DL-Mirrors/kernel-tenderloin-3.0
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mm: ashmem: Make sure vma is valid while flushing

Browse Source 
Ensure that the vma that the ashmem region is tied to
is valid before flushing and hold the mm semaphore so
that the vma does not get destroyed from under while
it's being flushed.

CRs-Fixed: 326685
Change-Id: I86320ffe9e6570e6ffa7dda68ab26be7aed86afd
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
This commit is contained in:
Shubhraprakash Das
2011-12-22 14:28:07 -07:00
parent 1aa4848c00
commit cf089c4da0
1 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
mm/ashmem.c
View File

@@ -673,10 +673,28 @@ static int ashmem_cache_op(struct ashmem_area *asma,
void (*cache_func)(unsigned long vstart, unsigned long length, void (*cache_func)(unsigned long vstart, unsigned long length,
unsigned long pstart)) unsigned long pstart))
{ {
int ret = 0;
struct vm_area_struct *vma;
#ifdef CONFIG_OUTER_CACHE #ifdef CONFIG_OUTER_CACHE
unsigned long vaddr; unsigned long vaddr;
#endif #endif
mutex_lock(&ashmem_mutex); if (!asma->vm_start)
return -EINVAL;
down_read(&current->mm->mmap_sem);
vma = find_vma(current->mm, asma->vm_start);
if (!vma) {
ret = -EINVAL;
goto done;
}
if (vma->vm_file != asma->file) {
ret = -EINVAL;
goto done;
}
if ((asma->vm_start + asma->size) > (vma->vm_start + vma->vm_end)) {
ret = -EINVAL;
goto done;
}
#ifndef CONFIG_OUTER_CACHE #ifndef CONFIG_OUTER_CACHE
cache_func(asma->vm_start, asma->size, 0); cache_func(asma->vm_start, asma->size, 0);
#else #else
@@ -689,8 +707,11 @@ static int ashmem_cache_op(struct ashmem_area *asma,
cache_func(vaddr, PAGE_SIZE, physaddr); cache_func(vaddr, PAGE_SIZE, physaddr);
} }
#endif #endif
mutex_unlock(&ashmem_mutex); done:
return 0; up_read(&current->mm->mmap_sem);
if (ret)
asma->vm_start = 0;
return ret;
} }
static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)