[PATCH] fb: fix potential deadlock between lock_fb_info and console_lock
DORMANTno replies
From: Andrea Righi <hidden>
Date: 2011-02-06 15:58:15
Also in:
lkml
Subsystem:
framebuffer layer, the rest · Maintainers:
Helge Deller, Linus Torvalds
The function fb_set_suspend() must be called with the console semaphore held, which means the code path coming in here will first take the console_lock() and then call lock_fb_info(). However several framebuffer ioctl commands acquire these locks in reverse order (lock_fb_info() and then console_lock()). This gives rise to potential AB-BA deadlock. Fix this by changing the order of acquisition in the ioctl commands that make use of console_lock(). Reported-by: Peter Nordström (Palm GBU) <redacted> Signed-off-by: Andrea Righi <redacted> --- drivers/video/fbmem.c | 24 +++++++++++++++--------- 1 files changed, 15 insertions(+), 9 deletions(-)
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index e2bf953..def59f0 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c@@ -1034,14 +1034,16 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, case FBIOPUT_VSCREENINFO: if (copy_from_user(&var, argp, sizeof(var))) return -EFAULT; - if (!lock_fb_info(info)) - return -ENODEV; console_lock(); + if (!lock_fb_info(info)) { + console_unlock(); + return -ENODEV; + } info->flags |= FBINFO_MISC_USEREVENT; ret = fb_set_var(info, &var); info->flags &= ~FBINFO_MISC_USEREVENT; - console_unlock(); unlock_fb_info(info); + console_unlock(); if (!ret && copy_to_user(argp, &var, sizeof(var))) ret = -EFAULT; break;
@@ -1070,12 +1072,14 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, case FBIOPAN_DISPLAY: if (copy_from_user(&var, argp, sizeof(var))) return -EFAULT; - if (!lock_fb_info(info)) - return -ENODEV; console_lock(); + if (!lock_fb_info(info)) { + console_unlock(); + return -ENODEV; + } ret = fb_pan_display(info, &var); - console_unlock(); unlock_fb_info(info); + console_unlock(); if (ret = 0 && copy_to_user(argp, &var, sizeof(var))) return -EFAULT; break;
@@ -1117,14 +1121,16 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, unlock_fb_info(info); break; case FBIOBLANK: - if (!lock_fb_info(info)) - return -ENODEV; console_lock(); + if (!lock_fb_info(info)) { + console_unlock(); + return -ENODEV; + } info->flags |= FBINFO_MISC_USEREVENT; ret = fb_blank(info, arg); info->flags &= ~FBINFO_MISC_USEREVENT; - console_unlock(); unlock_fb_info(info); + console_unlock(); break; default: if (!lock_fb_info(info))
--
1.7.1