Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b30b61ff authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Daniel Vetter
Browse files

drm/vkms: Fix flush_work() without INIT_WORK(). 

syzbot is hitting a lockdep warning [1] because flush_work() is called
without INIT_WORK() after kzalloc() at vkms_atomic_crtc_reset().

Commit 6c234fe3 ("drm/vkms: Implement CRC debugfs API") added
INIT_WORK() to only vkms_atomic_crtc_duplicate_state() side. Assuming
that lifecycle of crc_work is appropriately managed, fix this problem
by adding INIT_WORK() to vkms_atomic_crtc_reset() side.

[1] https://syzkaller.appspot.com/bug?id=a5954455fcfa51c29ca2ab55b203076337e1c770



Reported-and-tested-by: default avatarsyzbot <syzbot+12f1b031b6da017e34f8@syzkaller.appspotmail.com>
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: default avatarShayenne Moura <shayenneluzmoura@gmail.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1547829823-9877-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
parent 46f3ceaf

drivers/gpu/drm/vkms/vkms_crtc.c

+1 −0
Original line number Diff line number Diff line
@@ -104,6 +104,7 @@ static void vkms_atomic_crtc_reset(struct drm_crtc *crtc) 
	vkms_state = kzalloc(sizeof(*vkms_state), GFP_KERNEL);

	if (!vkms_state)

		return;

	INIT_WORK(&vkms_state->crc_work, vkms_crc_work_handle);



	crtc->state = &vkms_state->base;

	crtc->state->crtc = crtc;