fbmem: fix fb_info->lock and mm->mmap_sem circular locking dependency

Fix a circular locking dependency in the frame buffer console driver
pushing down the mutex fb_info->lock.

Circular locking dependecies occur calling the blocking
fb_notifier_call_chain() with fb_info->lock held.  Notifier callbacks can
try to acquire mm->mmap_sem, while fb_mmap() acquires the locks in the
reverse order mm->mmap_sem => fb_info->lock.

Tested-by: Andrey Borzenkov <arvidjaar@mail.ru>
Signed-off-by: Andrea Righi <righi.andrea@gmail.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 1 insertions, 10 deletions

diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index cfd9dce1ce0b..b64f061dd447 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1086,13 +1086,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
                         return -EINVAL;
                 con2fb.framebuffer = -1;
                 event.data = &con2fb;
-
-                if (!lock_fb_info(info))
-                        return -ENODEV;
                 event.info = info;
                 fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);
-                unlock_fb_info(info);
-
                 ret = copy_to_user(argp, &con2fb, sizeof(con2fb)) ? -EFAULT : 0;
                 break;
         case FBIOPUT_CON2FBMAP:
@@ -1109,12 +1104,8 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
                         break;
                 }
                 event.data = &con2fb;
-                if (!lock_fb_info(info))
-                        return -ENODEV;
                 event.info = info;
-                ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP,
-                                              &event);
-                unlock_fb_info(info);
+                ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP, &event);
                 break;
         case FBIOBLANK:
                 if (!lock_fb_info(info))