Deadlock in intel_user_framebuffer_destroy()

Commit Message

Lukas Wunner June 15, 2015, 7:34 a.m. UTC

Hi Jani,

On Mon, Jun 15, 2015 at 09:44:15AM +0300, Jani Nikula wrote:
> On Wed, 03 Jun 2015, Chris Wilson <[e-mail]> wrote:
> > Just move the mutex_lock down a step.
> Lucas, did you try this?

Yes, works for me. I was going to submit the attached patch as part of
the MacBook Pro GPU switching patch set (once it's finished) but feel
free to merge now.

Thanks for following up on this.

Lukas
From b502824816e20e65f7b0b17b18efec161f7560ed Mon Sep 17 00:00:00 2001
Message-Id: <[e-mail]>
In-Reply-To: <[e-mail]>
References: <[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
	<[e-mail]>
From: Lukas Wunner <[e-mail]>
Date: Wed, 3 Jun 2015 14:57:41 +0100
Subject: [PATCH v2 18/20] drm/i915: Fix deadlock upon discarding BIOS fb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
To: [e-mail]

From: Chris Wilson <[e-mail]>

A deadlock was introduced by commit 60a5ca015ffd:

Author: Ville SyrjÀlÀ <[e-mail]>
Date:   Fri Jun 13 11:10:53 2014 +0300

    drm/i915: Add locking around framebuffer_references--

The commit amended intel_user_framebuffer_destroy() with locking of
dev->struct_mutex.

A few weeks prior Chris Wilson had amended intelfb_create() with a call
to drm_framebuffer_unreference() while dev->struct_mutex is locked
(edd586fe705e, "drm/i915: Discard BIOS framebuffers too small to
accommodate chosen mode"). That function calls drm_framebuffer_free(),
which calls intel_user_framebuffer_destroy(), which now tries to acquire
the lock once more, rendering the functionality added by Chris Wilson
broken.

Leave the offending commit as is but adapt Chris Wilson's code by moving
mutex_lock() below the call to drm_framebuffer_unreference().

Fixes: 60a5ca015ffd2aacfe5674b5a401cd2a37159e07
[Lukas: Amend Chris' patch with commit message]
Signed-off-by: Lukas Wunner <[e-mail]>
---
 drivers/gpu/drm/i915/intel_fbdev.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Patch

diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 4e7e7da..bea3218 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -183,8 +183,6 @@  static int intelfb_create(struct drm_fb_helper *helper,
 	int size, ret;
 	bool prealloc = false;
 
-	mutex_lock(&dev->struct_mutex);
-
 	if (intel_fb &&
 	    (sizes->fb_width > intel_fb->base.width ||
 	     sizes->fb_height > intel_fb->base.height)) {
@@ -195,6 +193,9 @@  static int intelfb_create(struct drm_fb_helper *helper,
 		drm_framebuffer_unreference(&intel_fb->base);
 		intel_fb = ifbdev->fb = NULL;
 	}
+
+	mutex_lock(&dev->struct_mutex);
+
 	if (!intel_fb || WARN_ON(!intel_fb->obj)) {
 		DRM_DEBUG_KMS("no BIOS fb, allocating a new one\n");
 		ret = intelfb_alloc(helper, sizes);