diff mbox

drm: Fix deadlock retry loop in page_flip_ioctl

Message ID 20170522073155.30416-1-daniel.vetter@ffwll.ch (mailing list archive)
State New, archived
Headers show

Commit Message

Daniel Vetter May 22, 2017, 7:31 a.m. UTC
I failed to properly onion-wrap the unwind code: We acquire the vblank
reference before we start with the wait-wound locking dance, hence we
must make sure we retry before we drop the reference. Oops.

Fixes: 29dc0d1de182 ("drm: Roll out acquire context for the page_flip ioctl")
Cc: Harry Wentland <harry.wentland@amd.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: Sean Paul <seanpaul@chromium.org>
Cc: David Airlie <airlied@linux.ie>
Cc: dri-devel@lists.freedesktop.org
Reported-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Tommi Rantala <tt.rantala@gmail.com>
Cc: Michel Dänzer <michel@daenzer.net>
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
---
 drivers/gpu/drm/drm_plane.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

Comments

Michel Dänzer May 22, 2017, 8:57 a.m. UTC | #1
On 22/05/17 04:31 PM, Daniel Vetter wrote:
> I failed to properly onion-wrap the unwind code: We acquire the vblank
> reference before we start with the wait-wound locking dance, hence we
> must make sure we retry before we drop the reference. Oops.
> 
> Fixes: 29dc0d1de182 ("drm: Roll out acquire context for the page_flip ioctl")
> Cc: Harry Wentland <harry.wentland@amd.com>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
> Cc: Sean Paul <seanpaul@chromium.org>
> Cc: David Airlie <airlied@linux.ie>
> Cc: dri-devel@lists.freedesktop.org
> Reported-by: Tommi Rantala <tt.rantala@gmail.com>
> Cc: Tommi Rantala <tt.rantala@gmail.com>
> Cc: Michel Dänzer <michel@daenzer.net>
> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
> ---
>  drivers/gpu/drm/drm_plane.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
> index fedd4d60d9cd..24c8a611b98a 100644
> --- a/drivers/gpu/drm/drm_plane.c
> +++ b/drivers/gpu/drm/drm_plane.c
> @@ -948,6 +948,11 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
>  	}
>  
>  out:
> +	if (ret == -EDEADLK) {
> +		drm_modeset_backoff(&ctx);
> +		goto retry;
> +	}
> +
>  	if (ret && crtc->funcs->page_flip_target)
>  		drm_crtc_vblank_put(crtc);
>  	if (fb)
> @@ -956,11 +961,6 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
>  		drm_framebuffer_put(crtc->primary->old_fb);
>  	crtc->primary->old_fb = NULL;
>  
> -	if (ret == -EDEADLK) {
> -		drm_modeset_backoff(&ctx);
> -		goto retry;
> -	}

I suspect the drm_framebuffer_put(fb) call still needs to happen before
the retry?
diff mbox

Patch

diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index fedd4d60d9cd..24c8a611b98a 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -948,6 +948,11 @@  int drm_mode_page_flip_ioctl(struct drm_device *dev,
 	}
 
 out:
+	if (ret == -EDEADLK) {
+		drm_modeset_backoff(&ctx);
+		goto retry;
+	}
+
 	if (ret && crtc->funcs->page_flip_target)
 		drm_crtc_vblank_put(crtc);
 	if (fb)
@@ -956,11 +961,6 @@  int drm_mode_page_flip_ioctl(struct drm_device *dev,
 		drm_framebuffer_put(crtc->primary->old_fb);
 	crtc->primary->old_fb = NULL;
 
-	if (ret == -EDEADLK) {
-		drm_modeset_backoff(&ctx);
-		goto retry;
-	}
-
 	drm_modeset_drop_locks(&ctx);
 	drm_modeset_acquire_fini(&ctx);