From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=74.125.229.9 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793072849; b=u+SKSrUXflJ3yjlFEt03mgmKAwVl29DJZuks2YwUg0rV4uGjTOb1e5JG5+hTqxZCt8AI JS38osPDGl++s381pE0yXeY5pWoP0s43ZvHLpGdQQe+y4MPeltAu47MtSDaa9Tcxn6qT8 k62DoJgCE6LB6JKGALvAAkrXIrysnu4EIgq82Hw2S/DA0h+d2aNXkOaLPx0jinSKM2NwO YB1T5gcIWfSv0Il11E23N+H7/OodHYx7eLYsfBY9Fb/RKMECAVaJ0zDMMuJxkBEg+vl1g Cnp+TAGdWZ5sJyQ9q31l0E3cCVtertbkBEauVFUZvXAEq075cmIkuQgNUYjjoAdGwSg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793072849; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Gm-Gg:X-Received:Received: From:To:Cc:Subject:Date:Message-ID:X-Mailer:MIME-Version: Content-Transfer-Encoding; bh=d5xPE7zkAisWNP1/3IMkS+loLJJfjfdBEUGlcoiM7g0=; b=ffNy33zF6L+xcTg0XLk+NrsRdlqqBMqBddeTo99jc1BCIMHccHDMRTLK65Pb74As85vl ldFrGGWcLd3RGl5tYGLMLlqYE7tmjLulizwbnwoiw1yZZ+akD/nKJ58LQi8cgcfrEO8SE LbELFydyGMIAoYoMUAjPzfmikF/HGrOnfmE3EhOJvS/FR+QjdTodp5qwGqanQl/q60emC 1GMBzd7OkJlMRcSzNpl+1bVLRZsB34MZmXJUKwX2qdrSq4SY25gKnGB7SszA3hcmiRMX1 SrYjEI7bLa9gqfHcbTC+ejT2MphJN+RtZRpGluO2lPqjaiocx6C27PXIyL3vsIKccVg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=e983Zow8; arc=none smtp.remote-ip=74.125.229.9 Received: from mail-dy2-f9.google.com (mail-dy2-f9.google.com [74.125.229.9]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13D15606A31D for ; Tue, 27 Oct 2026 03:47:28 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 13D15606A31D Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=e983Zow8 Received: by mail-dy2-f9.google.com with SMTP id 5a478bee46e88-3678f64d078so778572eec.1 for ; Mon, 26 Oct 2026 20:47:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1793072848; x=1793677648; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=d5xPE7zkAisWNP1/3IMkS+loLJJfjfdBEUGlcoiM7g0=; b=e983Zow8bqjcKnPpbeo0bbx7KS7wIeUh39gAOhDmf2Re+Zkktq3fgnJC41tfL3GREe 5c6sMBCH2D4WNBCK52FND3Xet7GOvnwn13zfbYx7WoOVAzxFGimRlBBT7Y07ZzNEEktP 7WXk+Yi/UJL42KfR3Di5c6WFqo5Tvb/ND7+pWcYoSSHGN6Xhi6Bl7CypCbWewPd3QNUT k5mohsSecJcBa+nCksrsh0AVnrGG/oWPJl9JesGIU1/9WNuYcQbYO1xjz+ZNXnwBd8tf JdeFa+FyY3QE6XfKiASyPEKdUp1zMj78IG9LZPrLQSMz0xSnnywEzz5NhGHDOWOQTzl3 OHSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793072848; x=1793677648; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=d5xPE7zkAisWNP1/3IMkS+loLJJfjfdBEUGlcoiM7g0=; b=JDTjQwKzCYmEL/TEZ3QNsVU70HVJB5vGaVb+796d/WsVUazJtfNTOc/3aY3FzG1b1z ZHiMJveORDgRM1wm25vbRkE1/F/uu1XhuzCULEfsplmwBcfgPCLJuuMboxI3nrKkXCyv kcKAx1bz6Zl65JkUKcInNsBM9uxtO6lGvoxPx2rFDXX2MUPP93A+vtUttqCUMOXPbOvb 2gYJATLO8oHR5new9pQk/4DGfUPsaFVZk9g7SUowoWbhPEOdQStAHGWd7HrTzY6SB5Zt uQ8K0LZzzLGenEIaka2E7mXPuSHKR8s+F/w/WBBpB8sKkEF2k1HQyEI1zWGbIWp+z7ua xQpQ== X-Forwarded-Encrypted: i=1; AKwUvBw9Cq3t7TmbQcChjk6KwlYGEM+YRuLL5Wdjx8n1AioXIarxL7FWeeCapH5vuKbG1locxGzjGs0Xq+To//Q=@vger.kernel.org X-Gm-Message-State: AFq9FYJA1WSs4OBA6R+Bf5vDiRfn/CE0pEzZZKaSFzteJW4rq/j8vIHN RbJ2EqjHLh50aBulbY2uNwI8j9tNPn5qfhPt4uLH21ukPC6OBszrkfQS X-Gm-Gg: AYBFou23MWDYodCV5FnQF1W3YErxNmM+aiCTTjkOS3F2S/M1wrXpMRun+snjSr+LZRY 8tbGukOuyTZ411nVaj2cyHGQVPSzwYBhY/Rg8BVDKv9XBEjm7tziZjYUiR8s4RlkVkE9cewh7AX e20ncDSxen2pGGjR1bpiQGxPOceD2v2bin7YEak2qOCiznSTuMwKvF/V1TrflVZCtD9w+PDbyaK FICDx82KLWVtB5rz/tTSlgbmM6jdzToAwyUms8DEv/fSnSfrQbJUg1KPG+3Z54jKM77zRFEjnmg 72lqOJtmEavFHDYEXE6tcnhMfxnylWRFzkwOyMznkoBf9VyLn7LUs/HgTtCe8TAxszd1t50uOTl 7L13gALJCdcVgZ4tDlE5GJ+LvyHmN/Wc7dForo2z187jE4HNBiM5L/xT9lE0gu5J1mrACsxuoJx XBWkK2iiZwDcaFO4i8THGm5CQlEELBe5sNgCTOSmrRm+l75b8T22sHj+WPM2liBYp9qLWiuLMgk d29/8y1iL5DMyz4PT7s6zLv+hcqyZtra5onzAlmk1QWHPGqCoWKdK9qHqqpTQgaD4mDSThURvM2 FhABCJoVMMoWzjdX X-Received: by 2002:a05:7301:7d01:b0:366:c497:610c with SMTP id 5a478bee46e88-369e8610133mr11168504eec.33.1793072847986; Mon, 26 Oct 2026 20:47:27 -0700 (PDT) Received: from blue.tailcc13ef.ts.net (104.194.64.109.16clouds.com. [104.194.64.109]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36a026e04a0sm11349777eec.1.2026.10.26.20.47.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 20:47:27 -0700 (PDT) From: Yao Yiqi To: deller@gmx.de, tzimmermann@suse.de, simona@ffwll.ch Cc: dri-devel@lists.freedesktop.org, linux-fbdev@vger.kernel.org, linux-kernel@vger.kernel.org, yaoyiqi3@huawei.com, stable@vger.kernel.org Subject: [PATCH v2] fbcon: Avoid cancel_delayed_work_sync() in atomic context Date: Tue, 27 Oct 2026 11:47:16 +0800 Message-ID: <20261027034716.588174-1-yyaqia@gmail.com> X-Mailer: git-send-email 2.56.0 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Yao Yiqi fbcon_cursor() can be reached from the console printing path, which runs in atomic context. When the VT software cursor is enabled (vc_cursor_type & CUR_SW), it calls fbcon_del_cursor_work(), which uses cancel_delayed_work_sync() and therefore may sleep. With CONFIG_DEBUG_ATOMIC_SLEEP enabled, the following is reported: BUG: sleeping function called from invalid context at kernel/workqueue.c:4722 in_atomic(): 1, irqs_disabled(): 1, non_block: 0 ... __cancel_work_sync fbcon_del_cursor_work fbcon_cursor hide_cursor vt_console_print console_unlock ... Make the default helper safe: fbcon_del_cursor_work() only stops blinking, using cancel_delayed_work(), which is allowed in any context. Every "stop blinking" call site keeps using it, including fbcon_cursor(). Only fbcon_release(), which is about to free @par and must ensure that no callback is still using it, calls the separate fbcon_del_cursor_work_sync(). New call sites therefore get the safe variant by default. cancel_delayed_work() does not wait for a running callback, and fb_flashcursor() re-arms itself, so also move the requeue into the console_lock section. fbcon_del_cursor_work() callers hold console_lock, which serializes them with the requeue and keeps the non-synchronizing cancel effective. Fixes: 3b0fb6ab25dd ("fbcon: Use delayed work for cursor") Cc: stable@vger.kernel.org Assisted-by: Opencode:deepseek-v4.1-flash Signed-off-by: Yao Yiqi --- Sorry for the last email, I forgot to write changelog. This email has no code modification, it just adds the changelog. Changes in v2: - Reworked per review (sashiko-AI): do not guess the context with in_interrupt()/irqs_disabled(). fbcon_del_cursor_work() is now non-synchronizing by default and therefore safe from any context; fbcon_del_cursor_work_sync() is added for fbcon_release(), the only path that frees @par and needs to drain the work. - Move the requeue in fb_flashcursor() under console_lock so a running callback cannot re-arm the work after the non-synchronizing cancel. drivers/video/fbdev/core/fbcon.c | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 94abbb5ac766..917ce9d641a1 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -422,10 +422,14 @@ static void fb_flashcursor(struct work_struct *work) par->bitops->cursor(vc, info, enable, get_fg_color(vc, info, c), get_bg_color(vc, info, c)); - console_unlock(); + /* + * Re-arm under console_lock so that a concurrent + * fbcon_del_cursor_work() cannot race with this requeue. + */ queue_delayed_work(system_power_efficient_wq, &par->cursor_work, par->cur_blink_jiffies); + console_unlock(); } static void fbcon_add_cursor_work(struct fb_info *info) @@ -437,10 +441,30 @@ static void fbcon_add_cursor_work(struct fb_info *info) par->cur_blink_jiffies); } +/* + * Stop the cursor blink. + * + * Does not wait for a callback that is already running, so it is safe to + * call from any context. + * + * console_lock serializes this with the requeue in fb_flashcursor(); + * otherwise a running callback could re-arm the work. + */ static void fbcon_del_cursor_work(struct fb_info *info) { struct fbcon_par *par = info->fbcon_par; + cancel_delayed_work(&par->cursor_work); +} + +/* + * Stop the cursor blink and wait for a running callback to finish before + * @par is freed. May sleep, only for teardown paths. + */ +static void fbcon_del_cursor_work_sync(struct fb_info *info) +{ + struct fbcon_par *par = info->fbcon_par; + cancel_delayed_work_sync(&par->cursor_work); } @@ -765,7 +789,7 @@ static void fbcon_release(struct fb_info *info) if (info->fbcon_par) { struct fbcon_par *par = info->fbcon_par; - fbcon_del_cursor_work(info); + fbcon_del_cursor_work_sync(info); kfree(par->cursor_state.mask); kfree(par->cursor_data); kfree(par->cursor_src); -- 2.56.0