linux-kernel - [BUG] android: possible ABBA deadlock in print_binder_proc() and binder_get_txn_from_and_acq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <303401d0-25c9-d04b-e96d-3ca2aa0a616d@gmail.com>
Date:   Tue, 7 Sep 2021 10:29:57 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     Greg KH <gregkh@...uxfoundation.org>, arve@...roid.com,
        tkjos@...roid.com, maco@...roid.com, joel@...lfernandes.org,
        christian@...uner.io, hridya@...gle.com, surenb@...gle.com
Cc:     linux-kernel <linux-kernel@...r.kernel.org>
Subject: [BUG] android: possible ABBA deadlock in print_binder_proc() and
 binder_get_txn_from_and_acq_inner()

Hello,

My static analysis tool reports a possible ABBA deadlock in the android 
driver in Linux 5.10:

print_binder_proc()
   binder_inner_proc_lock()
     _binder_inner_proc_lock()
       spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
   print_binder_thread_ilocked()
     print_binder_transaction_ilocked()
       spin_lock(&t->lock); --> Line 5531 (Lock B)

binder_get_txn_from_and_acq_inner()
   binder_get_txn_from()
     spin_lock(&t->lock); --> Line 1833 (Lock B)
   binder_inner_proc_lock()
     _binder_inner_proc_lock()
       spin_lock(&proc->inner_lock); --> Line 662 (Lock A)

When print_binder_proc() and binder_get_txn_from_and_acq_inner() are 
concurrently executed, the deadlock can occur.

I am not quite sure whether this possible deadlock is real and how to 
fix it if it is real.
Any feedback would be appreciated, thanks :)

Reported-by: TOTE Robot <oslab@...nghua.edu.cn>


Best wishes,
Jia-Ju Bai