Commit 889ad63d authored by Jeremy Cline's avatar Jeremy Cline Committed by Gerd Hoffmann

drm/qxl: Call qxl_bo_unref outside atomic context

"qxl_bo_unref" may sleep, but calling "qxl_release_map" causes
"preempt_disable()" to be called and "preempt_enable()" isn't called
until "qxl_release_unmap" is used. Move the call to "qxl_bo_unref" out
from in between the two to avoid sleeping from an atomic context.

This issue can be demonstrated on a kernel with CONFIG_LOCKDEP=y by
creating a VM using QXL, using a desktop environment using Xorg, then
moving the cursor on or off a window.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1571128
Fixes: 9428088c ("drm/qxl: reapply cursor after resetting primary")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJeremy Cline <jcline@redhat.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20180601200532.13619-1-jcline@redhat.comSigned-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent c32048d9
...@@ -630,7 +630,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, ...@@ -630,7 +630,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
struct qxl_cursor_cmd *cmd; struct qxl_cursor_cmd *cmd;
struct qxl_cursor *cursor; struct qxl_cursor *cursor;
struct drm_gem_object *obj; struct drm_gem_object *obj;
struct qxl_bo *cursor_bo = NULL, *user_bo = NULL; struct qxl_bo *cursor_bo = NULL, *user_bo = NULL, *old_cursor_bo = NULL;
int ret; int ret;
void *user_ptr; void *user_ptr;
int size = 64*64*4; int size = 64*64*4;
...@@ -684,7 +684,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, ...@@ -684,7 +684,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
cursor_bo, 0); cursor_bo, 0);
cmd->type = QXL_CURSOR_SET; cmd->type = QXL_CURSOR_SET;
qxl_bo_unref(&qcrtc->cursor_bo); old_cursor_bo = qcrtc->cursor_bo;
qcrtc->cursor_bo = cursor_bo; qcrtc->cursor_bo = cursor_bo;
cursor_bo = NULL; cursor_bo = NULL;
} else { } else {
...@@ -704,6 +704,9 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, ...@@ -704,6 +704,9 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
qxl_release_fence_buffer_objects(release); qxl_release_fence_buffer_objects(release);
if (old_cursor_bo)
qxl_bo_unref(&old_cursor_bo);
qxl_bo_unref(&cursor_bo); qxl_bo_unref(&cursor_bo);
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment