v4l2-core/videobuf2-core.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index f0d6cec4e2e5..068e96d39c18 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 27a0aacf3ee4e7f91b95d69c954a6ba6540a5c0a
+refs/heads/master: 068a0df76023926af958a336a78bef60468d2033
diff --git a/trunk/drivers/media/v4l2-core/videobuf2-core.c b/trunk/drivers/media/v4l2-core/videobuf2-core.c
index 02bb5e721657..58c17444d22f 100644
--- a/trunk/drivers/media/v4l2-core/videobuf2-core.c
+++ b/trunk/drivers/media/v4l2-core/videobuf2-core.c
@@ -1886,6 +1886,11 @@ int vb2_mmap(struct vb2_queue *q, struct vm_area_struct *vma)
 
 	vb = q->bufs[buffer];
 
+	if (vb->v4l2_planes[plane].length < (vma->vm_end - vma->vm_start)) {
+		dprintk(1, "Invalid length\n");
+		return -EINVAL;
+	}
+
 	ret = call_memop(q, mmap, vb->planes[plane].mem_priv, vma);
 	if (ret)
 		return ret;