Merge tag 'v3.3-rc4' into for-3.4 in order to resolve the conflict

[firefly-linux-kernel-4.4.55.git] / drivers / staging / android / binder.c

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 7491801a661c683f8b0f5fe9c11f8c7c1e1d1b33..f0b7e6605ab5e4969d88a2112498439362454f82 100644 (file)
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -38,6 +38,7 @@
 
 static DEFINE_MUTEX(binder_lock);
 static DEFINE_MUTEX(binder_deferred_lock);
+static DEFINE_MUTEX(binder_mmap_lock);
 
 static HLIST_HEAD(binder_procs);
 static HLIST_HEAD(binder_deferred_list);
@@ -632,6 +633,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
        if (mm) {
                down_write(&mm->mmap_sem);
                vma = proc->vma;
+               if (vma && mm != vma->vm_mm) {
+                       pr_err("binder: %d: vma mm and task mm mismatch\n",
+                               proc->pid);
+                       vma = NULL;
+               }
        }
 
        if (allocate == 0)
@@ -2759,7 +2765,6 @@ static void binder_vma_open(struct vm_area_struct *vma)
                     proc->pid, vma->vm_start, vma->vm_end,
                     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
                     (unsigned long)pgprot_val(vma->vm_page_prot));
-       dump_stack();
 }
 
 static void binder_vma_close(struct vm_area_struct *vma)
@@ -2803,6 +2808,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
        }
        vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
 
+       mutex_lock(&binder_mmap_lock);
        if (proc->buffer) {
                ret = -EBUSY;
                failure_string = "already mapped";
@@ -2817,6 +2823,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
        }
        proc->buffer = area->addr;
        proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
+       mutex_unlock(&binder_mmap_lock);
 
 #ifdef CONFIG_CPU_CACHE_VIPT
        if (cache_is_vipt_aliasing()) {
@@ -2849,7 +2856,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
        binder_insert_free_buffer(proc, buffer);
        proc->free_async_space = proc->buffer_size / 2;
        barrier();
-       proc->files = get_files_struct(current);
+       proc->files = get_files_struct(proc->tsk);
        proc->vma = vma;
 
        /*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n",
@@ -2860,10 +2867,12 @@ err_alloc_small_buf_failed:
        kfree(proc->pages);
        proc->pages = NULL;
 err_alloc_pages_failed:
+       mutex_lock(&binder_mmap_lock);
        vfree(proc->buffer);
        proc->buffer = NULL;
 err_get_vm_area_failed:
 err_already_mapped:
+       mutex_unlock(&binder_mmap_lock);
 err_bad_arg:
        printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n",
               proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);