fbdev: fix fb_compat_ioctl() deadlocks
commit3e680aae4e
("fb: convert lock/unlock_kernel() into local fb mutex") introduced several deadlocks in the fb_compat_ioctl() path, as mutex_lock() doesn't allow recursion, unlike lock_kernel(). This broke frame buffer applications on 64-bit systems with a 32-bit userland. commit120a37470c
("framebuffer compat_ioctl deadlock") fixed one of the deadlocks. This patch fixes the remaining deadlocks: - Revert commit120a37470c
, - Extract the core logic of fb_ioctl() into a new function do_fb_ioctl(), - Change all callsites of fb_ioctl() where info->lock is already held to call do_fb_ioctl() instead, - Add sparse annotations to all routines that take info->lock. Signed-off-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com> Cc: Mikulas Patocka <mpatocka@redhat.com> Cc: Krzysztof Helt <krzysztof.h1@wp.pl> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
a70dcb969f
commit
a684e7d330
|
@ -1002,13 +1002,9 @@ fb_blank(struct fb_info *info, int blank)
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
static long
|
static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
|
||||||
fb_ioctl(struct file *file, unsigned int cmd,
|
unsigned long arg)
|
||||||
unsigned long arg)
|
|
||||||
{
|
{
|
||||||
struct inode *inode = file->f_path.dentry->d_inode;
|
|
||||||
int fbidx = iminor(inode);
|
|
||||||
struct fb_info *info;
|
|
||||||
struct fb_ops *fb;
|
struct fb_ops *fb;
|
||||||
struct fb_var_screeninfo var;
|
struct fb_var_screeninfo var;
|
||||||
struct fb_fix_screeninfo fix;
|
struct fb_fix_screeninfo fix;
|
||||||
|
@ -1018,14 +1014,10 @@ fb_ioctl(struct file *file, unsigned int cmd,
|
||||||
void __user *argp = (void __user *)arg;
|
void __user *argp = (void __user *)arg;
|
||||||
long ret = 0;
|
long ret = 0;
|
||||||
|
|
||||||
info = registered_fb[fbidx];
|
|
||||||
mutex_lock(&info->lock);
|
|
||||||
fb = info->fbops;
|
fb = info->fbops;
|
||||||
|
if (!fb)
|
||||||
if (!fb) {
|
|
||||||
mutex_unlock(&info->lock);
|
|
||||||
return -ENODEV;
|
return -ENODEV;
|
||||||
}
|
|
||||||
switch (cmd) {
|
switch (cmd) {
|
||||||
case FBIOGET_VSCREENINFO:
|
case FBIOGET_VSCREENINFO:
|
||||||
ret = copy_to_user(argp, &info->var,
|
ret = copy_to_user(argp, &info->var,
|
||||||
|
@ -1126,6 +1118,21 @@ fb_ioctl(struct file *file, unsigned int cmd,
|
||||||
else
|
else
|
||||||
ret = fb->fb_ioctl(info, cmd, arg);
|
ret = fb->fb_ioctl(info, cmd, arg);
|
||||||
}
|
}
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
static long fb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
||||||
|
__acquires(&info->lock)
|
||||||
|
__releases(&info->lock)
|
||||||
|
{
|
||||||
|
struct inode *inode = file->f_path.dentry->d_inode;
|
||||||
|
int fbidx = iminor(inode);
|
||||||
|
struct fb_info *info;
|
||||||
|
long ret;
|
||||||
|
|
||||||
|
info = registered_fb[fbidx];
|
||||||
|
mutex_lock(&info->lock);
|
||||||
|
ret = do_fb_ioctl(info, cmd, arg);
|
||||||
mutex_unlock(&info->lock);
|
mutex_unlock(&info->lock);
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
@ -1157,8 +1164,8 @@ struct fb_cmap32 {
|
||||||
compat_caddr_t transp;
|
compat_caddr_t transp;
|
||||||
};
|
};
|
||||||
|
|
||||||
static int fb_getput_cmap(struct inode *inode, struct file *file,
|
static int fb_getput_cmap(struct fb_info *info, unsigned int cmd,
|
||||||
unsigned int cmd, unsigned long arg)
|
unsigned long arg)
|
||||||
{
|
{
|
||||||
struct fb_cmap_user __user *cmap;
|
struct fb_cmap_user __user *cmap;
|
||||||
struct fb_cmap32 __user *cmap32;
|
struct fb_cmap32 __user *cmap32;
|
||||||
|
@ -1181,7 +1188,7 @@ static int fb_getput_cmap(struct inode *inode, struct file *file,
|
||||||
put_user(compat_ptr(data), &cmap->transp))
|
put_user(compat_ptr(data), &cmap->transp))
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
|
|
||||||
err = fb_ioctl(file, cmd, (unsigned long) cmap);
|
err = do_fb_ioctl(info, cmd, (unsigned long) cmap);
|
||||||
|
|
||||||
if (!err) {
|
if (!err) {
|
||||||
if (copy_in_user(&cmap32->start,
|
if (copy_in_user(&cmap32->start,
|
||||||
|
@ -1223,8 +1230,8 @@ static int do_fscreeninfo_to_user(struct fb_fix_screeninfo *fix,
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int fb_get_fscreeninfo(struct inode *inode, struct file *file,
|
static int fb_get_fscreeninfo(struct fb_info *info, unsigned int cmd,
|
||||||
unsigned int cmd, unsigned long arg)
|
unsigned long arg)
|
||||||
{
|
{
|
||||||
mm_segment_t old_fs;
|
mm_segment_t old_fs;
|
||||||
struct fb_fix_screeninfo fix;
|
struct fb_fix_screeninfo fix;
|
||||||
|
@ -1235,7 +1242,7 @@ static int fb_get_fscreeninfo(struct inode *inode, struct file *file,
|
||||||
|
|
||||||
old_fs = get_fs();
|
old_fs = get_fs();
|
||||||
set_fs(KERNEL_DS);
|
set_fs(KERNEL_DS);
|
||||||
err = fb_ioctl(file, cmd, (unsigned long) &fix);
|
err = do_fb_ioctl(info, cmd, (unsigned long) &fix);
|
||||||
set_fs(old_fs);
|
set_fs(old_fs);
|
||||||
|
|
||||||
if (!err)
|
if (!err)
|
||||||
|
@ -1244,8 +1251,10 @@ static int fb_get_fscreeninfo(struct inode *inode, struct file *file,
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
static long
|
static long fb_compat_ioctl(struct file *file, unsigned int cmd,
|
||||||
fb_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
unsigned long arg)
|
||||||
|
__acquires(&info->lock)
|
||||||
|
__releases(&info->lock)
|
||||||
{
|
{
|
||||||
struct inode *inode = file->f_path.dentry->d_inode;
|
struct inode *inode = file->f_path.dentry->d_inode;
|
||||||
int fbidx = iminor(inode);
|
int fbidx = iminor(inode);
|
||||||
|
@ -1262,16 +1271,16 @@ fb_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
||||||
case FBIOPUT_CON2FBMAP:
|
case FBIOPUT_CON2FBMAP:
|
||||||
arg = (unsigned long) compat_ptr(arg);
|
arg = (unsigned long) compat_ptr(arg);
|
||||||
case FBIOBLANK:
|
case FBIOBLANK:
|
||||||
mutex_unlock(&info->lock);
|
ret = do_fb_ioctl(info, cmd, arg);
|
||||||
return fb_ioctl(file, cmd, arg);
|
break;
|
||||||
|
|
||||||
case FBIOGET_FSCREENINFO:
|
case FBIOGET_FSCREENINFO:
|
||||||
ret = fb_get_fscreeninfo(inode, file, cmd, arg);
|
ret = fb_get_fscreeninfo(info, cmd, arg);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case FBIOGETCMAP:
|
case FBIOGETCMAP:
|
||||||
case FBIOPUTCMAP:
|
case FBIOPUTCMAP:
|
||||||
ret = fb_getput_cmap(inode, file, cmd, arg);
|
ret = fb_getput_cmap(info, cmd, arg);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
default:
|
default:
|
||||||
|
@ -1286,6 +1295,8 @@ fb_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
||||||
|
|
||||||
static int
|
static int
|
||||||
fb_mmap(struct file *file, struct vm_area_struct * vma)
|
fb_mmap(struct file *file, struct vm_area_struct * vma)
|
||||||
|
__acquires(&info->lock)
|
||||||
|
__releases(&info->lock)
|
||||||
{
|
{
|
||||||
int fbidx = iminor(file->f_path.dentry->d_inode);
|
int fbidx = iminor(file->f_path.dentry->d_inode);
|
||||||
struct fb_info *info = registered_fb[fbidx];
|
struct fb_info *info = registered_fb[fbidx];
|
||||||
|
@ -1339,6 +1350,8 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
|
||||||
|
|
||||||
static int
|
static int
|
||||||
fb_open(struct inode *inode, struct file *file)
|
fb_open(struct inode *inode, struct file *file)
|
||||||
|
__acquires(&info->lock)
|
||||||
|
__releases(&info->lock)
|
||||||
{
|
{
|
||||||
int fbidx = iminor(inode);
|
int fbidx = iminor(inode);
|
||||||
struct fb_info *info;
|
struct fb_info *info;
|
||||||
|
@ -1374,6 +1387,8 @@ out:
|
||||||
|
|
||||||
static int
|
static int
|
||||||
fb_release(struct inode *inode, struct file *file)
|
fb_release(struct inode *inode, struct file *file)
|
||||||
|
__acquires(&info->lock)
|
||||||
|
__releases(&info->lock)
|
||||||
{
|
{
|
||||||
struct fb_info * const info = file->private_data;
|
struct fb_info * const info = file->private_data;
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue