Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 495c10cc authored by John Sheu's avatar John Sheu Committed by Sumit Semwal
Browse files

CHROMIUM: dma-buf: restore args on failure of dma_buf_mmap 



Callers to dma_buf_mmap expect to fput() the vma struct's vm_file
themselves on failure.  Not restoring the struct's data on failure
causes a double-decrement of the vm_file's refcount.

Signed-off-by: default avatarJohn Sheu <sheu@google.com>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarSumit Semwal <sumit.semwal@linaro.org>
parent f00b4dad

drivers/base/dma-buf.c

+17 −6
Original line number Diff line number Diff line
@@ -447,6 +447,9 @@ EXPORT_SYMBOL_GPL(dma_buf_kunmap); 
int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,

		 unsigned long pgoff)

{

	struct file *oldfile;

	int ret;



	if (WARN_ON(!dmabuf || !vma))

		return -EINVAL;
@@ -460,14 +463,22 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma, 
		return -EINVAL;



	/* readjust the vma */

	if (vma->vm_file)

		fput(vma->vm_file);



	vma->vm_file = get_file(dmabuf->file);



	get_file(dmabuf->file);

	oldfile = vma->vm_file;

	vma->vm_file = dmabuf->file;

	vma->vm_pgoff = pgoff;



	return dmabuf->ops->mmap(dmabuf, vma);

	ret = dmabuf->ops->mmap(dmabuf, vma);

	if (ret) {

		/* restore old parameters on failure */

		vma->vm_file = oldfile;

		fput(dmabuf->file);

	} else {

		if (oldfile)

			fput(oldfile);

	}

	return ret;



}

EXPORT_SYMBOL_GPL(dma_buf_mmap);