Re: [PATCH] fbmem: fix race condition betweenregister_framebuffer() and fb_open()

From: Bruno PrÃmont
Date: Wed May 25 2011 - 12:19:40 EST


On Tue, 24 May 2011 Bruno PrÃmont <bonbons@xxxxxxxxxxxxxxxxx> wrote:
> On Tue, 24 May 2011 Fabio Erculiani <lxnay@xxxxxxxxxxx> wrote:
> > register_framebuffer() acquires registration_lock, then calls
> > do_register_framebuffer() which calls fb_notifier_call_chain()
> > which calls fb_open() which calls get_fb_info() which tries
> > (at last) to acquire registration_lock again.
> > This is a workaround.
>
> What calls fb_open() instead of just calling fb_info->fbops->fb_open
> when it is set?
> In other words what kernel handler of fb_notifier chain does file-based
> open of the framebuffer or is the event pushed out synchronously to
> userspace?

Note that fb_info->lock is also taken on both sides:
- per definition around all fb_notifier_call_chain() calls
- as well in fb_open() to protect fb_info->fb_ops->fb_open call.

Bruno


> > Signed-off-by: Fabio Erculiani <lxnay@xxxxxxxxxxx>
> > ---
> > drivers/video/fbmem.c | 13 ++++++++++++-
> > 1 files changed, 12 insertions(+), 1 deletions(-)
> >
> > diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
> > index 5aac00e..b9831a0 100644
> > --- a/drivers/video/fbmem.c
> > +++ b/drivers/video/fbmem.c
> > @@ -1628,6 +1628,11 @@ static int do_register_framebuffer(struct fb_info *fb_info)
> > event.info = fb_info;
> > if (!lock_fb_info(fb_info))
> > return -ENODEV;
> > +
> > + /* FIXME: unlock registration mutex before registration
> > + * notification is sent, in order to avoid deadlock.
> > + */
> > + mutex_unlock(&registration_lock);
> > fb_notifier_call_chain(FB_EVENT_FB_REGISTERED, &event);
> > unlock_fb_info(fb_info);
> > return 0;
> > @@ -1692,7 +1697,13 @@ register_framebuffer(struct fb_info *fb_info)
> >
> > mutex_lock(&registration_lock);
> > ret = do_register_framebuffer(fb_info);
> > - mutex_unlock(&registration_lock);
> > + if (ret != 0)
> > + /*
> > + * FIXME: mutex is unlocked only if ret == 0.
> > + * This is the second part of the workaround
> > + * that prevents deadlocking.
> > + */
> > + mutex_unlock(&registration_lock);
> >
> > return ret;
> > }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/