diff options
| author | Tuomas Tynkkynen <ttynkkynen@nvidia.com> | 2012-08-15 17:54:38 +0300 |
|---|---|---|
| committer | Simone Willett <swillett@nvidia.com> | 2012-08-27 17:17:27 -0700 |
| commit | ce8ef677d55d74149d75a0ccf8e3b493bf68e110 (patch) | |
| tree | e908741d51a483cad669e91e957ffb160aeb7315 /drivers/video/tegra | |
| parent | b536b496165f0de2e854e6297f54371e27233dd2 (diff) | |
video: tegra: nvmap: fix handle usecount tracking
A handle's usecount used to be incremented once during the mmap ioctl,
and decremented when the mapping is closed by the kernel. However, that
fails if a mapping cloned, for example if the mapping was split due to
a munmap, or (presumably) during fork, as the decrement will then happen
for each cloned mapping.
Therefore increment the usecount when a mapping is opened.
Also fix a BUG_ON() that would have caught this bug, if it wouldn't
have done the check by checking if the unsigned usecount field is
less than zero.
Bug 1033981
Change-Id: I72ac9361a19e44f91ffd6b1126f4632e0f7b6726
Signed-off-by: Tuomas Tynkkynen <ttynkkynen@nvidia.com>
Reviewed-on: http://git-master/r/123710
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Krishna Reddy <vdumpa@nvidia.com>
Diffstat (limited to 'drivers/video/tegra')
| -rw-r--r-- | drivers/video/tegra/nvmap/nvmap_dev.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/video/tegra/nvmap/nvmap_dev.c b/drivers/video/tegra/nvmap/nvmap_dev.c index 98b0bcc18ba5..02ccaeec4965 100644 --- a/drivers/video/tegra/nvmap/nvmap_dev.c +++ b/drivers/video/tegra/nvmap/nvmap_dev.c @@ -886,10 +886,11 @@ static void nvmap_vma_open(struct vm_area_struct *vma) struct nvmap_vma_priv *priv; priv = vma->vm_private_data; - BUG_ON(!priv); atomic_inc(&priv->count); + if(priv->handle) + nvmap_usecount_inc(priv->handle); } static void nvmap_vma_close(struct vm_area_struct *vma) @@ -898,8 +899,8 @@ static void nvmap_vma_close(struct vm_area_struct *vma) if (priv) { if (priv->handle) { + BUG_ON(priv->handle->usecount == 0); nvmap_usecount_dec(priv->handle); - BUG_ON(priv->handle->usecount < 0); } if (!atomic_dec_return(&priv->count)) { if (priv->handle) |