Commit 4089e272 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Daniel Vetter
Browse files

gpu/drm: Fix lock held when returning to user space. 



We need to call drm_modeset_acquire_fini() when drm_atomic_state_alloc()
failed or call drm_modeset_acquire_init() after drm_atomic_state_alloc()
succeeded.

Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: default avatarsyzbot <syzbot+6ea337c427f5083ebdf2@syzkaller.appspotmail.com>
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1547115571-21219-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
parent 66a8d5bf

drivers/gpu/drm/drm_atomic_uapi.c

+1 −2
Original line number Diff line number Diff line
@@ -1296,12 +1296,11 @@ int drm_mode_atomic_ioctl(struct drm_device *dev, 
			(arg->flags & DRM_MODE_PAGE_FLIP_EVENT))

		return -EINVAL;



	drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);



	state = drm_atomic_state_alloc(dev);

	if (!state)

		return -ENOMEM;



	drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);

	state->acquire_ctx = &ctx;

	state->allow_modeset = !!(arg->flags & DRM_MODE_ATOMIC_ALLOW_MODESET);

drivers/gpu/drm/drm_mode_object.c

+2 −2
Original line number Diff line number Diff line
@@ -459,11 +459,11 @@ static int set_property_atomic(struct drm_mode_object *obj, 
	struct drm_modeset_acquire_ctx ctx;

	int ret;



	drm_modeset_acquire_init(&ctx, 0);



	state = drm_atomic_state_alloc(dev);

	if (!state)

		return -ENOMEM;



	drm_modeset_acquire_init(&ctx, 0);

	state->acquire_ctx = &ctx;

retry:

	if (prop == state->dev->mode_config.dpms_property) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE