linux-kernel - Re: [drm:qxl] BUG: sleeping function called from invalid context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 08 May 2017 16:48:50 -0300
From:   Gabriel Krisman Bertazi <krisman@...labora.co.uk>
To:     Mike Galbraith <efault@....de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Dave Airlie <airlied@...hat.com>,
        Gerd Hoffmann <kraxel@...hat.com>,
        dri-devel@...ts.freedesktop.org
Subject: Re: [drm:qxl] BUG: sleeping function called from invalid context - qxl_bo_kmap_atomic_page()...splat

Mike Galbraith <efault@....de> writes:

> Greetings,
>
> I'm meeting this splat in master, call io_mapping_map_atomic_wc(),
> then do something sleepy.  In master-rt, I meet a variant of this
> doing read_lock() in find_next_iomem_res(), due to rwlocks being
> sleepy in RT.
>

Hi Mike,

Thanks for reporting this.  Can you confirm the following patch prevents
the issue?

>8

>From 407213129ef4a687378563cbb6ca78faa23f33bd Mon Sep 17 00:00:00 2001
From: Gabriel Krisman Bertazi <krisman@...labora.co.uk>
Date: Mon, 8 May 2017 16:47:22 -0300
Subject: [PATCH] drm: qxl: Suffle allocations in atomic cursor update

Signed-off-by: Gabriel Krisman Bertazi <krisman@...labora.co.uk>
---
 drivers/gpu/drm/qxl/qxl_display.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 058340a002c2..e92d0feaf639 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -581,25 +581,25 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
 		obj = to_qxl_framebuffer(fb)->obj;
 		user_bo = gem_to_qxl_bo(obj);
 
-		/* pinning is done in the prepare/cleanup framevbuffer */
-		ret = qxl_bo_kmap(user_bo, &user_ptr);
-		if (ret)
-			goto out_free_release;
-
 		ret = qxl_alloc_bo_reserved(qdev, release,
 					    sizeof(struct qxl_cursor) + size,
 					    &cursor_bo);
 		if (ret)
-			goto out_kunmap;
+			goto out_free_release;
 
 		ret = qxl_release_reserve_list(release, true);
 		if (ret)
 			goto out_free_bo;
 
-		ret = qxl_bo_kmap(cursor_bo, (void **)&cursor);
+		/* pinning is done in the prepare/cleanup framevbuffer */
+		ret = qxl_bo_kmap(user_bo, &user_ptr);
 		if (ret)
 			goto out_backoff;
 
+		ret = qxl_bo_kmap(cursor_bo, (void **)&cursor);
+		if (ret)
+			goto out_kunmap;
+
 		cursor->header.unique = 0;
 		cursor->header.type = SPICE_CURSOR_TYPE_ALPHA;
 		cursor->header.width = 64;
@@ -636,12 +636,12 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
 
 	return;
 
+out_kunmap:
+	qxl_bo_kunmap(user_bo);
 out_backoff:
 	qxl_release_backoff_reserve_list(release);
 out_free_bo:
 	qxl_bo_unref(&cursor_bo);
-out_kunmap:
-	qxl_bo_kunmap(user_bo);
 out_free_release:
 	qxl_release_free(qdev, release);
 	return;
-- 
2.11.0