video: tegra: nvmap: track vma for all handles

Clean up the code related to mmap and handle nvmap_map_info_caller_ptr
failures graciously.
Initilize h->vmas at right place.
Add sanity checks in nvmap_vma_open/_close.

Bug 1519700

Change-Id: Iede355b8a500a787992fcb23a72cf334a737ec49
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: http://git-master/r/419168
(cherry picked from commit c18228c5de319d74f68deff9c5d402ca17b64e95)
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/426092
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>

1 files changed, 16 insertions, 17 deletions

diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c
index a3d39f509633..d9853e179f85 100644
--- a/drivers/video/tegra/nvmap/nvmap_ioctl.c
+++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c
@@ -425,7 +425,7 @@ int nvmap_map_into_caller_ptr(struct file *filp, void __user *arg, bool is32)
 #ifdef CONFIG_COMPAT
 	struct nvmap_map_caller_32 op32;
 #endif
-	struct nvmap_vma_priv *vpriv;
+	struct nvmap_vma_priv *priv;
 	struct vm_area_struct *vma;
 	struct nvmap_handle *h = NULL;
 	int err = 0;
@@ -464,7 +464,7 @@ int nvmap_map_into_caller_ptr(struct file *filp, void __user *arg, bool is32)
 	down_read(&current->mm->mmap_sem);
 
 	vma = find_vma(current->mm, op.addr);
-	if (!vma || !vma->vm_private_data) {
+	if (!vma) {
 		err = -ENOMEM;
 		goto out;
 	}
@@ -479,9 +479,6 @@ int nvmap_map_into_caller_ptr(struct file *filp, void __user *arg, bool is32)
 		goto out;
 	}
 
-	vpriv = vma->vm_private_data;
-	BUG_ON(!vpriv);
-
 	/* the VMA must exactly match the requested mapping operation, and the
 	 * VMA that is targetted must have been created by this driver
 	 */
@@ -492,22 +489,24 @@ int nvmap_map_into_caller_ptr(struct file *filp, void __user *arg, bool is32)
 	}
 
 	/* verify that each mmap() system call creates a unique VMA */
-
-	if (vpriv->handle && (h == vpriv->handle)) {
+	if (vma->vm_private_data)
 		goto out;
-	} else if (vpriv->handle) {
-		err = -EADDRNOTAVAIL;
-		goto out;
-	}
 
 	if (!h->heap_pgalloc && (h->carveout->base & ~PAGE_MASK)) {
 		err = -EFAULT;
 		goto out;
 	}
 
+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+	if (!priv)  {
+		err = -ENOMEM;
+		goto out;
+	}
+
 	vma->vm_flags |= (h->heap_pgalloc ? 0 : VM_PFNMAP);
-	vpriv->handle = h;
-	vpriv->offs = op.offset;
+	priv->handle = h;
+	priv->offs = op.offset;
+	vma->vm_private_data = priv;
 	vma->vm_page_prot = nvmap_pgprot(h, vma->vm_page_prot);
 	nvmap_vma_open(vma);
 
@@ -640,7 +639,7 @@ static int __nvmap_cache_maint(struct nvmap_client *client,
 			       struct nvmap_cache_op *op)
 {
 	struct vm_area_struct *vma;
-	struct nvmap_vma_priv *vpriv;
+	struct nvmap_vma_priv *priv;
 	struct nvmap_handle *handle;
 	unsigned long start;
 	unsigned long end;
@@ -662,9 +661,9 @@ static int __nvmap_cache_maint(struct nvmap_client *client,
 		goto out;
 	}
 
-	vpriv = (struct nvmap_vma_priv *)vma->vm_private_data;
+	priv = (struct nvmap_vma_priv *)vma->vm_private_data;
 
-	if (vpriv->handle != handle) {
+	if (priv->handle != handle) {
 		err = -EFAULT;
 		goto out;
 	}
@@ -673,7 +672,7 @@ static int __nvmap_cache_maint(struct nvmap_client *client,
 		(vma->vm_pgoff << PAGE_SHIFT);
 	end = start + op->len;
 
-	err = __nvmap_do_cache_maint(client, vpriv->handle, start, end, op->op,
+	err = __nvmap_do_cache_maint(client, priv->handle, start, end, op->op,
 				     false);
 out:
 	up_read(&current->mm->mmap_sem);