forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2023-12-08 01573e231f18eb2d99162747186f59511f56b64d 
 kernel/drivers/staging/android/ashmem.c
....@@ -138,7 +138,8 @@
138138 		page_range_subsumes_range(range, start, end);
139139 }
140140 
141
-static inline bool range_before_page(struct ashmem_range *range, size_t page)
141
+static inline bool range_before_page(struct ashmem_range *range,
142
+				     size_t page)
142143 {
143144 	return range->pgend < page;
144145 }
....@@ -201,7 +202,7 @@
201202 }
202203 
203204 /**
204
- * range_del() - Deletes and dealloctes an ashmem_range structure
205
+ * range_del() - Deletes and deallocates an ashmem_range structure
205206  * @range:	 The associated ashmem_range that has previously been allocated
206207  */
207208 static void range_del(struct ashmem_range *range)
....@@ -566,24 +567,24 @@
566567 
567568 	/*
568569 	 * Holding the ashmem_mutex while doing a copy_from_user might cause
569
-	 * an data abort which would try to access mmap_sem. If another
570
+	 * an data abort which would try to access mmap_lock. If another
570571 	 * thread has invoked ashmem_mmap then it will be holding the
571572 	 * semaphore and will be waiting for ashmem_mutex, there by leading to
572
-	 * deadlock. We'll release the mutex  and take the name to a local
573
+	 * deadlock. We'll release the mutex and take the name to a local
573574 	 * variable that does not need protection and later copy the local
574575 	 * variable to the structure member with lock held.
575576 	 */
576577 	len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN);
577578 	if (len < 0)
578579 		return len;
579
-	if (len == ASHMEM_NAME_LEN)
580
-		local_name[ASHMEM_NAME_LEN - 1] = '\0';
580
+
581581 	mutex_lock(&ashmem_mutex);
582582 	/* cannot change an existing mapping's name */
583583 	if (asma->file)
584584 		ret = -EINVAL;
585585 	else
586
-		strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name);
586
+		strscpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name,
587
+			ASHMEM_NAME_LEN);
587588 
588589 	mutex_unlock(&ashmem_mutex);
589590 	return ret;
....@@ -597,7 +598,7 @@
597598 	 * Have a local variable to which we'll copy the content
598599 	 * from asma with the lock held. Later we can copy this to the user
599600 	 * space safely without holding any locks. So even if we proceed to
600
-	 * wait for mmap_sem, it won't lead to deadlock.
601
+	 * wait for mmap_lock, it won't lead to deadlock.
601602 	 */
602603 	char local_name[ASHMEM_NAME_LEN];
603604 
....@@ -893,6 +894,8 @@
893894 		seq_printf(m, "name:\t%s\n",
894895 			   asma->name + ASHMEM_NAME_PREFIX_LEN);
895896 
897
+	seq_printf(m, "size:\t%zu\n", asma->size);
898
+
896899 	mutex_unlock(&ashmem_mutex);
897900 }
898901 #endif
....@@ -912,6 +915,15 @@
912915 #endif
913916 };
914917 
918
+/*
919
+ * is_ashmem_file - Check if struct file* is associated with ashmem
920
+ */
921
+int is_ashmem_file(struct file *file)
922
+{
923
+	return file->f_op == &ashmem_fops;
924
+}
925
+EXPORT_SYMBOL_GPL(is_ashmem_file);
926
+
915927 static struct miscdevice ashmem_misc = {
916928 	.minor = MISC_DYNAMIC_MINOR,
917929 	.name = "ashmem",