LKML Archive on
help / color / mirror / Atom feed
From: Sasha Levin <>
Cc: "Mark Yacoub" <>,
	"Michel Dänzer" <>,
	"Mark Yacoub" <>,
	"Sean Paul" <>,
	"Sasha Levin" <>,
Subject: [PATCH AUTOSEL 4.14 4/7] drm: Copy drm_wait_vblank to user before returning
Date: Mon, 23 Aug 2021 20:55:25 -0400	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Mark Yacoub <>

[ Upstream commit fa0b1ef5f7a694f48e00804a391245f3471aa155 ]

Userspace should get back a copy of drm_wait_vblank that's been modified
even when drm_wait_vblank_ioctl returns a failure.

drm_wait_vblank_ioctl modifies the request and expects the user to read
it back. When the type is RELATIVE, it modifies it to ABSOLUTE and updates
the sequence to become current_vblank_count + sequence (which was
RELATIVE), but now it became ABSOLUTE.
drmWaitVBlank (in libdrm) expects this to be the case as it modifies
the request to be Absolute so it expects the sequence to would have been

The change is in compat_drm_wait_vblank, which is called by
drm_compat_ioctl. This change of copying the data back regardless of the
return number makes it en par with drm_ioctl, which always copies the
data before returning.

Return from the function after everything has been copied to user.

Fixes IGT:kms_flip::modeset-vs-vblank-race-interruptible
Tested on ChromeOS Trogdor(msm)

Reviewed-by: Michel Dänzer <>
Signed-off-by: Mark Yacoub <>
Signed-off-by: Sean Paul <>
Signed-off-by: Sasha Levin <>
 drivers/gpu/drm/drm_ioc32.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 86105e7f07fc..6773e8f09fc3 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -855,8 +855,6 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
 	req.request.sequence = req32.request.sequence;
 	req.request.signal = req32.request.signal;
 	err = drm_ioctl_kernel(file, drm_wait_vblank_ioctl, &req, DRM_UNLOCKED);
-	if (err)
-		return err;
 	req32.reply.type = req.reply.type;
 	req32.reply.sequence = req.reply.sequence;
@@ -865,7 +863,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
 	if (copy_to_user(argp, &req32, sizeof(req32)))
 		return -EFAULT;
-	return 0;
+	return err;
 #if defined(CONFIG_X86)

  parent reply	other threads:[~2021-08-24  1:02 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-24  0:55 [PATCH AUTOSEL 4.14 1/7] opp: remove WARN when no valid OPPs remain Sasha Levin
2021-08-24  0:55 ` [PATCH AUTOSEL 4.14 2/7] virtio: Improve vq->broken access to avoid any compiler optimization Sasha Levin
2021-08-24  0:55 ` [PATCH AUTOSEL 4.14 3/7] vringh: Use wiov->used to check for read/write desc order Sasha Levin
2021-08-24  0:55 ` Sasha Levin [this message]
2021-08-24  0:55 ` [PATCH AUTOSEL 4.14 5/7] drm/nouveau/disp: power down unused DP links during init Sasha Levin
2021-08-24  0:55 ` [PATCH AUTOSEL 4.14 6/7] drm/nouveau: block a bunch of classes from userspace Sasha Levin
2021-08-24 17:05   ` Lyude Paul
2021-08-30 12:17     ` Sasha Levin
2021-08-24  0:55 ` [PATCH AUTOSEL 4.14 7/7] net/rds: dma_map_sg is entitled to merge entries Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \
    --subject='Re: [PATCH AUTOSEL 4.14 4/7] drm: Copy drm_wait_vblank to user before returning' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).