path: root/drivers/video/tegra
diff options
authorTuomas Tynkkynen <>2012-08-15 17:54:38 +0300
committerSimone Willett <>2012-08-27 17:17:27 -0700
commitce8ef677d55d74149d75a0ccf8e3b493bf68e110 (patch)
treee908741d51a483cad669e91e957ffb160aeb7315 /drivers/video/tegra
parentb536b496165f0de2e854e6297f54371e27233dd2 (diff)
video: tegra: nvmap: fix handle usecount tracking
A handle's usecount used to be incremented once during the mmap ioctl, and decremented when the mapping is closed by the kernel. However, that fails if a mapping cloned, for example if the mapping was split due to a munmap, or (presumably) during fork, as the decrement will then happen for each cloned mapping. Therefore increment the usecount when a mapping is opened. Also fix a BUG_ON() that would have caught this bug, if it wouldn't have done the check by checking if the unsigned usecount field is less than zero. Bug 1033981 Change-Id: I72ac9361a19e44f91ffd6b1126f4632e0f7b6726 Signed-off-by: Tuomas Tynkkynen <> Reviewed-on: http://git-master/r/123710 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Krishna Reddy <>
Diffstat (limited to 'drivers/video/tegra')
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/video/tegra/nvmap/nvmap_dev.c b/drivers/video/tegra/nvmap/nvmap_dev.c
index 98b0bcc..02ccaee 100644
--- a/drivers/video/tegra/nvmap/nvmap_dev.c
+++ b/drivers/video/tegra/nvmap/nvmap_dev.c
@@ -886,10 +886,11 @@ static void nvmap_vma_open(struct vm_area_struct *vma)
struct nvmap_vma_priv *priv;
priv = vma->vm_private_data;
+ if(priv->handle)
+ nvmap_usecount_inc(priv->handle);
static void nvmap_vma_close(struct vm_area_struct *vma)
@@ -898,8 +899,8 @@ static void nvmap_vma_close(struct vm_area_struct *vma)
if (priv) {
if (priv->handle) {
+ BUG_ON(priv->handle->usecount == 0);
- BUG_ON(priv->handle->usecount < 0);
if (!atomic_dec_return(&priv->count)) {
if (priv->handle)