~hc/RK356X_SDK_RELEASE.git

..	..	@@ -138,7 +138,8 @@
138	138	page_range_subsumes_range(range, start, end);
139	139	}
140	140
141		-static inline bool range_before_page(struct ashmem_range *range, size_t page)
	141	+static inline bool range_before_page(struct ashmem_range *range,
	142	+ size_t page)
142	143	{
143	144	return range->pgend < page;
144	145	}
..	..	@@ -201,7 +202,7 @@
201	202	}
202	203
203	204	/**
204		- * range_del() - Deletes and dealloctes an ashmem_range structure
	205	+ * range_del() - Deletes and deallocates an ashmem_range structure
205	206	* @range: The associated ashmem_range that has previously been allocated
206	207	*/
207	208	static void range_del(struct ashmem_range *range)
..	..	@@ -566,24 +567,24 @@
566	567
567	568	/*
568	569	* Holding the ashmem_mutex while doing a copy_from_user might cause
569		- * an data abort which would try to access mmap_sem. If another
	570	+ * an data abort which would try to access mmap_lock. If another
570	571	* thread has invoked ashmem_mmap then it will be holding the
571	572	* semaphore and will be waiting for ashmem_mutex, there by leading to
572		- * deadlock. We'll release the mutex and take the name to a local
	573	+ * deadlock. We'll release the mutex and take the name to a local
573	574	* variable that does not need protection and later copy the local
574	575	* variable to the structure member with lock held.
575	576	*/
576	577	len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN);
577	578	if (len < 0)
578	579	return len;
579		- if (len == ASHMEM_NAME_LEN)
580		- local_name[ASHMEM_NAME_LEN - 1] = '\0';
	580	+
581	581	mutex_lock(&ashmem_mutex);
582	582	/* cannot change an existing mapping's name */
583	583	if (asma->file)
584	584	ret = -EINVAL;
585	585	else
586		- strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name);
	586	+ strscpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name,
	587	+ ASHMEM_NAME_LEN);
587	588
588	589	mutex_unlock(&ashmem_mutex);
589	590	return ret;
..	..	@@ -597,7 +598,7 @@
597	598	* Have a local variable to which we'll copy the content
598	599	* from asma with the lock held. Later we can copy this to the user
599	600	* space safely without holding any locks. So even if we proceed to
600		- * wait for mmap_sem, it won't lead to deadlock.
	601	+ * wait for mmap_lock, it won't lead to deadlock.
601	602	*/
602	603	char local_name[ASHMEM_NAME_LEN];
603	604
..	..	@@ -893,6 +894,8 @@
893	894	seq_printf(m, "name:\t%s\n",
894	895	asma->name + ASHMEM_NAME_PREFIX_LEN);
895	896
	897	+ seq_printf(m, "size:\t%zu\n", asma->size);
	898	+
896	899	mutex_unlock(&ashmem_mutex);
897	900	}
898	901	#endif
..	..	@@ -912,6 +915,15 @@
912	915	#endif
913	916	};
914	917
	918	+/*
	919	+ * is_ashmem_file - Check if struct file* is associated with ashmem
	920	+ */
	921	+int is_ashmem_file(struct file *file)
	922	+{
	923	+ return file->f_op == &ashmem_fops;
	924	+}
	925	+EXPORT_SYMBOL_GPL(is_ashmem_file);
	926	+
915	927	static struct miscdevice ashmem_misc = {
916	928	.minor = MISC_DYNAMIC_MINOR,
917	929	.name = "ashmem",