4 files changed, 12 insertions, 3 deletions

diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index b866a6becd99..243b28d07373 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1681,9 +1681,7 @@ static int __buf_prepare(struct vb2_buffer *vb, const struct v4l2_buffer *b)
                 ret = __qbuf_mmap(vb, b);
                 break;
         case V4L2_MEMORY_USERPTR:
-                down_read(&current->mm->mmap_sem);
                 ret = __qbuf_userptr(vb, b);
-                up_read(&current->mm->mmap_sem);
                 break;
         case V4L2_MEMORY_DMABUF:
                 ret = __qbuf_dmabuf(vb, b);
diff --git a/drivers/media/v4l2-core/videobuf2-dma-contig.c b/drivers/media/v4l2-core/videobuf2-dma-contig.c
index 94c1e6455d36..c548ce425701 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-contig.c
@@ -616,6 +616,7 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
                 goto fail_buf;
         }
 
+        down_read(&current->mm->mmap_sem);
         /* current->mm->mmap_sem is taken by videobuf2 core */
         vma = find_vma(current->mm, vaddr);
         if (!vma) {
@@ -642,6 +643,7 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         if (ret) {
                 unsigned long pfn;
                 if (vb2_dc_get_user_pfn(start, n_pages, vma, &pfn) == 0) {
+                        up_read(&current->mm->mmap_sem);
                         buf->dma_addr = vb2_dc_pfn_to_dma(buf->dev, pfn);
                         buf->size = size;
                         kfree(pages);
@@ -651,6 +653,7 @@ static void *vb2_dc_get_userptr(void *alloc_ctx, unsigned long vaddr,
                 pr_err("failed to get user pages\n");
                 goto fail_vma;
         }
+        up_read(&current->mm->mmap_sem);
 
         sgt = kzalloc(sizeof(*sgt), GFP_KERNEL);
         if (!sgt) {
@@ -713,10 +716,12 @@ fail_get_user_pages:
                 while (n_pages)
                         put_page(pages[--n_pages]);
 
+        down_read(&current->mm->mmap_sem);
 fail_vma:
         vb2_put_vma(buf->vma);
 
 fail_pages:
+        up_read(&current->mm->mmap_sem);
         kfree(pages); /* kfree is NULL-proof */
 
 fail_buf:
diff --git a/drivers/media/v4l2-core/videobuf2-dma-sg.c b/drivers/media/v4l2-core/videobuf2-dma-sg.c
index 7289b81bd7b7..d2cf113d1933 100644
--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
+++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
@@ -264,6 +264,7 @@ static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
         if (!buf->pages)
                 goto userptr_fail_alloc_pages;
 
+        down_read(&current->mm->mmap_sem);
         vma = find_vma(current->mm, vaddr);
         if (!vma) {
                 dprintk(1, "no vma for address %lu\n", vaddr);
@@ -302,6 +303,7 @@ static void *vb2_dma_sg_get_userptr(void *alloc_ctx, unsigned long vaddr,
                                              1, /* force */
                                              buf->pages,
                                              NULL);
+        up_read(&current->mm->mmap_sem);
 
         if (num_pages_from_user != buf->num_pages)
                 goto userptr_fail_get_user_pages;
@@ -331,8 +333,10 @@ userptr_fail_get_user_pages:
         if (!vma_is_io(buf->vma))
                 while (--num_pages_from_user >= 0)
                         put_page(buf->pages[num_pages_from_user]);
+        down_read(&current->mm->mmap_sem);
         vb2_put_vma(buf->vma);
 userptr_fail_find_vma:
+        up_read(&current->mm->mmap_sem);
         kfree(buf->pages);
 userptr_fail_alloc_pages:
         kfree(buf);
diff --git a/drivers/media/v4l2-core/videobuf2-vmalloc.c b/drivers/media/v4l2-core/videobuf2-vmalloc.c
index 2fe4c27f524a..63bef959623e 100644
--- a/drivers/media/v4l2-core/videobuf2-vmalloc.c
+++ b/drivers/media/v4l2-core/videobuf2-vmalloc.c
@@ -89,7 +89,7 @@ static void *vb2_vmalloc_get_userptr(void *alloc_ctx, unsigned long vaddr,
         offset = vaddr & ~PAGE_MASK;
         buf->size = size;
 
-
+        down_read(&current->mm->mmap_sem);
         vma = find_vma(current->mm, vaddr);
         if (vma && (vma->vm_flags & VM_PFNMAP) && (vma->vm_pgoff)) {
                 if (vb2_get_contig_userptr(vaddr, size, &vma, &physp))
@@ -121,6 +121,7 @@ static void *vb2_vmalloc_get_userptr(void *alloc_ctx, unsigned long vaddr,
                 if (!buf->vaddr)
                         goto fail_get_user_pages;
         }
+        up_read(&current->mm->mmap_sem);
 
         buf->vaddr += offset;
         return buf;
@@ -133,6 +134,7 @@ fail_get_user_pages:
         kfree(buf->pages);
 
 fail_pages_array_alloc:
+        up_read(&current->mm->mmap_sem);
         kfree(buf);
 
         return NULL;