linux-kernel - Re: [BUG] android: possible ABBA deadlock in print_binder_proc() and binder_get_txn_from_and_acq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <37c6a84a-77ee-449b-a83b-59e378242fcb@gmail.com>
Date:   Tue, 14 Sep 2021 18:10:59 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     Todd Kjos <tkjos@...gle.com>
Cc:     Greg KH <gregkh@...uxfoundation.org>, arve@...roid.com,
        tkjos@...roid.com, maco@...roid.com, joel@...lfernandes.org,
        christian@...uner.io, hridya@...gle.com, surenb@...gle.com,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] android: possible ABBA deadlock in print_binder_proc() and
 binder_get_txn_from_and_acq_inner()

Thanks for the reply :)

On 2021/9/8 3:29, Todd Kjos wrote:
> On Mon, Sep 6, 2021 at 7:30 PM Jia-Ju Bai <baijiaju1990@...il.com> wrote:
>> Hello,
>>
>> My static analysis tool reports a possible ABBA deadlock in the android
>> driver in Linux 5.10:
>>
>> print_binder_proc()
>>     binder_inner_proc_lock()
>>       _binder_inner_proc_lock()
>>         spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
>>     print_binder_thread_ilocked()
>>       print_binder_transaction_ilocked()
>>         spin_lock(&t->lock); --> Line 5531 (Lock B)
>>
>> binder_get_txn_from_and_acq_inner()
>>     binder_get_txn_from()
>>       spin_lock(&t->lock); --> Line 1833 (Lock B)
>>     binder_inner_proc_lock()
>>       _binder_inner_proc_lock()
>>         spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
> Hmm. What kernel version are you looking at? These line numbers don't
> match what I see in mainline.

Linux 5.10

> Also, the sequence for
> binder_get_txn_from_and_acq_inner() looks like this for me:
>
> binder_get_txn_from_and_acq_inner()
>      binder_get_txn_from()
>        spin_lock(&t->lock); --> Line 1427 (Lock B)
>        spin_unlock(&t->lock); --> Line 1431 (Lock B)
>      binder_inner_proc_lock()
>        _binder_inner_proc_lock()
>           spin_lock(&proc->inner_lock); --> Line 256 (Lock A)
>
> Which doesn't have the deadlock hazard.
>

Yes, you are right.
My static tool has several errors in the implementation, and thus 
reported this false positive, sorry...


Best wishes,
Jia-Ju Bai