Commit 495c10cc authored by John Sheu's avatar John Sheu Committed by Sumit Semwal

CHROMIUM: dma-buf: restore args on failure of dma_buf_mmap

Callers to dma_buf_mmap expect to fput() the vma struct's vm_file
themselves on failure.  Not restoring the struct's data on failure
causes a double-decrement of the vm_file's refcount.
Signed-off-by: default avatarJohn Sheu <sheu@google.com>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarSumit Semwal <sumit.semwal@linaro.org>
parent f00b4dad
...@@ -447,6 +447,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap); ...@@ -447,6 +447,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap);
int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
unsigned long pgoff) unsigned long pgoff)
{ {
struct file *oldfile;
int ret;
if (WARN_ON(!dmabuf || !vma)) if (WARN_ON(!dmabuf || !vma))
return -EINVAL; return -EINVAL;
...@@ -460,14 +463,22 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, ...@@ -460,14 +463,22 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
return -EINVAL; return -EINVAL;
/* readjust the vma */ /* readjust the vma */
if (vma->vm_file) get_file(dmabuf->file);
fput(vma->vm_file); oldfile = vma->vm_file;
vma->vm_file = dmabuf->file;
vma->vm_file = get_file(dmabuf->file);
vma->vm_pgoff = pgoff; vma->vm_pgoff = pgoff;
return dmabuf->ops->mmap(dmabuf, vma); ret = dmabuf->ops->mmap(dmabuf, vma);
if (ret) {
/* restore old parameters on failure */
vma->vm_file = oldfile;
fput(dmabuf->file);
} else {
if (oldfile)
fput(oldfile);
}
return ret;
} }
EXPORT_SYMBOL_GPL(dma_buf_mmap); EXPORT_SYMBOL_GPL(dma_buf_mmap);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment