From 72452ef6510d134770dbe90e61cbc854145db25d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= <arve@android.com>
Date: Wed, 1 Feb 2012 15:29:13 -0800
Subject: [PATCH] --- yaml --- r: 287423 b: refs/heads/master c:
 bd1eff9741af27378b241b347041c724bb28e857 h: refs/heads/master i:   287421:
 aab1715445501307c9c6903d452b376ce3284c95   287419:
 8013abc3e2cf0b35b140278624ab4ffdd5dd52cf   287415:
 b0f9c79c6fa765b80c09cb88bd3f0670be4aa9cb   287407:
 752ae6232f5ca92403b5d5639a30d117b1c24d33   287391:
 f4b103b1634919771d0f251f580f10c50deb5fde   287359:
 a5f9cfd2669741d71841863a3fb70a86e6811403 v: v3

---
 [refs]                                 |  2 +-
 trunk/drivers/staging/android/binder.c | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index dcd694ea8e35..44fd56279bc8 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b0d017e80e9f4e6b37e699b9a944646e64deb473
+refs/heads/master: bd1eff9741af27378b241b347041c724bb28e857
diff --git a/trunk/drivers/staging/android/binder.c b/trunk/drivers/staging/android/binder.c
index 48cf27cdb51a..f0b7e6605ab5 100644
--- a/trunk/drivers/staging/android/binder.c
+++ b/trunk/drivers/staging/android/binder.c
@@ -38,6 +38,7 @@
 
 static DEFINE_MUTEX(binder_lock);
 static DEFINE_MUTEX(binder_deferred_lock);
+static DEFINE_MUTEX(binder_mmap_lock);
 
 static HLIST_HEAD(binder_procs);
 static HLIST_HEAD(binder_deferred_list);
@@ -632,6 +633,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
 	if (mm) {
 		down_write(&mm->mmap_sem);
 		vma = proc->vma;
+		if (vma && mm != vma->vm_mm) {
+			pr_err("binder: %d: vma mm and task mm mismatch\n",
+				proc->pid);
+			vma = NULL;
+		}
 	}
 
 	if (allocate == 0)
@@ -2802,6 +2808,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 	}
 	vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
 
+	mutex_lock(&binder_mmap_lock);
 	if (proc->buffer) {
 		ret = -EBUSY;
 		failure_string = "already mapped";
@@ -2816,6 +2823,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 	}
 	proc->buffer = area->addr;
 	proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
+	mutex_unlock(&binder_mmap_lock);
 
 #ifdef CONFIG_CPU_CACHE_VIPT
 	if (cache_is_vipt_aliasing()) {
@@ -2848,7 +2856,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 	binder_insert_free_buffer(proc, buffer);
 	proc->free_async_space = proc->buffer_size / 2;
 	barrier();
-	proc->files = get_files_struct(current);
+	proc->files = get_files_struct(proc->tsk);
 	proc->vma = vma;
 
 	/*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n",
@@ -2859,10 +2867,12 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 	kfree(proc->pages);
 	proc->pages = NULL;
 err_alloc_pages_failed:
+	mutex_lock(&binder_mmap_lock);
 	vfree(proc->buffer);
 	proc->buffer = NULL;
 err_get_vm_area_failed:
 err_already_mapped:
+	mutex_unlock(&binder_mmap_lock);
 err_bad_arg:
 	printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n",
 	       proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);