fbmem: fix fb_info->lock and mm->mmap_sem circular locking dependency

Fix a circular locking dependency in the frame buffer console driver
pushing down the mutex fb_info->lock.

Circular locking dependecies occur calling the blocking
fb_notifier_call_chain() with fb_info->lock held.  Notifier callbacks can
try to acquire mm->mmap_sem, while fb_mmap() acquires the locks in the
reverse order mm->mmap_sem => fb_info->lock.

Tested-by: Andrey Borzenkov <arvidjaar@mail.ru>
Signed-off-by: Andrea Righi <righi.andrea@gmail.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2 files changed, 6 insertions, 0 deletions

diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 157057c79ca3..dd37cbcaf8ce 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -35,6 +35,8 @@ static int fb_notifier_callback(struct notifier_block *self,
                 return 0;
 
         bd = container_of(self, struct backlight_device, fb_notif);
+        if (!lock_fb_info(evdata->info))
+                return -ENODEV;
         mutex_lock(&bd->ops_lock);
         if (bd->ops)
                 if (!bd->ops->check_fb ||
@@ -47,6 +49,7 @@ static int fb_notifier_callback(struct notifier_block *self,
                         backlight_update_status(bd);
                 }
         mutex_unlock(&bd->ops_lock);
+        unlock_fb_info(evdata->info);
         return 0;
 }
 
diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index b6449470106c..0bb13df0fa89 100644
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -40,6 +40,8 @@ static int fb_notifier_callback(struct notifier_block *self,
         if (!ld->ops)
                 return 0;
 
+        if (!lock_fb_info(evdata->info))
+                return -ENODEV;
         mutex_lock(&ld->ops_lock);
         if (!ld->ops->check_fb || ld->ops->check_fb(ld, evdata->info)) {
                 if (event == FB_EVENT_BLANK) {
@@ -51,6 +53,7 @@ static int fb_notifier_callback(struct notifier_block *self,
                 }
         }
         mutex_unlock(&ld->ops_lock);
+        unlock_fb_info(evdata->info);
         return 0;
 }