[v2,04/11] drm/qxl: fix lockdep issue in qxl_alloc_release_reserved
diff mbox series

Message ID 20210217123213.2199186-5-kraxel@redhat.com
State Accepted
Commit 19089b760e56c97458c272e90e43da761b05cf12
Headers show
Series
  • [v2,01/11] drm/qxl: properly handle device init failures
Related show

Commit Message

Gerd Hoffmann Feb. 17, 2021, 12:32 p.m. UTC
Call qxl_bo_unpin (which does a reservation) without holding the
release_mutex lock.  Fixes lockdep (correctly) warning on a possible
deadlock.

Fixes: 65ffea3c6e73 ("drm/qxl: unpin release objects")
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 drivers/gpu/drm/qxl/qxl_release.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

Comments

Thomas Zimmermann Feb. 17, 2021, 7:23 p.m. UTC | #1
Am 17.02.21 um 13:32 schrieb Gerd Hoffmann:
> Call qxl_bo_unpin (which does a reservation) without holding the
> release_mutex lock.  Fixes lockdep (correctly) warning on a possible
> deadlock.
> 
> Fixes: 65ffea3c6e73 ("drm/qxl: unpin release objects")
> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

Acked-by: Thomas Zimmermann <tzimmermann@suse.de>

> ---
>   drivers/gpu/drm/qxl/qxl_release.c | 13 ++++++++++---
>   1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
> index 716d706ca7f0..f5845c96d414 100644
> --- a/drivers/gpu/drm/qxl/qxl_release.c
> +++ b/drivers/gpu/drm/qxl/qxl_release.c
> @@ -283,7 +283,7 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
>   				       int type, struct qxl_release **release,
>   				       struct qxl_bo **rbo)
>   {
> -	struct qxl_bo *bo;
> +	struct qxl_bo *bo, *free_bo = NULL;
>   	int idr_ret;
>   	int ret = 0;
>   	union qxl_release_info *info;
> @@ -315,8 +315,7 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
>   
>   	mutex_lock(&qdev->release_mutex);
>   	if (qdev->current_release_bo_offset[cur_idx] + 1 >= releases_per_bo[cur_idx]) {
> -		qxl_bo_unpin(qdev->current_release_bo[cur_idx]);
> -		qxl_bo_unref(&qdev->current_release_bo[cur_idx]);
> +		free_bo = qdev->current_release_bo[cur_idx];
>   		qdev->current_release_bo_offset[cur_idx] = 0;
>   		qdev->current_release_bo[cur_idx] = NULL;
>   	}
> @@ -324,6 +323,10 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
>   		ret = qxl_release_bo_alloc(qdev, &qdev->current_release_bo[cur_idx], priority);
>   		if (ret) {
>   			mutex_unlock(&qdev->release_mutex);
> +			if (free_bo) {
> +				qxl_bo_unpin(free_bo);
> +				qxl_bo_unref(&free_bo);
> +			}
>   			qxl_release_free(qdev, *release);
>   			return ret;
>   		}
> @@ -339,6 +342,10 @@ int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
>   		*rbo = bo;
>   
>   	mutex_unlock(&qdev->release_mutex);
> +	if (free_bo) {
> +		qxl_bo_unpin(free_bo);
> +		qxl_bo_unref(&free_bo);
> +	}
>   
>   	ret = qxl_release_list_add(*release, bo);
>   	qxl_bo_unref(&bo);
>

Patch
diff mbox series

diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index 716d706ca7f0..f5845c96d414 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -283,7 +283,7 @@  int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
 				       int type, struct qxl_release **release,
 				       struct qxl_bo **rbo)
 {
-	struct qxl_bo *bo;
+	struct qxl_bo *bo, *free_bo = NULL;
 	int idr_ret;
 	int ret = 0;
 	union qxl_release_info *info;
@@ -315,8 +315,7 @@  int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
 
 	mutex_lock(&qdev->release_mutex);
 	if (qdev->current_release_bo_offset[cur_idx] + 1 >= releases_per_bo[cur_idx]) {
-		qxl_bo_unpin(qdev->current_release_bo[cur_idx]);
-		qxl_bo_unref(&qdev->current_release_bo[cur_idx]);
+		free_bo = qdev->current_release_bo[cur_idx];
 		qdev->current_release_bo_offset[cur_idx] = 0;
 		qdev->current_release_bo[cur_idx] = NULL;
 	}
@@ -324,6 +323,10 @@  int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
 		ret = qxl_release_bo_alloc(qdev, &qdev->current_release_bo[cur_idx], priority);
 		if (ret) {
 			mutex_unlock(&qdev->release_mutex);
+			if (free_bo) {
+				qxl_bo_unpin(free_bo);
+				qxl_bo_unref(&free_bo);
+			}
 			qxl_release_free(qdev, *release);
 			return ret;
 		}
@@ -339,6 +342,10 @@  int qxl_alloc_release_reserved(struct qxl_device *qdev, unsigned long size,
 		*rbo = bo;
 
 	mutex_unlock(&qdev->release_mutex);
+	if (free_bo) {
+		qxl_bo_unpin(free_bo);
+		qxl_bo_unref(&free_bo);
+	}
 
 	ret = qxl_release_list_add(*release, bo);
 	qxl_bo_unref(&bo);