[media] media: vb2: add length check for mmap

The length of mmap() can be bigger than length of vb2 buffer, so
it should be checked.

Signed-off-by: Seung-Woo Kim <[e-mail]>
Acked-by: Marek Szyprowski <[e-mail]>
Signed-off-by: Mauro Carvalho Chehab <[e-mail]>

drivers/media/v4l2-core/videobuf2-core.c

···
 
 	vb = q->bufs[buffer];
 
+	if (vb->v4l2_planes[plane].length < (vma->vm_end - vma->vm_start)) {
+		dprintk(1, "Invalid length\n");
+		return -EINVAL;
+	}
+
 	ret = call_memop(q, mmap, vb->planes[plane].mem_priv, vma);
 	if (ret)
 		return ret;