+dri-devel ML
On 12 February 2013 07:20, <s...@google.com> wrote:
> From: John Sheu <s...@google.com>
>
> Callers to dma_buf_mmap expect to fput() the vma struct's vm_file
> themselves on failure. Not restoring the struct's data on failure
> causes a double-decrement of the vm_file's refcount.
>
> Signed-off-by: John Sheu <s...@google.com>
>
> ---
> drivers/base/dma-buf.c | 21 +++++++++++++++------
> 1 files changed, 15 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c
> index 09e6878..06c6225 100644
> --- a/drivers/base/dma-buf.c
> +++ b/drivers/base/dma-buf.c
> @@ -536,6 +536,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap);
> int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
> unsigned long pgoff)
> {
> + struct file *oldfile;
> + int ret;
> +
> if (WARN_ON(!dmabuf || !vma))
> return -EINVAL;
>
> @@ -549,15 +552,21 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct
> vm_area_struct *vma,
> return -EINVAL;
>
> /* readjust the vma */
> - if (vma->vm_file)
> - fput(vma->vm_file);
> -
> + get_file(dmabuf->file);
> + oldfile = vma->vm_file;
> vma->vm_file = dmabuf->file;
> - get_file(vma->vm_file);
> -
> vma->vm_pgoff = pgoff;
>
> - return dmabuf->ops->mmap(dmabuf, vma);
> + ret = dmabuf->ops->mmap(dmabuf, vma);
> + if (ret) {
> + /* restore old parameters on failure */
> + vma->vm_file = oldfile;
> + fput(dmabuf->file);
> + } else {
> + if (oldfile)
> + fput(oldfile);
> + }
> + return ret;
> }
> EXPORT_SYMBOL_GPL(dma_buf_mmap);
>
> --
> 1.7.8.6
>
>
--
Thanks and regards,
Sumit Semwal
Linaro Kernel Engineer - Graphics working group
Linaro.org <http://www.linaro.org/>* **│ *Open source software for ARM SoCs*
***
Follow *Linaro: *Facebook <http://www.facebook.com/pages/Linaro> |
Twitter<http://twitter.com/#!/linaroorg>
| Blog <http://www.linaro.org/linaro-blog/>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel
