linux-kernel - [BUG] gpu: drm: possible ABBA deadlock in drm_gem_prime_fd_to_handle() and drm_gem_prime_handle_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Thu, 9 Dec 2021 11:32:05 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     maarten.lankhorst@...ux.intel.com,
        Maxime Ripard <mripard@...nel.org>, tzimmermann@...e.de,
        airlied@...ux.ie, daniel@...ll.ch
Cc:     dri-devel@...ts.freedesktop.org,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: [BUG] gpu: drm: possible ABBA deadlock in
 drm_gem_prime_fd_to_handle() and drm_gem_prime_handle_to_fd()

Hello,

My static analysis tool reports a possible ABBA deadlock in the drm 
driver in Linux 5.10:

drm_gem_prime_fd_to_handle()
   mutex_lock(&dev->object_name_lock); --> Line 313 (Lock A)
   drm_gem_handle_delete()
     drm_gem_object_release_handle()
       drm_gem_remove_prime_handles()
         mutex_lock(&filp->prime.lock); --> Line 16 (Lock B)

drm_gem_prime_handle_to_fd()
   mutex_lock(&file_priv->prime.lock); --> Line 433 (Lock B)
   mutex_lock(&dev->object_name_lock); --> Line 466 (Lock A)

When drm_gem_prime_fd_to_handle() and drm_gem_prime_handle_to_fd() are 
concurrently executed, the deadlock can occur.

I am not quite sure whether this possible deadlock is real and how to 
fix it if it is real.
Any feedback would be appreciated, thanks :)

Reported-by: TOTE Robot <oslab@...nghua.edu.cn>


Best wishes,
Jia-Ju Bai