Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df30b21c authored by Federico Vaga's avatar Federico Vaga Committed by Greg Kroah-Hartman
Browse files

Staging: comedi: fix mmap_count 



In comedi_fops, mmap_count is decremented at comedi_vm_ops->close but
it is not incremented at comedi_vm_ops->open. This may result in a negative
counter.  The patch introduces the open method to keep the counter
consistent.

The bug was triggerd by this sample code:

        mmap(0, ...., comedi_fd);
        fork();
        exit(0);

Acked-by: default avatarAlessandro Rubini <rubini@gnudd.com>
Signed-off-by: default avatarFederico Vaga <federico.vaga@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 3ffab428

drivers/staging/comedi/comedi_fops.c

+17 −2
Original line number Diff line number Diff line
@@ -1432,7 +1432,21 @@ static int do_cancel(struct comedi_device *dev, struct comedi_subdevice *s) 
	return ret;

}



static void comedi_unmap(struct vm_area_struct *area)



static void comedi_vm_open(struct vm_area_struct *area)

{

	struct comedi_async *async;

	struct comedi_device *dev;



	async = area->vm_private_data;

	dev = async->subdevice->device;



	mutex_lock(&dev->mutex);

	async->mmap_count++;

	mutex_unlock(&dev->mutex);

}



static void comedi_vm_close(struct vm_area_struct *area)

{

	struct comedi_async *async;

	struct comedi_device *dev;
@@ -1446,7 +1460,8 @@ static void comedi_unmap(struct vm_area_struct *area) 
}



static struct vm_operations_struct comedi_vm_ops = {

	.close = comedi_unmap,

	.open = comedi_vm_open,

	.close = comedi_vm_close,

};



static int comedi_mmap(struct file *file, struct vm_area_struct *vma)