+dri-devel ML

On 12 February 2013 07:20, sheu@google.com wrote:

...

From: John Sheu sheu@google.com

Callers to dma_buf_mmap expect to fput() the vma struct's vm_file themselves on failure. Not restoring the struct's data on failure causes a double-decrement of the vm_file's refcount.

Signed-off-by: John Sheu sheu@google.com

---

drivers/base/dma-buf.c | 21 +++++++++++++++------ 1 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c index 09e6878..06c6225 100644 --- a/drivers/base/dma-buf.c +++ b/drivers/base/dma-buf.c @@ -536,6 +536,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap); int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, unsigned long pgoff) {

•   struct file *oldfile;
  

•   int ret;
  

•   if (WARN_ON(!dmabuf || !vma))
            return -EINVAL;
  
  

@@ -549,15 +552,21 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, return -EINVAL;

    /* readjust the vma */

•   if (vma->vm_file)
  

•           fput(vma->vm_file);
  

•   get_file(dmabuf->file);
  

•   oldfile = vma->vm_file;
    vma->vm_file = dmabuf->file;
  

•   get_file(vma->vm_file);
  

•   vma->vm_pgoff = pgoff;
  
  

•   return dmabuf->ops->mmap(dmabuf, vma);
  

•   ret = dmabuf->ops->mmap(dmabuf, vma);
  

•   if (ret) {
  

•           /* restore old parameters on failure */
  

•           vma->vm_file = oldfile;
  

•           fput(dmabuf->file);
  

•   } else {
  

•           if (oldfile)
  

•                   fput(oldfile);
  

•   }
  

•   return ret;
  

} EXPORT_SYMBOL_GPL(dma_buf_mmap);

-- 1.7.8.6

--

Thanks and regards,

Sumit Semwal

Linaro Kernel Engineer - Graphics working group

Linaro.org │ Open source software for ARM SoCs

Follow Linaro: Facebook | Twitter | Blog