linux-kernel - Re: [PATCH] fbcon: fix race condition between console lock and cursor timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 21 Aug 2012 09:19:04 -0400
From:	Josh Boyer <jwboyer@...il.com>
To:	Dave Airlie <airlied@...hat.com>
Cc:	linux-fbdev@...r.kernel.org, dri-devel@...ts.sf.net,
	linux-kernel@...r.kernel.org,
	Linus <torvalds@...ux-foundation.org>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Randy Dunlap <rdunlap@...otime.net>,
	kernel-team@...oraproject.org
Subject: Re: [PATCH] fbcon: fix race condition between console lock and cursor timer

On Tue, Aug 21, 2012 at 2:40 AM, Dave Airlie <airlied@...hat.com> wrote:
> So we've had a fair few reports of fbcon handover breakage between
> efi/vesafb and i915 surface recently, so I dedicated a couple of
> days to finding the problem.
>
> Essentially the last thing we saw was the conflicting framebuffer
> message and that was all.
>
> So after much tracing with direct netconsole writes (printks
> under console_lock not so useful), I think I found the race.
>
> Thread A (driver load)    Thread B (timer thread)
>   unbind_con_driver ->              |
>   bind_con_driver ->                |
>   vc->vc_sw->con_deinit ->          |
>   fbcon_deinit ->                   |
>   console_lock()                    |
>       |                             |
>       |                       fbcon_flashcursor timer fires
>       |                       console_lock() <- blocked for A
>       |
>       |
> fbcon_del_cursor_timer ->
>   del_timer_sync
>   (BOOM)
>
> Of course because all of this is under the console lock,
> we never see anything, also since we also just unbound the active
> console guess what we never see anything.
>
> Hopefully this fixes the problem for anyone seeing vesafb->kms
> driver handoff.
>
> Signed-off-by: David Airlie <airlied@...hat.com>
> ---
>  drivers/video/console/fbcon.c |    6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
> index 2e471c2..f8a79fc 100644
> --- a/drivers/video/console/fbcon.c
> +++ b/drivers/video/console/fbcon.c
> @@ -372,8 +372,12 @@ static void fb_flashcursor(struct work_struct *work)
>         struct vc_data *vc = NULL;
>         int c;
>         int mode;
> +       int ret;
> +
> +       ret = console_trylock();
> +       if (ret == 0)
> +               return;
>
> -       console_lock();
>         if (ops && ops->currcon != -1)
>                 vc = vc_cons[ops->currcon].d;
>

I have a Dell XPS 8300 machine with a Radeon card in it that started
showing this problem yesterday with 3.6-rc2 kernels.  I tested this
patch on top of v3.6-rc2-206-g10c63c9 this morning and the problem
seems to have been cleared up for me.  That includes making sure the
grub2 file has the gfxterm set, etc.

I know we've been seeing this quite a bit more on Fedora 17, so we'll
want to have some people test a 3.5 build with it but things are
looking better.

josh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/