Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 513adb58 authored by Andrea Righi's avatar Andrea Righi Committed by Linus Torvalds
Browse files

fbdev: fix info->lock deadlock in fbcon_event_notify() 



fb_notifier_call_chain() is called with info->lock held, i.e.  in
do_fb_ioctl() => FBIOPUT_VSCREENINFO => fb_set_var() and the some
notifier callbacks, like fbcon_event_notify(), try to re-acquire
info->lock again.

Remove the lock/unlock_fb_info() in all the framebuffer notifier
callbacks' and be sure to always call fb_notifier_call_chain() with
info->lock held.

Reported-by: default avatarPavel Roskin <proski@gnu.org>
Reported-by: default avatarEric Miao <eric.y.miao@gmail.com>
Signed-off-by: default avatarAndrea Righi <righi.andrea@gmail.com>
Cc: Stefan Richter <stefanr@s5r6.in-berlin.de>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b52bb371

drivers/video/backlight/backlight.c

+0 −3
Original line number Diff line number Diff line
@@ -35,8 +35,6 @@ static int fb_notifier_callback(struct notifier_block *self, 
		return 0;



	bd = container_of(self, struct backlight_device, fb_notif);

	if (!lock_fb_info(evdata->info))

		return -ENODEV;

	mutex_lock(&bd->ops_lock);

	if (bd->ops)

		if (!bd->ops->check_fb ||
@@ -49,7 +47,6 @@ static int fb_notifier_callback(struct notifier_block *self, 
			backlight_update_status(bd);

		}

	mutex_unlock(&bd->ops_lock);

	unlock_fb_info(evdata->info);

	return 0;

}

drivers/video/backlight/lcd.c

+0 −3
Original line number Diff line number Diff line
@@ -40,8 +40,6 @@ static int fb_notifier_callback(struct notifier_block *self, 
	if (!ld->ops)

		return 0;



	if (!lock_fb_info(evdata->info))

		return -ENODEV;

	mutex_lock(&ld->ops_lock);

	if (!ld->ops->check_fb || ld->ops->check_fb(ld, evdata->info)) {

		if (event == FB_EVENT_BLANK) {
@@ -53,7 +51,6 @@ static int fb_notifier_callback(struct notifier_block *self, 
		}

	}

	mutex_unlock(&ld->ops_lock);

	unlock_fb_info(evdata->info);

	return 0;

}

drivers/video/console/fbcon.c

+3 −52
Original line number Diff line number Diff line
@@ -2263,9 +2263,12 @@ static void fbcon_generic_blank(struct vc_data *vc, struct fb_info *info, 
	}





	if (!lock_fb_info(info))

		return;

	event.info = info;

	event.data = &blank;

	fb_notifier_call_chain(FB_EVENT_CONBLANK, &event);

	unlock_fb_info(info);

}



static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
@@ -2956,8 +2959,6 @@ static int fbcon_fb_unregistered(struct fb_info *info) 
{

	int i, idx;



	if (!lock_fb_info(info))

		return -ENODEV;

	idx = info->node;

	for (i = first_fb_vc; i <= last_fb_vc; i++) {

		if (con2fb_map[i] == idx)
@@ -2985,8 +2986,6 @@ static int fbcon_fb_unregistered(struct fb_info *info) 
	if (primary_device == idx)

		primary_device = -1;



	unlock_fb_info(info);



	if (!num_registered_fb)

		unregister_con_driver(&fb_con);
@@ -3027,11 +3026,8 @@ static int fbcon_fb_registered(struct fb_info *info) 
{

	int ret = 0, i, idx;



	if (!lock_fb_info(info))

		return -ENODEV;

	idx = info->node;

	fbcon_select_primary(info);

	unlock_fb_info(info);



	if (info_idx == -1) {

		for (i = first_fb_vc; i <= last_fb_vc; i++) {
@@ -3152,53 +3148,23 @@ static int fbcon_event_notify(struct notifier_block *self, 


	switch(action) {

	case FB_EVENT_SUSPEND:

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		fbcon_suspended(info);

		unlock_fb_info(info);

		break;

	case FB_EVENT_RESUME:

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		fbcon_resumed(info);

		unlock_fb_info(info);

		break;

	case FB_EVENT_MODE_CHANGE:

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		fbcon_modechanged(info);

		unlock_fb_info(info);

		break;

	case FB_EVENT_MODE_CHANGE_ALL:

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		fbcon_set_all_vcs(info);

		unlock_fb_info(info);

		break;

	case FB_EVENT_MODE_DELETE:

		mode = event->data;

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		ret = fbcon_mode_deleted(info, mode);

		unlock_fb_info(info);

		break;

	case FB_EVENT_FB_UNBIND:

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		idx = info->node;

		unlock_fb_info(info);

		ret = fbcon_fb_unbind(idx);

		break;

	case FB_EVENT_FB_REGISTERED:
@@ -3217,29 +3183,14 @@ static int fbcon_event_notify(struct notifier_block *self, 
		con2fb->framebuffer = con2fb_map[con2fb->console - 1];

		break;

	case FB_EVENT_BLANK:

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		fbcon_fb_blanked(info, *(int *)event->data);

		unlock_fb_info(info);

		break;

	case FB_EVENT_NEW_MODELIST:

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		fbcon_new_modelist(info);

		unlock_fb_info(info);

		break;

	case FB_EVENT_GET_REQ:

		caps = event->data;

		if (!lock_fb_info(info)) {

			ret = -ENODEV;

			goto done;

		}

		fbcon_get_requirement(info, caps);

		unlock_fb_info(info);

		break;

	}

done:

drivers/video/fbmem.c

+19 −0
Original line number Diff line number Diff line
@@ -1097,8 +1097,11 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, 
			return -EINVAL;

		con2fb.framebuffer = -1;

		event.data = &con2fb;

		if (!lock_fb_info(info))

			return -ENODEV;

		event.info = info;

		fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);

		unlock_fb_info(info);

		ret = copy_to_user(argp, &con2fb, sizeof(con2fb)) ? -EFAULT : 0;

		break;

	case FBIOPUT_CON2FBMAP:
@@ -1115,8 +1118,11 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, 
			break;

		}

		event.data = &con2fb;

		if (!lock_fb_info(info))

			return -ENODEV;

		event.info = info;

		ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP, &event);

		unlock_fb_info(info);

		break;

	case FBIOBLANK:

		if (!lock_fb_info(info))
@@ -1521,7 +1527,10 @@ register_framebuffer(struct fb_info *fb_info) 
	registered_fb[i] = fb_info;



	event.info = fb_info;

	if (!lock_fb_info(fb_info))

		return -ENODEV;

	fb_notifier_call_chain(FB_EVENT_FB_REGISTERED, &event);

	unlock_fb_info(fb_info);

	return 0;

}
@@ -1555,8 +1564,12 @@ unregister_framebuffer(struct fb_info *fb_info) 
		goto done;

	}





	if (!lock_fb_info(fb_info))

		return -ENODEV;

	event.info = fb_info;

	ret = fb_notifier_call_chain(FB_EVENT_FB_UNBIND, &event);

	unlock_fb_info(fb_info);



	if (ret) {

		ret = -EINVAL;
@@ -1590,6 +1603,8 @@ void fb_set_suspend(struct fb_info *info, int state) 
{

	struct fb_event event;



	if (!lock_fb_info(info))

		return;

	event.info = info;

	if (state) {

		fb_notifier_call_chain(FB_EVENT_SUSPEND, &event);
@@ -1598,6 +1613,7 @@ void fb_set_suspend(struct fb_info *info, int state) 
		info->state = FBINFO_STATE_RUNNING;

		fb_notifier_call_chain(FB_EVENT_RESUME, &event);

	}

	unlock_fb_info(info);

}



/**
@@ -1667,8 +1683,11 @@ int fb_new_modelist(struct fb_info *info) 
	err = 1;



	if (!list_empty(&info->modelist)) {

		if (!lock_fb_info(info))

			return -ENODEV;

		event.info = info;

		err = fb_notifier_call_chain(FB_EVENT_NEW_MODELIST, &event);

		unlock_fb_info(info);

	}



	return err;