drm/i915: Fix potential AB-BA deadlock in i915_gem_execbuffer()
authorRoland Dreier <rdreier@cisco.com>
Sat, 7 Feb 2009 01:48:09 +0000 (17:48 -0800)
committerDave Airlie <airlied@redhat.com>
Fri, 20 Feb 2009 02:21:10 +0000 (12:21 +1000)
commita35f2e2b83a789e189a501ebd722bc9a1310eb05
treea98654866d9295266dcf5ca61740004358b585ba
parent96dec61d563fb8dff2c8427fdf85327a95b65c74
drm/i915: Fix potential AB-BA deadlock in i915_gem_execbuffer()

Lockdep warns that i915_gem_execbuffer() can trigger a page fault (which
takes mmap_sem) while holding dev->struct_mutex, while drm_vm_open()
(which is called with mmap_sem already held) takes dev->struct_mutex.
So this is a potential AB-BA deadlock.

The way that i915_gem_execbuffer() triggers a page fault is by doing
copy_to_user() when returning new buffer offsets back to userspace;
however there is no reason to hold the struct_mutex when doing this
copy, since what is being copied is the contents of an array private to
i915_gem_execbuffer() anyway.  So we can fix the potential deadlock (and
get rid of the lockdep warning) by simply moving the copy_to_user()
outside of where struct_mutex is held.

This fixes <http://bugzilla.kernel.org/show_bug.cgi?id=12491>.

Reported-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Dave Airlie <airlied@linux.ie>
drivers/gpu/drm/i915/i915_gem.c