[PATCH] CHROMIUM: dma-buf: restore args on failure of dma_buf_mmap

[Sumit Semwal]

+dri-devel ML


On 12 February 2013 07:20, <sheu at google.com> wrote:

> From: John Sheu <sheu at google.com>
>
> Callers to dma_buf_mmap expect to fput() the vma struct's vm_file
> themselves on failure.  Not restoring the struct's data on failure
> causes a double-decrement of the vm_file's refcount.
>
> Signed-off-by: John Sheu <sheu at google.com>
>
> ---
>  drivers/base/dma-buf.c |   21 +++++++++++++++------
>  1 files changed, 15 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c
> index 09e6878..06c6225 100644
> --- a/drivers/base/dma-buf.c
> +++ b/drivers/base/dma-buf.c
> @@ -536,6 +536,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap);
>  int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
>                  unsigned long pgoff)
>  {
> +       struct file *oldfile;
> +       int ret;
> +
>         if (WARN_ON(!dmabuf || !vma))
>                 return -EINVAL;
>
> @@ -549,15 +552,21 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct
> vm_area_struct *vma,
>                 return -EINVAL;
>
>         /* readjust the vma */
> -       if (vma->vm_file)
> -               fput(vma->vm_file);
> -
> +       get_file(dmabuf->file);
> +       oldfile = vma->vm_file;
>         vma->vm_file = dmabuf->file;
> -       get_file(vma->vm_file);
> -
>         vma->vm_pgoff = pgoff;
>
> -       return dmabuf->ops->mmap(dmabuf, vma);
> +       ret = dmabuf->ops->mmap(dmabuf, vma);
> +       if (ret) {
> +               /* restore old parameters on failure */
> +               vma->vm_file = oldfile;
> +               fput(dmabuf->file);
> +       } else {
> +               if (oldfile)
> +                       fput(oldfile);
> +       }
> +       return ret;
>  }
>  EXPORT_SYMBOL_GPL(dma_buf_mmap);
>
> --
> 1.7.8.6
>
>


-- 

Thanks and regards,

Sumit Semwal

Linaro Kernel Engineer - Graphics working group

Linaro.org <http://www.linaro.org/>* **│ *Open source software for ARM SoCs*
***

Follow *Linaro: *Facebook <http://www.facebook.com/pages/Linaro> |
Twitter<http://twitter.com/#!/linaroorg>
 | Blog <http://www.linaro.org/linaro-blog/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20130212/fe3d741f/attachment.html>