+dri-devel ML
On 12 February 2013 07:20, sheu@google.com wrote:
From: John Sheu sheu@google.com
Callers to dma_buf_mmap expect to fput() the vma struct's vm_file themselves on failure. Not restoring the struct's data on failure causes a double-decrement of the vm_file's refcount.
Signed-off-by: John Sheu sheu@google.com
drivers/base/dma-buf.c | 21 +++++++++++++++------ 1 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c index 09e6878..06c6225 100644 --- a/drivers/base/dma-buf.c +++ b/drivers/base/dma-buf.c @@ -536,6 +536,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap); int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, unsigned long pgoff) {
struct file *oldfile;int ret;if (WARN_ON(!dmabuf || !vma)) return -EINVAL;@@ -549,15 +552,21 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, return -EINVAL;
/* readjust the vma */
if (vma->vm_file)fput(vma->vm_file);
get_file(dmabuf->file);oldfile = vma->vm_file; vma->vm_file = dmabuf->file;
get_file(vma->vm_file);vma->vm_pgoff = pgoff;return dmabuf->ops->mmap(dmabuf, vma);
ret = dmabuf->ops->mmap(dmabuf, vma);if (ret) {/* restore old parameters on failure */vma->vm_file = oldfile;fput(dmabuf->file);} else {if (oldfile)fput(oldfile);}return ret;} EXPORT_SYMBOL_GPL(dma_buf_mmap);
-- 1.7.8.6