linux/drivers/gpu/drm/virtio
Ryosuke Yasuoka d1b894c5bb drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker
A probe-time deadlock can occur between the dequeue worker and
drm_client_register(). During probe, drm_client_register() holds
clientlist_mutex and calls the fbdev hotplug callback, which triggers an
atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs()
waiting for virtqueue space. The dequeue worker that would free that
space calls virtio_gpu_cmd_get_display_info_cb(), which invokes
drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting
to acquire the same clientlist_mutex. Since wake_up() is only called
after the resp_cb loop, the probe thread is never woken and both threads
deadlock.

Fix this by removing the hotplug notification from
virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info)
is still updated synchronously in the callback.

For the init path, drm_client_register() already fires an initial
hotplug when the client is registered, which picks up the connector
state updated by display_info_cb.

For the runtime config_changed path, add a wait_event_timeout() in
config_changed_work_func() so that display_info_cb updates the connector
data before the hotplug notification is sent. Also replace
drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since
virtio-gpu never calls drm_kms_helper_poll_init() and thus
drm_helper_hpd_irq_event() always returns false without doing anything.

Fixes: 27655b9bb9 ("drm/client: Send hotplug event after registering a client")
Closes: https://syzkaller.appspot.com/bug?id=d6dd6f86d3aaf7eebe7406e45c1c6e549453f224
Closes: https://syzkaller.appspot.com/bug?id=908bd910da5dd79b88de4cf7baf376cc873a922e
Suggested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Ryosuke Yasuoka <ryasuoka@redhat.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260713-virtiogpu_syzbot-v2-1-2958fa37d46d@redhat.com
2026-07-13 19:26:37 +03:00
..
Kconfig
Makefile
virtgpu_debugfs.c drm: include drm_print.h where needed 2025-10-31 10:34:52 +02:00
virtgpu_display.c drm: Rename struct drm_atomic_state to drm_atomic_commit 2026-05-04 14:05:04 +10:00
virtgpu_drv.c drm-next for 7.2-rc1 2026-06-17 10:21:00 +01:00
virtgpu_drv.h drm/virtio: use uninterruptible resv lock for plane updates 2026-05-20 18:12:11 +03:00
virtgpu_fence.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
virtgpu_gem.c drm/virtio: Don't detach GEM from a non-created context 2026-07-13 19:13:02 +03:00
virtgpu_ioctl.c drm/virtio: add VIRTGPU_PARAM_BLOB_ALIGNMENT to params 2026-05-20 17:59:21 +03:00
virtgpu_kms.c drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker 2026-07-13 19:26:37 +03:00
virtgpu_object.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
virtgpu_plane.c drm/virtio: use uninterruptible resv lock for plane updates 2026-05-20 18:12:11 +03:00
virtgpu_prime.c Merge drm/drm-next into drm-misc-next 2026-02-23 11:48:20 +01:00
virtgpu_submit.c drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() 2026-06-08 21:40:51 +03:00
virtgpu_trace_points.c
virtgpu_trace.h
virtgpu_vq.c drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker 2026-07-13 19:26:37 +03:00
virtgpu_vram.c drm/virtio: Extend blob UAPI with deferred-mapping hinting 2026-05-14 00:57:34 +03:00