[Intel-gfx] Deadlock in intel_user_framebuffer_destroy()

[Lukas Wunner]

Hi,

a deadlock was introduced by commit 60a5ca015ffd2aacfe5674b5a401cd2a37159e07

Author: Ville Syrjälä <ville.syrjala at linux.intel.com>
Date:   Fri Jun 13 11:10:53 2014 +0300

    drm/i915: Add locking around framebuffer_references--


The commit amended intel_display.c:intel_user_framebuffer_destroy() with
mutex_lock(&dev->struct_mutex).

A few weeks prior Chris Wilson had amended intel_fbdev.c:intelfb_create()
with a call to drm_framebuffer_unreference() while &dev->struct_mutex is
locked (commit edd586fe705e819bc711b5ed7194a0b6f9f1a7e1, "drm/i915: Discard
BIOS framebuffers too small to accommodate chosen mode").

This leads to the following call chain while &dev->struct_mutex is locked:

intel_fbdev.c:intelfb_create()
  -> drm_crtc.c:drm_framebuffer_unreference()
       -> drm_crtc.c:drm_framebuffer_free()
            -> intel_display.c:intel_user_framebuffer_destroy()

The last function in that call chain attempts to re-lock the mutex.
The functionality added by Chris Wilson is thus rendered broken.

Best regards,

Lukas