redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

fbdev: fix fb_compat_ioctl() deadlocks

Browse source 
commit 3e680aae4e ("fb: convert
lock/unlock_kernel() into local fb mutex") introduced several deadlocks
in the fb_compat_ioctl() path, as mutex_lock() doesn't allow recursion,
unlike lock_kernel().  This broke frame buffer applications on 64-bit
systems with a 32-bit userland.

commit 120a37470c ("framebuffer compat_ioctl
deadlock") fixed one of the deadlocks.

This patch fixes the remaining deadlocks:
  - Revert commit 120a37470c,
  - Extract the core logic of fb_ioctl() into a new function do_fb_ioctl(),
  - Change all callsites of fb_ioctl() where info->lock is already held to
    call do_fb_ioctl() instead,
  - Add sparse annotations to all routines that take info->lock.

Signed-off-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Cc: Mikulas Patocka <mpatocka@redhat.com>
Cc: Krzysztof Helt <krzysztof.h1@wp.pl>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Geert Uytterhoeven 2008-11-06 12:53:37 -08:00 committed by Linus Torvalds
parent a70dcb969f
commit a684e7d330
1 changed files with 39 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

63
drivers/video/fbmem.c
View file

@ -1002,13 +1002,9 @@ fb_blank(struct fb_info *info, int blank)
return ret; return ret;
} }
static long static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
fb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
unsigned long arg)
{ {
struct inode *inode = file->f_path.dentry->d_inode;
int fbidx = iminor(inode);
struct fb_info *info;
struct fb_ops *fb; struct fb_ops *fb;
struct fb_var_screeninfo var; struct fb_var_screeninfo var;
struct fb_fix_screeninfo fix; struct fb_fix_screeninfo fix;
@ -1018,14 +1014,10 @@ fb_ioctl(struct file *file, unsigned int cmd,
void __user *argp = (void __user *)arg; void __user *argp = (void __user *)arg;
long ret = 0; long ret = 0;
info = registered_fb[fbidx];
mutex_lock(&info->lock);
fb = info->fbops; fb = info->fbops;
if (!fb)
if (!fb) {
mutex_unlock(&info->lock);
return -ENODEV; return -ENODEV;
}
switch (cmd) { switch (cmd) {
case FBIOGET_VSCREENINFO: case FBIOGET_VSCREENINFO:
ret = copy_to_user(argp, &info->var, ret = copy_to_user(argp, &info->var,
@ -1126,6 +1118,21 @@ fb_ioctl(struct file *file, unsigned int cmd,
else else
ret = fb->fb_ioctl(info, cmd, arg); ret = fb->fb_ioctl(info, cmd, arg);
} }
return ret;
}
static long fb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
__acquires(&info->lock)
__releases(&info->lock)
{
struct inode *inode = file->f_path.dentry->d_inode;
int fbidx = iminor(inode);
struct fb_info *info;
long ret;
info = registered_fb[fbidx];
mutex_lock(&info->lock);
ret = do_fb_ioctl(info, cmd, arg);
mutex_unlock(&info->lock); mutex_unlock(&info->lock);
return ret; return ret;
} }
@ -1157,8 +1164,8 @@ struct fb_cmap32 {
compat_caddr_t transp; compat_caddr_t transp;
}; };
static int fb_getput_cmap(struct inode *inode, struct file *file, static int fb_getput_cmap(struct fb_info *info, unsigned int cmd,
unsigned int cmd, unsigned long arg) unsigned long arg)
{ {
struct fb_cmap_user __user *cmap; struct fb_cmap_user __user *cmap;
struct fb_cmap32 __user *cmap32; struct fb_cmap32 __user *cmap32;
@ -1181,7 +1188,7 @@ static int fb_getput_cmap(struct inode *inode, struct file *file,
put_user(compat_ptr(data), &cmap->transp)) put_user(compat_ptr(data), &cmap->transp))
return -EFAULT; return -EFAULT;
err = fb_ioctl(file, cmd, (unsigned long) cmap); err = do_fb_ioctl(info, cmd, (unsigned long) cmap);
if (!err) { if (!err) {
if (copy_in_user(&cmap32->start, if (copy_in_user(&cmap32->start,
@ -1223,8 +1230,8 @@ static int do_fscreeninfo_to_user(struct fb_fix_screeninfo *fix,
return err; return err;
} }
static int fb_get_fscreeninfo(struct inode *inode, struct file *file, static int fb_get_fscreeninfo(struct fb_info *info, unsigned int cmd,
unsigned int cmd, unsigned long arg) unsigned long arg)
{ {
mm_segment_t old_fs; mm_segment_t old_fs;
struct fb_fix_screeninfo fix; struct fb_fix_screeninfo fix;
@ -1235,7 +1242,7 @@ static int fb_get_fscreeninfo(struct inode *inode, struct file *file,
old_fs = get_fs(); old_fs = get_fs();
set_fs(KERNEL_DS); set_fs(KERNEL_DS);
err = fb_ioctl(file, cmd, (unsigned long) &fix); err = do_fb_ioctl(info, cmd, (unsigned long) &fix);
set_fs(old_fs); set_fs(old_fs);
if (!err) if (!err)
@ -1244,8 +1251,10 @@ static int fb_get_fscreeninfo(struct inode *inode, struct file *file,
return err; return err;
} }
static long static long fb_compat_ioctl(struct file *file, unsigned int cmd,
fb_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) unsigned long arg)
__acquires(&info->lock)
__releases(&info->lock)
{ {
struct inode *inode = file->f_path.dentry->d_inode; struct inode *inode = file->f_path.dentry->d_inode;
int fbidx = iminor(inode); int fbidx = iminor(inode);
@ -1262,16 +1271,16 @@ fb_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
case FBIOPUT_CON2FBMAP: case FBIOPUT_CON2FBMAP:
arg = (unsigned long) compat_ptr(arg); arg = (unsigned long) compat_ptr(arg);
case FBIOBLANK: case FBIOBLANK:
mutex_unlock(&info->lock); ret = do_fb_ioctl(info, cmd, arg);
return fb_ioctl(file, cmd, arg); break;
case FBIOGET_FSCREENINFO: case FBIOGET_FSCREENINFO:
ret = fb_get_fscreeninfo(inode, file, cmd, arg); ret = fb_get_fscreeninfo(info, cmd, arg);
break; break;
case FBIOGETCMAP: case FBIOGETCMAP:
case FBIOPUTCMAP: case FBIOPUTCMAP:
ret = fb_getput_cmap(inode, file, cmd, arg); ret = fb_getput_cmap(info, cmd, arg);
break; break;
default: default:
@ -1286,6 +1295,8 @@ fb_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
static int static int
fb_mmap(struct file *file, struct vm_area_struct * vma) fb_mmap(struct file *file, struct vm_area_struct * vma)
__acquires(&info->lock)
__releases(&info->lock)
{ {
int fbidx = iminor(file->f_path.dentry->d_inode); int fbidx = iminor(file->f_path.dentry->d_inode);
struct fb_info *info = registered_fb[fbidx]; struct fb_info *info = registered_fb[fbidx];
@ -1339,6 +1350,8 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
static int static int
fb_open(struct inode *inode, struct file *file) fb_open(struct inode *inode, struct file *file)
__acquires(&info->lock)
__releases(&info->lock)
{ {
int fbidx = iminor(inode); int fbidx = iminor(inode);
struct fb_info *info; struct fb_info *info;
@ -1374,6 +1387,8 @@ out:
static int static int
fb_release(struct inode *inode, struct file *file) fb_release(struct inode *inode, struct file *file)
__acquires(&info->lock)
__releases(&info->lock)
{ {
struct fb_info * const info = file->private_data; struct fb_info * const info = file->private_data;