Re: mmap(), close(), and dget()

Bill Hawes (whawes@star.net)
Tue, 03 Feb 1998 09:25:52 -0500

Itai Nahshon wrote:
>
> Jason McMullan wrote:
> >
> > Hi there everybody! Ok, here's my problem
> > (character device driver)
> >
> > 1) App open()s my device inode
> > *) dev->open() called.
> >
> > 2) App mmap()s some memory through the device
> > *) dev->mmap() called
> > *) I do the MMAP dance..
> > *) I set vma->vm_dentry=dget(file->dentry);
> >
> > 3) App exits
> > *) dev->close() called
> > *) vma is unregistered
> >
> > Isn't that the wrong order for #3? Shouldn't the
> > vma's for mallocs be cleaned BEFORE dev->close() is
> > called?
> >

> IMHO you are right, the same problem may also lead to security
> reason. See the thread of discussions about sound security
> from last week.
> That is real problem only for a small set of character devices which
> have both mmap and release functions pointed by their file_operations.
> I know about sound and about fbmem (fbmem is never used in x86 systems).
> Does it raise new problems in GGI?

You might want to look into defining a vma close op to defer device closing
until the vma goes away. Each vma could hold an open count for the device, and
the device wouldn't go away until the last vma had been closed.

Regards,
Bill