linux-kernel - [BUG] block: drbd: four possible ABBA deadlocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f425ae14-8857-28d7-a27a-d25da83e1bd6@gmail.com>
Date:   Thu, 19 Aug 2021 17:31:04 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     philipp.reisner@...bit.com, lars.ellenberg@...bit.com,
        Jens Axboe <axboe@...nel.dk>
Cc:     drbd-dev@...ts.linbit.com, linux-block@...r.kernel.org,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: [BUG] block: drbd: four possible ABBA deadlocks

Hello,

My static analysis tool reports four possible ABBA deadlocks in the drbd 
drivers in Linux 5.10:

### Deadlock A ###
w_after_conn_state_ch()
   mutex_lock(&connection->resource->conf_update); --> line 2065
   conn_free_crypto()
     drbd_free_sock()
       drbd_free_one_sock(&connection->data)
         mutex_lock(&ds->mutex); --> line 2967

drbd_adm_net_opts()
   mutex_lock(&connection->data.mutex); --> line 2445
   mutex_lock(&connection->resource->conf_update); --> line 2446

When w_after_conn_state_ch() and drbd_adm_net_opts() are concurrently 
executed, the deadlock can occur.

### Deadlock B ###
drbd_adm_connect()
   mutex_lock(&adm_ctx.resource->conf_update); --> line 2644
   conn_free_crypto()
     drbd_free_one_sock(&connection->data)
       mutex_lock(&ds->mutex); --> line 2967

drbd_adm_net_opts()
   mutex_lock(&connection->data.mutex); --> line 2445
   mutex_lock(&connection->resource->conf_update); --> line 2446

When drbd_adm_connect() and drbd_adm_net_opts() are concurrently 
executed, the deadlock can occur.

### Deadlock C ###
w_after_conn_state_ch()
   mutex_lock(&connection->resource->conf_update); --> line 2065
   conn_free_crypto()
     drbd_free_sock()
       drbd_free_one_sock(&connection->data)
         mutex_lock(&ds->mutex); --> line 2967

receive_protocol()
   mutex_lock(&connection->data.mutex); --> line 3778
   mutex_lock(&connection->resource->conf_update); --> line 3779

When w_after_conn_state_ch() and receive_protocol() are concurrently 
executed, the deadlock can occur.

### Deadlock D ###
drbd_adm_connect()
   mutex_lock(&adm_ctx.resource->conf_update); --> line 2644
   conn_free_crypto()
     drbd_free_one_sock(&connection->data)
       mutex_lock(&ds->mutex); --> line 2967

receive_protocol()
   mutex_lock(&connection->data.mutex); --> line 3778
   mutex_lock(&connection->resource->conf_update); --> line 3779

When drbd_adm_connect() and receive_protocol() are concurrently 
executed, the deadlock can occur.

I am not quite sure whether these possible deadlocks are real and how to 
fix them if they are real.
Any feedback would be appreciated, thanks

Reported-by: TOTE Robot <oslab@...nghua.edu.cn>


Best wishes,
Jia-Ju Bai