Re: [PATCH V3 RESEND] fbcon: Avoid cancel_delayed_work_sync() in atomic context
From: Helge Deller
Date: Tue Nov 10 2026 - 18:25:12 EST
On 11/10/26 14:59, Yao Yiqi wrote:
From: Yao Yiqi <yaoyiqi3@xxxxxxxxxx>applied to fbdev git tree for further testing...
fbcon_cursor() can be reached from the console printing path, which runs
in atomic context. When the VT software cursor is enabled
(vc_cursor_type & CUR_SW), it calls fbcon_del_cursor_work(), which uses
cancel_delayed_work_sync() and therefore may sleep.
With CONFIG_DEBUG_ATOMIC_SLEEP enabled, the following is reported:
BUG: sleeping function called from invalid context at kernel/workqueue.c:4722
in_atomic(): 1, irqs_disabled(): 1, non_block: 0
...
__cancel_work_sync
fbcon_del_cursor_work
fbcon_cursor
hide_cursor
vt_console_print
console_unlock
...
Make the default helper safe: fbcon_del_cursor_work() only stops
blinking, using cancel_delayed_work(), which is allowed in any context.
Every "stop blinking" call site keeps using it, including fbcon_cursor().
Only fbcon_release(), which is about to free @par and must ensure that no
callback is still using it, calls the separate
fbcon_del_cursor_work_sync(). New call sites therefore get the safe
variant by default.
cancel_delayed_work() does not wait for a callback that is already
running. Since fb_flashcursor() re-arms itself, a callback that has
already been dequeued by process_one_work() can queue the work again
after fbcon_del_cursor_work() returns. Add a cursor_blink_on flag to
struct fbcon_par: fbcon_add_cursor_work() sets it, fbcon_del_cursor_work()
clears it, and fb_flashcursor() checks it after taking console_lock and
returns without drawing or re-arming once blinking has been stopped.
Keep the requeue inside the console_lock section so that the flag check
and the requeue are not split by a concurrent stop.
Fixes: 3b0fb6ab25dd ("fbcon: Use delayed work for cursor")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Opencode:deepseek-v4.1-flash
Signed-off-by: Yao Yiqi <yaoyiqi3@xxxxxxxxxx>
---
drivers/video/fbdev/core/fbcon.c | 41 +++++++++++++++++++++++++++-----
drivers/video/fbdev/core/fbcon.h | 1 +
2 files changed, 36 insertions(+), 6 deletions(-)
Thanks!
Helge