[PATCH] fbcon: Avoid cancel_delayed_work_sync() in atomic context

[PATCH] fbcon: Avoid cancel_delayed_work_sync() in atomic context

[Yao Yiqi]

From: Yao Yiqi <yaoyiqi3@huawei.com>

fbcon_cursor() can be reached from the console printing path with
interrupts disabled, but it might sleep in two paths:

  console_unlock()                  <- IRQ disabled here
    vt_console_print()
      hide_cursor()
        con_cursor()
          fbcon_cursor()
            fbcon_del_cursor_work() <- this call may sleep

  console_unlock()                    <- IRQ disabled here
    vt_console_print()
      lf()
        con_scroll()
          fbcon_scroll()
            fbcon_cursor()
              fbcon_del_cursor_work() <- this call may sleep

When the VT software cursor is enabled (vc_cursor_type & CUR_SW),
fbcon_cursor() calls fbcon_del_cursor_work(), which uses
cancel_delayed_work_sync() and therefore may sleep.

With CONFIG_DEBUG_ATOMIC_SLEEP enabled, there are reports like this:

  BUG: sleeping function called from invalid context at kernel/workqueue.c:4722
  in_atomic(): 1, irqs_disabled(): 1, non_block: 0
  ...
  __cancel_work_sync
  fbcon_del_cursor_work
  fbcon_cursor
  hide_cursor
  vt_console_print
  console_unlock
  ...

Use the non-synchronizing cancel when called with interrupts disabled or
from an interrupt context. We still keep the synchronizing cancel in
sleepable contexts, where it is needed to drain the work before
teardown.

Signed-off-by: Yao Yiqi <yaoyiqi3@huawei.com>
---
 drivers/video/fbdev/core/fbcon.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 94abbb5ac766..f1dbf973e44b 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -56,6 +56,9 @@
  *  more details.
  */
 
+#include "linux/irqflags.h"
+#include "linux/preempt.h"
+#include "linux/workqueue.h"
 #include <linux/export.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -441,7 +444,14 @@ static void fbcon_del_cursor_work(struct fb_info *info)
 {
 	struct fbcon_par *par = info->fbcon_par;
 
-	cancel_delayed_work_sync(&par->cursor_work);
+	/*
+	 * fbcon_cursor() can be reached from the console printing path with 
+	 * interrupts disabled. Only synchronize when sleeping is allowed.
+	 */
+	if (in_interrupt() || irqs_disabled())
+		cancel_delayed_work(&par->cursor_work);
+	else
+		cancel_delayed_work_sync(&par->cursor_work);
 }
 
 unsigned char *fbcon_cursor_glyph(const struct vc_font *font, unsigned int cursor_type)
-- 
2.56.0