diff mbox series

[wrynose,29/36] linux-yocto/6.18: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker

Message ID ca1e1cfe697c211cf3bc356d284b103fde8f9982.1785190123.git.yoann.congal@smile.fr
State New
Headers show
Series [wrynose,01/36] curl: fix CVE-2026-7168 | expand

Commit Message

Yoann Congal July 27, 2026, 10:55 p.m. UTC 
From: Bruce Ashfield <bruce.ashfield@gmail.com>

To partially (or fully) address: https://bugzilla.yoctoproject.org/show_bug.cgi?id=16217

Integrating the following commit(s) to linux-yocto/6.18:

1/1 [
    Author: Ryosuke Yasuoka
    Email: ryasuoka@redhat.com
    Subject: drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
    Date: Mon, 13 Jul 2026 22:01:00 +0900

    A probe-time deadlock can occur between the dequeue worker and
    drm_client_register(). During probe, drm_client_register() holds
    clientlist_mutex and calls the fbdev hotplug callback, which triggers an
    atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs()
    waiting for virtqueue space. The dequeue worker that would free that
    space calls virtio_gpu_cmd_get_display_info_cb(), which invokes
    drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting
    to acquire the same clientlist_mutex. Since wake_up() is only called
    after the resp_cb loop, the probe thread is never woken and both threads
    deadlock.

    Fix this by removing the hotplug notification from
    virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info)
    is still updated synchronously in the callback.

    For the init path, drm_client_register() already fires an initial
    hotplug when the client is registered, which picks up the connector
    state updated by display_info_cb.

    For the runtime config_changed path, add a wait_event_timeout() in
    config_changed_work_func() so that display_info_cb updates the connector
    data before the hotplug notification is sent. Also replace
    drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since
    virtio-gpu never calls drm_kms_helper_poll_init() and thus
    drm_helper_hpd_irq_event() always returns false without doing anything.

    Fixes: 27655b9bb9f0 ("drm/client: Send hotplug event after registering a client")
    Closes: https://syzkaller.appspot.com/bug?id=d6dd6f86d3aaf7eebe7406e45c1c6e549453f224
    Closes: https://syzkaller.appspot.com/bug?id=908bd910da5dd79b88de4cf7baf376cc873a922e
    Suggested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
    Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
    Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
    Link: https://patch.msgid.link/20260713-virtiogpu_syzbot-v2-1-2958fa37d46d@redhat.com
    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 496ab6151ead169d9f4873d1e2a3f5e646c73b07)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 .../linux/linux-yocto-rt_6.18.bb               |  2 +-
 .../linux/linux-yocto-tiny_6.18.bb             |  2 +-
 meta/recipes-kernel/linux/linux-yocto_6.18.bb  | 18 +++++++++---------
 3 files changed, 11 insertions(+), 11 deletions(-)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
index 6d287cdc7d5..9d44c803eb9 100644
--- a/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-rt_6.18.bb
@@ -15,7 +15,7 @@  python () {
         raise bb.parse.SkipRecipe("Set PREFERRED_PROVIDER_virtual/kernel to linux-yocto-rt to enable it")
 }
 
-SRCREV_machine ?= "0156acd2db993abc3baa366fee892d503aab1ccc"
+SRCREV_machine ?= "56572c42354027a50e261f16fe13b057604873e7"
 SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
 
 SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;branch=${KBRANCH};name=machine;protocol=https \
diff --git a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
index 8b9201a73e3..7ff47505aa0 100644
--- a/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto-tiny_6.18.bb
@@ -18,7 +18,7 @@  DEPENDS += "openssl-native util-linux-native"
 KMETA = "kernel-meta"
 KCONF_BSP_AUDIT_LEVEL = "2"
 
-SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
 SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
 
 PV = "${LINUX_VERSION}+git"
diff --git a/meta/recipes-kernel/linux/linux-yocto_6.18.bb b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
index 8528869a5ed..6111ae89daa 100644
--- a/meta/recipes-kernel/linux/linux-yocto_6.18.bb
+++ b/meta/recipes-kernel/linux/linux-yocto_6.18.bb
@@ -17,17 +17,17 @@  KBRANCH:qemux86-64 ?= "v6.18/standard/base"
 KBRANCH:qemuloongarch64  ?= "v6.18/standard/base"
 KBRANCH:qemumips64 ?= "v6.18/standard/mti-malta"
 
-SRCREV_machine:qemuarm ?= "162946cfb65f28f0a5f60e927bdae5615e6356a8"
-SRCREV_machine:qemuarm64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemuloongarch64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuarm ?= "78e0248ce3cecd33f63926cd1d54c64e163d076c"
+SRCREV_machine:qemuarm64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemuloongarch64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
 SRCREV_machine:qemumips ?= "62ea92a539f58803a222be98b81118403074206e"
-SRCREV_machine:qemuppc ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemuriscv64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemuriscv32 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemux86 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
-SRCREV_machine:qemux86-64 ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine:qemuppc ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemuriscv64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemuriscv32 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemux86 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
+SRCREV_machine:qemux86-64 ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
 SRCREV_machine:qemumips64 ?= "9fb4ff0187c85426f21fd40d4c61b742800f65c4"
-SRCREV_machine ?= "a05c451ede0dd80b1cc2362b47f36f3c137cbd1e"
+SRCREV_machine ?= "9eb7db1359675f27707b030ba228f381c10cd53e"
 SRCREV_meta ?= "2f71b0a288c307062fc60948ac793d8d51c685e2"
 
 # set your preferred provider of linux-yocto to 'linux-yocto-upstream', and you'll