| 1 | |
| 2 | * linux/drivers/video/fb_sys_read.c - Generic file operations where
|
| 3 | * framebuffer is in system RAM
|
| 4 | *
|
| 5 | * Copyright (C) 2007 Antonino Daplas <[email protected]>
|
| 6 | *
|
| 7 | * This file is subject to the terms and conditions of the GNU General Public
|
| 8 | * License. See the file COPYING in the main directory of this archive
|
| 9 | * for more details.
|
| 10 | *
|
| 11 |
|
| 12 |
|
| 13 | #include <linux/export.h>
|
| 14 | #include <linux/fb.h>
|
| 15 | #include <linux/module.h>
|
| 16 | #include <linux/uaccess.h>
|
| 17 |
|
| 18 | ssize_t fb_sys_read(struct fb_info *info, char __user *buf, size_t count,
|
| 19 | loff_t *ppos)
|
| 20 | {
|
| 21 | unsigned long p = *ppos;
|
| 22 | void *src;
|
| 23 | int err = 0;
|
| 24 | unsigned long total_size, c;
|
| 25 | ssize_t ret;
|
| 26 |
|
| 27 | if (!(info->flags & FBINFO_VIRTFB))
|
| 28 | fb_warn_once(info, "Framebuffer is not in virtual address space.");
|
| 29 |
|
| 30 | if (!info->screen_buffer)
|
| 31 | return -ENODEV;
|
| 32 |
|
| 33 | total_size = info->screen_size;
|
| 34 |
|
| 35 | if (total_size == 0)
|
| 36 | total_size = info->fix.smem_len;
|
| 37 |
|
| 38 | |
| 39 | * Security Hardening: Defend against buggy legacy drivers that may
|
| 40 | * calculate a malformed screen_size. Clamp total_size to the actual
|
| 41 | * hardware mapped memory limit (smem_len) to prevent OOB access.
|
| 42 |
|
| 43 | if (info->fix.smem_len && total_size > info->fix.smem_len)
|
| 44 | total_size = info->fix.smem_len;
|
| 45 |
|
| 46 | if (p >= total_size)
|
| 47 | return 0;
|
| 48 |
|
| 49 | if (count >= total_size)
|
| 50 | count = total_size;
|
| 51 |
|
| 52 | if (count + p > total_size)
|
| 53 | count = total_size - p;
|
| 54 |
|
| 55 | src = info->screen_buffer + p;
|
| 56 |
|
| 57 | if (info->fbops->fb_sync)
|
| 58 | info->fbops->fb_sync(info);
|
| 59 |
|
| 60 | c = copy_to_user(buf, src, count);
|
| 61 | if (c)
|
| 62 | err = -EFAULT;
|
| 63 | ret = count - c;
|
| 64 |
|
| 65 | *ppos += ret;
|
| 66 |
|
| 67 | return ret ? ret : err;
|
| 68 | }
|
| 69 | EXPORT_SYMBOL_GPL(fb_sys_read);
|
| 70 |
|
| 71 | ssize_t fb_sys_write(struct fb_info *info, const char __user *buf,
|
| 72 | size_t count, loff_t *ppos)
|
| 73 | {
|
| 74 | unsigned long p = *ppos;
|
| 75 | void *dst;
|
| 76 | int err = 0;
|
| 77 | unsigned long total_size, c;
|
| 78 | size_t ret;
|
| 79 |
|
| 80 | if (!(info->flags & FBINFO_VIRTFB))
|
| 81 | fb_warn_once(info, "Framebuffer is not in virtual address space.");
|
| 82 |
|
| 83 | if (!info->screen_buffer)
|
| 84 | return -ENODEV;
|
| 85 |
|
| 86 | total_size = info->screen_size;
|
| 87 |
|
| 88 | if (total_size == 0)
|
| 89 | total_size = info->fix.smem_len;
|
| 90 |
|
| 91 | |
| 92 | * Security Hardening: Defend against buggy legacy drivers that may
|
| 93 | * calculate a malformed screen_size. Clamp total_size to the actual
|
| 94 | * hardware mapped memory limit (smem_len) to prevent OOB access.
|
| 95 |
|
| 96 | if (info->fix.smem_len && total_size > info->fix.smem_len)
|
| 97 | total_size = info->fix.smem_len;
|
| 98 |
|
| 99 | if (p > total_size)
|
| 100 | return -EFBIG;
|
| 101 |
|
| 102 | if (count > total_size) {
|
| 103 | err = -EFBIG;
|
| 104 | count = total_size;
|
| 105 | }
|
| 106 |
|
| 107 | if (count + p > total_size) {
|
| 108 | if (!err)
|
| 109 | err = -ENOSPC;
|
| 110 |
|
| 111 | count = total_size - p;
|
| 112 | }
|
| 113 |
|
| 114 | dst = info->screen_buffer + p;
|
| 115 |
|
| 116 | if (info->fbops->fb_sync)
|
| 117 | info->fbops->fb_sync(info);
|
| 118 |
|
| 119 | c = copy_from_user(dst, buf, count);
|
| 120 | if (c)
|
| 121 | err = -EFAULT;
|
| 122 | ret = count - c;
|
| 123 |
|
| 124 | *ppos += ret;
|
| 125 |
|
| 126 | return ret ? ret : err;
|
| 127 | }
|
| 128 | EXPORT_SYMBOL_GPL(fb_sys_write);
|
| 129 |
|
| 130 | MODULE_AUTHOR("Antonino Daplas <[email protected]>");
|
| 131 | MODULE_DESCRIPTION("Generic file read (fb in system RAM)");
|
| 132 | MODULE_LICENSE("GPL");
|