Deadlock in intel_user_framebuffer_destroy()

Lukas Wunner
2015-06-03T13:50:35Z

Hi,

a deadlock was introduced by commit 60a5ca015ffd2aacfe5674b5a401cd2a37159e07

Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date: Fri Jun 13 11:10:53 2014 +0300

drm/i915: Add locking around framebuffer_references--

The commit amended intel_display.c:intel_user_framebuffer_destroy() with
mutex_lock(&dev->struct_mutex).

A few weeks prior Chris Wilson had amended intel_fbdev.c:intelfb_create()
with a call to drm_framebuffer_unreference() while &dev->struct_mutex is
locked (commit edd586fe705e819bc711b5ed7194a0b6f9f1a7e1, "drm/i915: Discard
BIOS framebuffers too small to accommodate chosen mode").

This leads to the following call chain while &dev->struct_mutex is locked:

intel_fbdev.c:intelfb_create()
-> drm_crtc.c:drm_framebuffer_unreference()
-> drm_crtc.c:drm_framebuffer_free()
-> intel_display.c:intel_user_framebuffer_destroy()

The last function in that call chain attempts to re-lock the mutex.
The functionality added by Chris Wilson is thus rendered broken.

Best regards,

Lukas