diff options
| author | John Sheu <sheu@google.com> | 2013-02-11 17:50:24 -0800 |
|---|---|---|
| committer | Sumit Semwal <sumit.semwal@linaro.org> | 2013-02-27 15:14:02 +0530 |
| commit | 495c10cc1c0c359871d5bef32dd173252fc17995 (patch) | |
| tree | 5cc942ec2c74496dd3774dffff5cdde67cd75ae0 | |
| parent | f00b4dad9d9eb001a04cf72e8351a2a1b9e99322 (diff) | |
CHROMIUM: dma-buf: restore args on failure of dma_buf_mmap
Callers to dma_buf_mmap expect to fput() the vma struct's vm_file
themselves on failure. Not restoring the struct's data on failure
causes a double-decrement of the vm_file's refcount.
Signed-off-by: John Sheu <sheu@google.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
| -rw-r--r-- | drivers/base/dma-buf.c | 23 |
1 files changed, 17 insertions, 6 deletions
diff --git a/drivers/base/dma-buf.c b/drivers/base/dma-buf.c index 394523807a6..2a7cb0df176 100644 --- a/drivers/base/dma-buf.c +++ b/drivers/base/dma-buf.c @@ -447,6 +447,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap); int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, unsigned long pgoff) { + struct file *oldfile; + int ret; + if (WARN_ON(!dmabuf || !vma)) return -EINVAL; @@ -460,14 +463,22 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, return -EINVAL; /* readjust the vma */ - if (vma->vm_file) - fput(vma->vm_file); - - vma->vm_file = get_file(dmabuf->file); - + get_file(dmabuf->file); + oldfile = vma->vm_file; + vma->vm_file = dmabuf->file; vma->vm_pgoff = pgoff; - return dmabuf->ops->mmap(dmabuf, vma); + ret = dmabuf->ops->mmap(dmabuf, vma); + if (ret) { + /* restore old parameters on failure */ + vma->vm_file = oldfile; + fput(dmabuf->file); + } else { + if (oldfile) + fput(oldfile); + } + return ret; + } EXPORT_SYMBOL_GPL(dma_buf_mmap); |