[PATCH] fbcon: fix deadlock in fbcon_generic_blank()

[PATCH] fbcon: fix deadlock in fbcon_generic_blank()

[John Tapsell]

Do not lock fb_info when calling sending the FB_EVENT_CONBLANK
event.

In fbmem.c, the semantics are that we acquire the lock_fb_info first,
and then console_lock.  However when fbcon.c fbcon_generic_blank() is
called, the console lock could already be held.  Locking fb_info can
thus cause a deadlock.

fbmem.c sends the FB_EVENT_BLANK without locking lock_fb_info first, so
this change introduces similar behaviour.

Signed-off-by: John Tapsell <johnflux@gmail.com>

---
 drivers/video/console/fbcon.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 6b4fb5c..8546441 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2333,13 +2333,9 @@ static void fbcon_generic_blank(struct vc_data
*vc, struct fb_info *info,
         vc->vc_video_erase_char = oldc;
     }

-
-    if (!lock_fb_info(info))
-        return;
     event.info = info;
     event.data = &blank;
     fb_notifier_call_chain(FB_EVENT_CONBLANK, &event);
-    unlock_fb_info(info);
 }

 static int fbcon_blank(struct vc_data *vc, int blank, int mode_switch)
-- 
1.8.1.2

Re: [PATCH] fbcon: fix deadlock in fbcon_generic_blank()

[Tomi Valkeinen]

[-- Attachment #1: Type: text/plain, Size: 1097 bytes --]

Hi,

On 18/09/13 01:29, John Tapsell wrote:
> Do not lock fb_info when calling sending the FB_EVENT_CONBLANK
> event.
> 
> In fbmem.c, the semantics are that we acquire the lock_fb_info first,
> and then console_lock.  However when fbcon.c fbcon_generic_blank() is
> called, the console lock could already be held.  Locking fb_info can
> thus cause a deadlock.

So has this happened for you? Or is it just theoretical?

> fbmem.c sends the FB_EVENT_BLANK without locking lock_fb_info first, so
> this change introduces similar behaviour.

I don't think this is true. FB_EVENT_BLANK is sent in fb_blank(). That
one is called when FBIOBLANK ioctl is called, and it does lock_fb_info().

I'm not familiar with the console code, but removing a lock makes me
feel rather uneasy... But looking at the code, I can also see that
console_lock could already be held, so something here definitely looks
broken.

The only place using FB_EVENT_CONBLANK seems to be backlight, and if I'm
not mistaken, it has its own lock, and doesn't depend on the fb_info
being locked.

 Tomi



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 901 bytes --]