On Wed, Apr 06, 2022 at 11:39:17PM +0200, Javier Martinez Canillas wrote:
> Drivers that want to remove registered conflicting framebuffers prior to
> register their own framebuffer, calls remove_conflicting_framebuffers().
>
> This function takes the registration_lock mutex, to prevent a races when
> drivers register framebuffer devices. But if a conflicting framebuffer
> device is found, the underlaying platform device is unregistered and this
> will lead to the platform driver .remove callback to be called, which in
> turn will call to the unregister_framebuffer() that takes the same lock.
>
> To prevent this, a struct fb_info.forced_out field was used as indication
> to unregister_framebuffer() whether the mutex has to be grabbed or not.
>
> A cleaner solution is to drop the lock before platform_device_unregister()
> so unregister_framebuffer() can take it when called from the fbdev driver,
> and just grab the lock again after the device has been registered and do
> a removal loop restart.
>
> Since the framebuffer devices will already be removed, the loop would just
> finish when no more conflicting framebuffers are found.
>
> Suggested-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
> Signed-off-by: Javier Martinez Canillas <javierm@xxxxxxxxxx>
It's always entertaining with these things since they can go boom in funny
ways, but need to a least try :-) Recursive locks are just a bit too evil.
Reviewed-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
> ---
>
> drivers/video/fbdev/core/fbmem.c | 21 ++++++++++++++-------
> include/linux/fb.h | 1 -
> 2 files changed, 14 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
> index b585339509b0..c1bfb8df9cba 100644
> --- a/drivers/video/fbdev/core/fbmem.c
> +++ b/drivers/video/fbdev/core/fbmem.c
> @@ -1555,6 +1555,7 @@ static void do_remove_conflicting_framebuffers(struct apertures_struct *a,
> {
> int i;
>
> +restart_removal:
> /* check all firmware fbs and kick off if the base addr overlaps */
> for_each_registered_fb(i) {
> struct apertures_struct *gen_aper;
> @@ -1582,8 +1583,18 @@ static void do_remove_conflicting_framebuffers(struct apertures_struct *a,
> * fix would add code to remove the device from the system.
> */
> if (dev_is_platform(device)) {
> - registered_fb[i]->forced_out = true;
> + /*
> + * Drop the lock since the driver will call to the
> + * unregister_framebuffer() function that takes it.
> + */
> + mutex_unlock(®istration_lock);
> platform_device_unregister(to_platform_device(device));
> + mutex_lock(®istration_lock);
> + /*
> + * Restart the removal now that the platform device
> + * has been unregistered and its associated fb gone.
> + */
> + goto restart_removal;
> } else {
> pr_warn("fb%d: cannot remove device\n", i);
> do_unregister_framebuffer(registered_fb[i]);
> @@ -1917,13 +1928,9 @@ EXPORT_SYMBOL(register_framebuffer);
> void
> unregister_framebuffer(struct fb_info *fb_info)
> {
> - bool forced_out = fb_info->forced_out;
> -
> - if (!forced_out)
> - mutex_lock(®istration_lock);
> + mutex_lock(®istration_lock);
> do_unregister_framebuffer(fb_info);
> - if (!forced_out)
> - mutex_unlock(®istration_lock);
> + mutex_unlock(®istration_lock);
> }
> EXPORT_SYMBOL(unregister_framebuffer);
>
> diff --git a/include/linux/fb.h b/include/linux/fb.h
> index 39baa9a70779..f1e0cd751b06 100644
> --- a/include/linux/fb.h
> +++ b/include/linux/fb.h
> @@ -503,7 +503,6 @@ struct fb_info {
> } *apertures;
>
> bool skip_vt_switch; /* no VT switch on suspend/resume required */
> - bool forced_out; /* set when being removed by another driver */
> };
>
> static inline struct apertures_struct *alloc_apertures(unsigned int max_num) {
> --
> 2.35.1
>
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
