* cleanup a fix and add the vma_set_file function
@ 2020-11-06 11:48 Christian König
2020-11-06 11:48 ` [PATCH 1/2] mm: mmap: fix fput in error path v2 Christian König
2020-11-06 11:48 ` [PATCH 2/2] mm: introduce vma_set_file function v5 Christian König
0 siblings, 2 replies; 9+ messages in thread
From: Christian König @ 2020-11-06 11:48 UTC (permalink / raw)
To: akpm; +Cc: linux-mm, linux-kernel, linaro-mm-sig, dri-devel, linux-media
Hi Andrew,
can I get you Acked-by to merge this cleanup through the drm-misc-next branch? The affected drivers are mostly from the DRM subsystem.
The fix for the other problem you pointed out in mmap_region() has already shown up in that branch.
Thanks in advance,
Christian.
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 1/2] mm: mmap: fix fput in error path v2
2020-11-06 11:48 cleanup a fix and add the vma_set_file function Christian König
@ 2020-11-06 11:48 ` Christian König
2020-11-06 22:48 ` Andrew Morton
2020-11-06 11:48 ` [PATCH 2/2] mm: introduce vma_set_file function v5 Christian König
1 sibling, 1 reply; 9+ messages in thread
From: Christian König @ 2020-11-06 11:48 UTC (permalink / raw)
To: akpm; +Cc: linux-mm, linux-kernel, linaro-mm-sig, dri-devel, linux-media
Patch "495c10cc1c0c CHROMIUM: dma-buf: restore args..."
adds a workaround for a bug in mmap_region.
As the comment states ->mmap() callback can change
vma->vm_file and so we might call fput() on the wrong file.
Revert the workaround and proper fix this in mmap_region.
v2: drop the extra if in dma_buf_mmap as well
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
---
drivers/dma-buf/dma-buf.c | 20 +++-----------------
mm/mmap.c | 2 +-
2 files changed, 4 insertions(+), 18 deletions(-)
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 0eb80c1ecdab..282bd8b84170 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1166,9 +1166,6 @@ EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
unsigned long pgoff)
{
- struct file *oldfile;
- int ret;
-
if (WARN_ON(!dmabuf || !vma))
return -EINVAL;
@@ -1186,22 +1183,11 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
return -EINVAL;
/* readjust the vma */
- get_file(dmabuf->file);
- oldfile = vma->vm_file;
- vma->vm_file = dmabuf->file;
+ fput(vma->vm_file);
+ vma->vm_file = get_file(dmabuf->file);
vma->vm_pgoff = pgoff;
- ret = dmabuf->ops->mmap(dmabuf, vma);
- if (ret) {
- /* restore old parameters on failure */
- vma->vm_file = oldfile;
- fput(dmabuf->file);
- } else {
- if (oldfile)
- fput(oldfile);
- }
- return ret;
-
+ return dmabuf->ops->mmap(dmabuf, vma);
}
EXPORT_SYMBOL_GPL(dma_buf_mmap);
diff --git a/mm/mmap.c b/mm/mmap.c
index d91ecb00d38c..30a4e8412a58 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1899,8 +1899,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
return addr;
unmap_and_free_vma:
+ fput(vma->vm_file);
vma->vm_file = NULL;
- fput(file);
/* Undo any partial mapping done by a device driver. */
unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
--
2.25.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH 2/2] mm: introduce vma_set_file function v5
2020-11-06 11:48 cleanup a fix and add the vma_set_file function Christian König
2020-11-06 11:48 ` [PATCH 1/2] mm: mmap: fix fput in error path v2 Christian König
@ 2020-11-06 11:48 ` Christian König
1 sibling, 0 replies; 9+ messages in thread
From: Christian König @ 2020-11-06 11:48 UTC (permalink / raw)
To: akpm; +Cc: linux-mm, linux-kernel, linaro-mm-sig, dri-devel, linux-media
Add the new vma_set_file() function to allow changing
vma->vm_file with the necessary refcount dance.
v2: add more users of this.
v3: add missing EXPORT_SYMBOL, rebase on mmap cleanup,
add comments why we drop the reference on two occasions.
v4: make it clear that changing an anonymous vma is illegal.
v5: move vma_set_file to mm/util.c
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> (v2)
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
---
drivers/dma-buf/dma-buf.c | 3 +--
drivers/gpu/drm/etnaviv/etnaviv_gem.c | 4 +---
drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c | 3 +--
drivers/gpu/drm/i915/gem/i915_gem_mman.c | 5 +++--
drivers/gpu/drm/msm/msm_gem.c | 4 +---
drivers/gpu/drm/omapdrm/omap_gem.c | 3 +--
drivers/gpu/drm/vgem/vgem_drv.c | 3 +--
drivers/staging/android/ashmem.c | 6 +++---
include/linux/mm.h | 2 ++
mm/util.c | 12 ++++++++++++
10 files changed, 26 insertions(+), 19 deletions(-)
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 282bd8b84170..e63684d4cd90 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1183,8 +1183,7 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
return -EINVAL;
/* readjust the vma */
- fput(vma->vm_file);
- vma->vm_file = get_file(dmabuf->file);
+ vma_set_file(vma, dmabuf->file);
vma->vm_pgoff = pgoff;
return dmabuf->ops->mmap(dmabuf, vma);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index 67d9a2b9ea6a..4132acfa11be 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -145,10 +145,8 @@ static int etnaviv_gem_mmap_obj(struct etnaviv_gem_object *etnaviv_obj,
* address_space (so unmap_mapping_range does what we want,
* in particular in the case of mmap'd dmabufs)
*/
- fput(vma->vm_file);
- get_file(etnaviv_obj->base.filp);
vma->vm_pgoff = 0;
- vma->vm_file = etnaviv_obj->base.filp;
+ vma_set_file(vma, etnaviv_obj->base.filp);
vma->vm_page_prot = vm_page_prot;
}
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c
index 0dd477e56573..04e9c04545ad 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c
@@ -114,8 +114,7 @@ static int i915_gem_dmabuf_mmap(struct dma_buf *dma_buf, struct vm_area_struct *
if (ret)
return ret;
- fput(vma->vm_file);
- vma->vm_file = get_file(obj->base.filp);
+ vma_set_file(vma, obj->base.filp);
return 0;
}
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
index 3d69e51f3e4d..ec28a6cde49b 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
@@ -893,8 +893,9 @@ int i915_gem_mmap(struct file *filp, struct vm_area_struct *vma)
* requires avoiding extraneous references to their filp, hence why
* we prefer to use an anonymous file for their mmaps.
*/
- fput(vma->vm_file);
- vma->vm_file = anon;
+ vma_set_file(vma, anon);
+ /* Drop the initial creation reference, the vma is now holding one. */
+ fput(anon);
switch (mmo->mmap_type) {
case I915_MMAP_TYPE_WC:
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 2e1bce7c0b19..311721ceee50 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -212,10 +212,8 @@ int msm_gem_mmap_obj(struct drm_gem_object *obj,
* address_space (so unmap_mapping_range does what we want,
* in particular in the case of mmap'd dmabufs)
*/
- fput(vma->vm_file);
- get_file(obj->filp);
vma->vm_pgoff = 0;
- vma->vm_file = obj->filp;
+ vma_set_file(vma, obj->filp);
vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
}
diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
index d8e09792793a..f063f5a04fb0 100644
--- a/drivers/gpu/drm/omapdrm/omap_gem.c
+++ b/drivers/gpu/drm/omapdrm/omap_gem.c
@@ -564,9 +564,8 @@ int omap_gem_mmap_obj(struct drm_gem_object *obj,
* address_space (so unmap_mapping_range does what we want,
* in particular in the case of mmap'd dmabufs)
*/
- fput(vma->vm_file);
vma->vm_pgoff = 0;
- vma->vm_file = get_file(obj->filp);
+ vma_set_file(vma, obj->filp);
vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
}
diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
index fa54a6d1403d..ea0eecae5153 100644
--- a/drivers/gpu/drm/vgem/vgem_drv.c
+++ b/drivers/gpu/drm/vgem/vgem_drv.c
@@ -397,8 +397,7 @@ static int vgem_prime_mmap(struct drm_gem_object *obj,
if (ret)
return ret;
- fput(vma->vm_file);
- vma->vm_file = get_file(obj->filp);
+ vma_set_file(vma, obj->filp);
vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 10b4be1f3e78..4789d36ddfd3 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -450,9 +450,9 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
vma_set_anonymous(vma);
}
- if (vma->vm_file)
- fput(vma->vm_file);
- vma->vm_file = asma->file;
+ vma_set_file(vma, asma->file);
+ /* XXX: merge this with the get_file() above if possible */
+ fput(asma->file);
out:
mutex_unlock(&ashmem_mutex);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index ef360fe70aaf..2b7ac36c42dd 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2719,6 +2719,8 @@ static inline void vma_set_page_prot(struct vm_area_struct *vma)
}
#endif
+void vma_set_file(struct vm_area_struct *vma, struct file *file);
+
#ifdef CONFIG_NUMA_BALANCING
unsigned long change_prot_numa(struct vm_area_struct *vma,
unsigned long start, unsigned long end);
diff --git a/mm/util.c b/mm/util.c
index 4ddb6e186dd5..8c9b7d1e7c49 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -311,6 +311,18 @@ int vma_is_stack_for_current(struct vm_area_struct *vma)
return (vma->vm_start <= KSTK_ESP(t) && vma->vm_end >= KSTK_ESP(t));
}
+/*
+ * Change backing file, only valid to use during initial VMA setup.
+ */
+void vma_set_file(struct vm_area_struct *vma, struct file *file)
+{
+ /* Changing an anonymous vma with this is illegal */
+ get_file(file);
+ swap(vma->vm_file, file);
+ fput(file);
+}
+EXPORT_SYMBOL(vma_set_file);
+
#ifndef STACK_RND_MASK
#define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */
#endif
--
2.25.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] mm: mmap: fix fput in error path v2
2020-11-06 11:48 ` [PATCH 1/2] mm: mmap: fix fput in error path v2 Christian König
@ 2020-11-06 22:48 ` Andrew Morton
2020-11-18 10:57 ` Christian König
0 siblings, 1 reply; 9+ messages in thread
From: Andrew Morton @ 2020-11-06 22:48 UTC (permalink / raw)
To: Christian König
Cc: linux-mm, linux-kernel, linaro-mm-sig, dri-devel, linux-media
On Fri, 6 Nov 2020 12:48:05 +0100 "Christian König" <ckoenig.leichtzumerken@gmail.com> wrote:
> Patch "495c10cc1c0c CHROMIUM: dma-buf: restore args..."
> adds a workaround for a bug in mmap_region.
>
> As the comment states ->mmap() callback can change
> vma->vm_file and so we might call fput() on the wrong file.
>
> Revert the workaround and proper fix this in mmap_region.
>
Seems correct, best I can tell. Presumably all ->mmap() instances will
correctly fput() to original file* if they're rewriting vma->vm_file.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] mm: mmap: fix fput in error path v2
2020-11-06 22:48 ` Andrew Morton
@ 2020-11-18 10:57 ` Christian König
2020-11-18 22:27 ` Andrew Morton
0 siblings, 1 reply; 9+ messages in thread
From: Christian König @ 2020-11-18 10:57 UTC (permalink / raw)
To: Andrew Morton
Cc: linux-mm, linux-kernel, linaro-mm-sig, dri-devel, linux-media
Am 06.11.20 um 23:48 schrieb Andrew Morton:
> On Fri, 6 Nov 2020 12:48:05 +0100 "Christian König" <ckoenig.leichtzumerken@gmail.com> wrote:
>
>> Patch "495c10cc1c0c CHROMIUM: dma-buf: restore args..."
>> adds a workaround for a bug in mmap_region.
>>
>> As the comment states ->mmap() callback can change
>> vma->vm_file and so we might call fput() on the wrong file.
>>
>> Revert the workaround and proper fix this in mmap_region.
>>
> Seems correct, best I can tell. Presumably all ->mmap() instances will
> correctly fput() to original file* if they're rewriting vma->vm_file.
Yes, exactly.
Patch #2 provides a helper to make sure that everybody gets the
get_file()/fput() correctly while updating vma->vm_file.
Can I add your acked-by to the patches and push them upstream through
drm-misc-next?
Thanks,
Christian.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] mm: mmap: fix fput in error path v2
2020-11-18 10:57 ` Christian König
@ 2020-11-18 22:27 ` Andrew Morton
0 siblings, 0 replies; 9+ messages in thread
From: Andrew Morton @ 2020-11-18 22:27 UTC (permalink / raw)
To: christian.koenig
Cc: Christian König, linux-mm, linux-kernel, linaro-mm-sig,
dri-devel, linux-media
On Wed, 18 Nov 2020 11:57:44 +0100 Christian König <ckoenig.leichtzumerken@gmail.com> wrote:
> Am 06.11.20 um 23:48 schrieb Andrew Morton:
> > On Fri, 6 Nov 2020 12:48:05 +0100 "Christian König" <ckoenig.leichtzumerken@gmail.com> wrote:
> >
> >> Patch "495c10cc1c0c CHROMIUM: dma-buf: restore args..."
> >> adds a workaround for a bug in mmap_region.
> >>
> >> As the comment states ->mmap() callback can change
> >> vma->vm_file and so we might call fput() on the wrong file.
> >>
> >> Revert the workaround and proper fix this in mmap_region.
> >>
> > Seems correct, best I can tell. Presumably all ->mmap() instances will
> > correctly fput() to original file* if they're rewriting vma->vm_file.
>
> Yes, exactly.
>
> Patch #2 provides a helper to make sure that everybody gets the
> get_file()/fput() correctly while updating vma->vm_file.
>
> Can I add your acked-by to the patches and push them upstream through
> drm-misc-next?
Please go ahead.
Acked-by: Andrew Morton <akpm@linux-foundation.org>
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] mm: mmap: fix fput in error path v2
2020-10-12 8:52 [PATCH 1/2] mm: mmap: fix fput in error path v2 Christian König
2020-10-16 16:13 ` Jason Gunthorpe
@ 2020-11-04 8:03 ` Christian König
1 sibling, 0 replies; 9+ messages in thread
From: Christian König @ 2020-11-04 8:03 UTC (permalink / raw)
To: akpm, linux-mm, linux-kernel, linaro-mm-sig, dri-devel,
linux-media, chris, airlied, daniel, sumit.semwal, willy,
jhubbard, jgg, linmiaohe
If nobody comes up with an objections I'm going to merge that through
drm-misc-next.
Thanks,
Christian.
Am 12.10.20 um 10:52 schrieb Christian König:
> Patch "495c10cc1c0c CHROMIUM: dma-buf: restore args..."
> adds a workaround for a bug in mmap_region.
>
> As the comment states ->mmap() callback can change
> vma->vm_file and so we might call fput() on the wrong file.
>
> Revert the workaround and proper fix this in mmap_region.
>
> v2: drop the extra if in dma_buf_mmap as well
>
> Signed-off-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
> drivers/dma-buf/dma-buf.c | 20 +++-----------------
> mm/mmap.c | 2 +-
> 2 files changed, 4 insertions(+), 18 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
> index a6ba4d598f0e..08630d057cf2 100644
> --- a/drivers/dma-buf/dma-buf.c
> +++ b/drivers/dma-buf/dma-buf.c
> @@ -1143,9 +1143,6 @@ EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
> int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
> unsigned long pgoff)
> {
> - struct file *oldfile;
> - int ret;
> -
> if (WARN_ON(!dmabuf || !vma))
> return -EINVAL;
>
> @@ -1163,22 +1160,11 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
> return -EINVAL;
>
> /* readjust the vma */
> - get_file(dmabuf->file);
> - oldfile = vma->vm_file;
> - vma->vm_file = dmabuf->file;
> + fput(vma->vm_file);
> + vma->vm_file = get_file(dmabuf->file);
> vma->vm_pgoff = pgoff;
>
> - ret = dmabuf->ops->mmap(dmabuf, vma);
> - if (ret) {
> - /* restore old parameters on failure */
> - vma->vm_file = oldfile;
> - fput(dmabuf->file);
> - } else {
> - if (oldfile)
> - fput(oldfile);
> - }
> - return ret;
> -
> + return dmabuf->ops->mmap(dmabuf, vma);
> }
> EXPORT_SYMBOL_GPL(dma_buf_mmap);
>
> diff --git a/mm/mmap.c b/mm/mmap.c
> index 40248d84ad5f..3a2670d73355 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -1852,8 +1852,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
> return addr;
>
> unmap_and_free_vma:
> + fput(vma->vm_file);
> vma->vm_file = NULL;
> - fput(file);
>
> /* Undo any partial mapping done by a device driver. */
> unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH 1/2] mm: mmap: fix fput in error path v2
2020-10-12 8:52 [PATCH 1/2] mm: mmap: fix fput in error path v2 Christian König
@ 2020-10-16 16:13 ` Jason Gunthorpe
2020-11-04 8:03 ` Christian König
1 sibling, 0 replies; 9+ messages in thread
From: Jason Gunthorpe @ 2020-10-16 16:13 UTC (permalink / raw)
To: Christian König
Cc: akpm, linux-mm, linux-kernel, linaro-mm-sig, dri-devel,
linux-media, chris, airlied, daniel, sumit.semwal, willy,
jhubbard, linmiaohe
On Mon, Oct 12, 2020 at 10:52:02AM +0200, Christian König wrote:
> Patch "495c10cc1c0c CHROMIUM: dma-buf: restore args..."
> adds a workaround for a bug in mmap_region.
>
> As the comment states ->mmap() callback can change
> vma->vm_file and so we might call fput() on the wrong file.
>
> Revert the workaround and proper fix this in mmap_region.
>
> v2: drop the extra if in dma_buf_mmap as well
>
> Signed-off-by: Christian König <christian.koenig@amd.com>
> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
> drivers/dma-buf/dma-buf.c | 20 +++-----------------
> mm/mmap.c | 2 +-
> 2 files changed, 4 insertions(+), 18 deletions(-)
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Probably should Fixes that other patch Andrew pointed at
Jason
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH 1/2] mm: mmap: fix fput in error path v2
@ 2020-10-12 8:52 Christian König
2020-10-16 16:13 ` Jason Gunthorpe
2020-11-04 8:03 ` Christian König
0 siblings, 2 replies; 9+ messages in thread
From: Christian König @ 2020-10-12 8:52 UTC (permalink / raw)
To: akpm, linux-mm, linux-kernel, linaro-mm-sig, dri-devel,
linux-media, chris, airlied, daniel, sumit.semwal, willy,
jhubbard, jgg, linmiaohe
Patch "495c10cc1c0c CHROMIUM: dma-buf: restore args..."
adds a workaround for a bug in mmap_region.
As the comment states ->mmap() callback can change
vma->vm_file and so we might call fput() on the wrong file.
Revert the workaround and proper fix this in mmap_region.
v2: drop the extra if in dma_buf_mmap as well
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
---
drivers/dma-buf/dma-buf.c | 20 +++-----------------
mm/mmap.c | 2 +-
2 files changed, 4 insertions(+), 18 deletions(-)
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index a6ba4d598f0e..08630d057cf2 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1143,9 +1143,6 @@ EXPORT_SYMBOL_GPL(dma_buf_end_cpu_access);
int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
unsigned long pgoff)
{
- struct file *oldfile;
- int ret;
-
if (WARN_ON(!dmabuf || !vma))
return -EINVAL;
@@ -1163,22 +1160,11 @@ int dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma,
return -EINVAL;
/* readjust the vma */
- get_file(dmabuf->file);
- oldfile = vma->vm_file;
- vma->vm_file = dmabuf->file;
+ fput(vma->vm_file);
+ vma->vm_file = get_file(dmabuf->file);
vma->vm_pgoff = pgoff;
- ret = dmabuf->ops->mmap(dmabuf, vma);
- if (ret) {
- /* restore old parameters on failure */
- vma->vm_file = oldfile;
- fput(dmabuf->file);
- } else {
- if (oldfile)
- fput(oldfile);
- }
- return ret;
-
+ return dmabuf->ops->mmap(dmabuf, vma);
}
EXPORT_SYMBOL_GPL(dma_buf_mmap);
diff --git a/mm/mmap.c b/mm/mmap.c
index 40248d84ad5f..3a2670d73355 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1852,8 +1852,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
return addr;
unmap_and_free_vma:
+ fput(vma->vm_file);
vma->vm_file = NULL;
- fput(file);
/* Undo any partial mapping done by a device driver. */
unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
--
2.17.1
^ permalink raw reply related [flat|nested] 9+ messages in thread
end of thread, other threads:[~2020-11-18 22:27 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-06 11:48 cleanup a fix and add the vma_set_file function Christian König
2020-11-06 11:48 ` [PATCH 1/2] mm: mmap: fix fput in error path v2 Christian König
2020-11-06 22:48 ` Andrew Morton
2020-11-18 10:57 ` Christian König
2020-11-18 22:27 ` Andrew Morton
2020-11-06 11:48 ` [PATCH 2/2] mm: introduce vma_set_file function v5 Christian König
-- strict thread matches above, loose matches on Subject: below --
2020-10-12 8:52 [PATCH 1/2] mm: mmap: fix fput in error path v2 Christian König
2020-10-16 16:13 ` Jason Gunthorpe
2020-11-04 8:03 ` Christian König
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).