linux-kernel - [BUG] net: mellanox: mlx4: possible deadlock in mlx4_xdp_set() and mlx4_en_reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4a850d04-ed6a-5802-7038-a94ad0d466c5@gmail.com>
Date:   Mon, 7 Feb 2022 23:16:14 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     tariqt@...dia.com, davem@...emloft.net, kuba@...nel.org
Cc:     netdev@...r.kernel.org, linux-rdma@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [BUG] net: mellanox: mlx4: possible deadlock in mlx4_xdp_set() and
 mlx4_en_reset_config()

Hello,

My static analysis tool reports a possible deadlock in the mlx4 driver 
in Linux 5.16:

mlx4_xdp_set()
   mutex_lock(&mdev->state_lock); --> Line 2778 (Lock A)
   mlx4_en_try_alloc_resources()
     mlx4_en_alloc_resources()
       mlx4_en_destroy_tx_ring()
         mlx4_qp_free()
           wait_for_completion(&qp->free); --> Line 528 (Wait X)

mlx4_en_reset_config()
   mutex_lock(&mdev->state_lock); --> Line 3522 (Lock A)
   mlx4_en_try_alloc_resources()
     mlx4_en_alloc_resources()
       mlx4_en_destroy_tx_ring()
         mlx4_qp_free()
           complete(&qp->free); --> Line 527 (Wake X)

When mlx4_xdp_set() is executed, "Wait X" is performed by holding "Lock 
A". If mlx4_en_reset_config() is executed at this time, "Wake X" cannot 
be performed to wake up "Wait X" in mlx4_xdp_set(), because "Lock A" has 
been already hold by mlx4_xdp_set(), causing a possible deadlock.

I am not quite sure whether this possible problem is real and how to fix 
it if it is real.
Any feedback would be appreciated, thanks :)

Best wishes,
Jia-Ju Bai