Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4ddfc911 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg Committed by Greg Kroah-Hartman
Browse files

Staging: binder: mmap fixes. 



Only allow a binder file pointer to be mmapped once. The buffer management
code cannot deal with more then one area.
Also remove leftover mutex_unlock if mmap fails.

Signed-off-by: default avatarArve Hjønnevåg <arve@android.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 85e0b0cb

drivers/staging/android/binder.c

+9 −1
Original line number Original line Diff line number Diff line
@@ -2694,6 +2694,12 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 
	}

	}

	vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;

	vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;





	if (proc->buffer) {

		ret = -EBUSY;

		failure_string = "already mapped";

		goto err_already_mapped;

	}



	area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);

	area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);

	if (area == NULL) {

	if (area == NULL) {

		ret = -ENOMEM;

		ret = -ENOMEM;
@@ -2741,10 +2747,12 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 




err_alloc_small_buf_failed:

err_alloc_small_buf_failed:

	kfree(proc->pages);

	kfree(proc->pages);

	proc->pages = NULL;

err_alloc_pages_failed:

err_alloc_pages_failed:

	vfree(proc->buffer);

	vfree(proc->buffer);

	proc->buffer = NULL;

err_get_vm_area_failed:

err_get_vm_area_failed:

	mutex_unlock(&binder_lock);

err_already_mapped:

err_bad_arg:

err_bad_arg:

	printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n", proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);

	printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n", proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);

	return ret;

	return ret;