Received-SPF: pass (google.com: domain of linux-kernel+bounces-80633-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Lizhi Xu <lizhi.xu@windriver.com>
To: <syzbot+93bd128a383695391534@syzkaller.appspotmail.com>
CC: <syzkaller-bugs@googlegroups.com>, <linux-kernel@vger.kernel.org>
Subject: Re: [syzbot] [dri?] WARNING in vkms_get_vblank_timestamp (2)
Date: Mon, 26 Feb 2024 15:30:01 +0800
Message-ID: <20240226073001.1248179-1-lizhi.xu@windriver.com>
In-Reply-To: <000000000000edf6a306105afb50@google.com>
References: <000000000000edf6a306105afb50@google.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


diff --git a/drivers/gpu/drm/vkms/vkms_crtc.c b/drivers/gpu/drm/vkms/vkms_crtc.c
index 61e500b8c9da..45942547af44 100644
--- a/drivers/gpu/drm/vkms/vkms_crtc.c
+++ b/drivers/gpu/drm/vkms/vkms_crtc.c
@@ -20,12 +20,12 @@ static enum hrtimer_restart vkms_vblank_simulate(struct hrtimer *timer)
 
 	fence_cookie = dma_fence_begin_signalling();
 
+	spin_lock(&output->lock);
 	ret_overrun = hrtimer_forward_now(&output->vblank_hrtimer,
 					  output->period_ns);
 	if (ret_overrun != 1)
 		pr_warn("%s: vblank timer overrun\n", __func__);
 
-	spin_lock(&output->lock);
 	ret = drm_crtc_handle_vblank(crtc);
 	if (!ret)
 		DRM_ERROR("vkms failure on handling vblank");
@@ -100,6 +100,9 @@ static bool vkms_get_vblank_timestamp(struct drm_crtc *crtc,
 
 	*vblank_time = READ_ONCE(output->vblank_hrtimer.node.expires);
 
+	if (!in_vblank_irq && *vblank_time == vblank->time)
+		return true;
+
 	if (WARN_ON(*vblank_time == vblank->time))
 		return true;