+dri-devel ML
>
>
> On 12 February 2013 07:20, <sheu@xxxxxxxxxx> wrote:
>>
>> From: John Sheu <sheu@xxxxxxxxxx>
>>
>> Callers to dma_buf_mmap expect to fput() the vma struct's vm_file
>> themselves on failure. Not restoring the struct's data on failure
>> causes a double-decrement of the vm_file's refcount.
>>
>> Signed-off-by: John Sheu <sheu@xxxxxxxxxx>
>>
>> ---
>> drivers/base/dma-buf.c | 21 +++++++++++++++------
>> 1 files changed, 15 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c
>> index 09e6878..06c6225 100644
>> --- a/drivers/base/dma-buf.c
>> +++ b/drivers/base/dma-buf.c
>> @@ -536,6 +536,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap);
>> int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
>> unsigned long pgoff)
>> {
>> + struct file *oldfile;
>> + int ret;
>> +
>> if (WARN_ON(!dmabuf || !vma))
>> return -EINVAL;
>>
>> @@ -549,15 +552,21 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct
>> vm_area_struct *vma,
>> return -EINVAL;
>>
>> /* readjust the vma */
>> - if (vma->vm_file)
>> - fput(vma->vm_file);
>> -
>> + get_file(dmabuf->file);
>> + oldfile = vma->vm_file;
>> vma->vm_file = dmabuf->file;
>> - get_file(vma->vm_file);
>> -
>> vma->vm_pgoff = pgoff;
>>
>> - return dmabuf->ops->mmap(dmabuf, vma);
>> + ret = dmabuf->ops->mmap(dmabuf, vma);
>> + if (ret) {
>> + /* restore old parameters on failure */
>> + vma->vm_file = oldfile;
>> + fput(dmabuf->file);
>> + } else {
>> + if (oldfile)
>> + fput(oldfile);
>> + }
>> + return ret;
>> }
>> EXPORT_SYMBOL_GPL(dma_buf_mmap);
>>
>> --
>> 1.7.8.6
>>
>
>
>
> --
>
> Thanks and regards,
>
> Sumit Semwal
>
> Linaro Kernel Engineer - Graphics working group
>
> Linaro.org │ Open source software for ARM SoCs
>
> Follow Linaro: Facebook | Twitter | Blog
--
Thanks and regards,
Sumit Semwal
Linaro Kernel Engineer - Graphics working group
Linaro.org │ Open source software for ARM SoCs
Follow Linaro: Facebook | Twitter | Blog
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
