linux-kernel - [V2 1/3] firmware: arm_sdei: fix possible deadlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1579145331-78633-1-git-send-email-zhangliguang@linux.alibaba.com>
Date:   Thu, 16 Jan 2020 11:28:49 +0800
From:   luanshi <zhangliguang@...ux.alibaba.com>
To:     james.morse@....com
Cc:     linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [V2 1/3] firmware: arm_sdei: fix possible deadlock

We call sdei_reregister_event() with sdei_list_lock held but
_sdei_event_register() and sdei_event_destroy() also acquires
sdei_list_lock thus creating A-A deadlock.

Fixes: da351827240e ("firmware: arm_sdei: Add support for CPU and system
power states")

Signed-off-by: Liguang Zhang <zhangliguang@...ux.alibaba.com>
---
 drivers/firmware/arm_sdei.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
index a479023..37e9bf0 100644
--- a/drivers/firmware/arm_sdei.c
+++ b/drivers/firmware/arm_sdei.c
@@ -45,8 +45,11 @@ static asmlinkage void (*sdei_firmware_call)(unsigned long function_id,
 static unsigned long sdei_entry_point;
 
 struct sdei_event {
-	/* These three are protected by the sdei_list_lock */
+	/* protected by the sdei_list_lock */
 	struct list_head	list;
+
+	spinlock_t		sdei_event_lock;
+	/* These two are protected by the sdei_event_lock */
 	bool			reregister;
 	bool			reenable;
 
@@ -214,6 +217,7 @@ static struct sdei_event *sdei_event_create(u32 event_num,
 		return ERR_PTR(-ENOMEM);
 
 	INIT_LIST_HEAD(&event->list);
+	spin_lock_init(&event->sdei_event_lock);
 	event->event_num = event_num;
 
 	err = sdei_api_event_get_info(event_num, SDEI_EVENT_INFO_EV_PRIORITY,
@@ -412,9 +416,9 @@ int sdei_event_enable(u32 event_num)
 		return -ENOENT;
 	}
 
-	spin_lock(&sdei_list_lock);
+	spin_lock(&event->sdei_event_lock);
 	event->reenable = true;
-	spin_unlock(&sdei_list_lock);
+	spin_unlock(&event->sdei_event_lock);
 
 	if (event->type == SDEI_EVENT_TYPE_SHARED)
 		err = sdei_api_event_enable(event->event_num);
@@ -491,10 +495,10 @@ static int _sdei_event_unregister(struct sdei_event *event)
 {
 	lockdep_assert_held(&sdei_events_lock);
 
-	spin_lock(&sdei_list_lock);
+	spin_lock(&event->sdei_event_lock);
 	event->reregister = false;
 	event->reenable = false;
-	spin_unlock(&sdei_list_lock);
+	spin_unlock(&event->sdei_event_lock);
 
 	if (event->type == SDEI_EVENT_TYPE_SHARED)
 		return sdei_api_event_unregister(event->event_num);
@@ -585,9 +589,9 @@ static int _sdei_event_register(struct sdei_event *event)
 
 	lockdep_assert_held(&sdei_events_lock);
 
-	spin_lock(&sdei_list_lock);
+	spin_lock(&event->sdei_event_lock);
 	event->reregister = true;
-	spin_unlock(&sdei_list_lock);
+	spin_unlock(&event->sdei_event_lock);
 
 	if (event->type == SDEI_EVENT_TYPE_SHARED)
 		return sdei_api_event_register(event->event_num,
@@ -598,10 +602,10 @@ static int _sdei_event_register(struct sdei_event *event)
 
 	err = sdei_do_cross_call(_local_event_register, event);
 	if (err) {
-		spin_lock(&sdei_list_lock);
+		spin_lock(&event->sdei_event_lock);
 		event->reregister = false;
 		event->reenable = false;
-		spin_unlock(&sdei_list_lock);
+		spin_unlock(&event->sdei_event_lock);
 
 		sdei_do_cross_call(_local_event_unregister, event);
 	}
-- 
1.8.3.1