linux-kernel - [BUG] ALSA: sb16: possible ABBA deadlock in snd_sb_csp_stop() and snd_sb_csp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 15 Jul 2021 18:20:36 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     perex@...ex.cz, tiwai@...e.com, alsa-devel@...a-project.org,
        "linux-kernel@...r.kernel.org >> linux-kernel" 
        <linux-kernel@...r.kernel.org>
Subject: [BUG] ALSA: sb16: possible ABBA deadlock in snd_sb_csp_stop() and
 snd_sb_csp_load()

Hello,

I find there is a possible ABBA deadlock in the SB16 driver in Linux 5.10:

In snd_sb_csp_stop():
876:     spin_lock_irqsave(&p->chip->mixer_lock, flags);
882:     spin_lock(&p->chip->reg_lock);

In snd_sb_csp_load():
614:     spin_lock_irqsave(&p->chip->reg_lock, flags);
653:     spin_lock(&p->chip->mixer_lock);

When snd_sb_csp_stop() and snd_sb_csp_load() are concurrently executed, 
the deadlock can occur.

I check the code and find a possible case of such concurrent execution:

#CPU1:
snd_sb16_playback_close
   snd_sb16_csp_playback_close (csp->ops.csp_stop(csp))
     snd_sb_csp_stop

#CPU2:
snd_sb_csp_ioctl
   snd_sb_csp_riff_load
     snd_sb_csp_load_user
       snd_sb_csp_load

I am not quite sure whether this possible deadlock is real and how to 
fix it if it is real.
Any feedback would be appreciated, thanks

Best wishes,
Jia-Ju Bai