1 files changed, 10 insertions, 1 deletions

diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 6d80d17f1e96..80a257554b30 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -170,6 +170,14 @@ static int drm_addmap_core(struct drm_device * dev, resource_size_t offset,
         }
         DRM_DEBUG("offset = 0x%08llx, size = 0x%08lx, type = %d\n",
                   (unsigned long long)map->offset, map->size, map->type);
+
+        /* page-align _DRM_SHM maps. They are allocated here so there is no security
+         * hole created by that and it works around various broken drivers that use
+         * a non-aligned quantity to map the SAREA. --BenH
+         */
+        if (map->type == _DRM_SHM)
+                map->size = PAGE_ALIGN(map->size);
+
         if ((map->offset & (~(resource_size_t)PAGE_MASK)) || (map->size & (~PAGE_MASK))) {
                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                 return -EINVAL;
@@ -363,7 +371,8 @@ static int drm_addmap_core(struct drm_device * dev, resource_size_t offset,
         list->user_token = list->hash.key << PAGE_SHIFT;
         mutex_unlock(&dev->struct_mutex);
 
-        list->master = dev->primary->master;
+        if (!(map->flags & _DRM_DRIVER))
+                list->master = dev->primary->master;
         *maplist = list;
         return 0;
         }