linux-kernel - [BUG] cw1200: possible deadlock involving three functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <cf81c699-77ef-651d-18d0-7d8182452ff4@gmail.com>
Date:   Tue, 8 Feb 2022 00:02:05 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     pizza@...ftnet.org, kvalo@...nel.org, davem@...emloft.net,
        kuba@...nel.org
Cc:     linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [BUG] cw1200: possible deadlock involving three functions

Hello,

My static analysis tool reports a possible deadlock in the cw1200 driver 
in Linux 5.16:

cw1200_probe_work()
   mutex_lock(&priv->conf_mutex); --> Line 384 (Lock A)
   wsm_flush_tx()
     wait_event_timeout(priv->bh_evt_wq, ...) --> Line 1208 (Wait X)

cw1200_bh()
   wait_event_interruptible(priv->bh_wq, ...) --> Line 524 (Wait Y)
   wake_up(&priv->bh_evt_wq); --> Line 534 (Wake X)

cw1200_do_join()
   mutex_lock(&priv->conf_mutex); --> Line 1238 (Lock A)
   wsm_unlock_tx()
     cw1200_bh_wakeup()
       wake_up(&priv->bh_wq); --> Line 119 (Wake Y)

When cw1200_probe_work() is executed, "Wait X" is performed by holding 
"Lock A". If cw1200_bh() is executed at this time, because "Wait Y" is 
performed, "Wake X" cannot be performed to wake up "Wait X". If 
cw1200_do_join() is executed at this time, because "Lock A" has already 
been hold, "Wake Y" cannot be performed to wake up "Wait Y".
I find that "Wait X" is performed with a timeout, to relieve the 
possible deadlock; but I think this timeout can cause inefficient execution.

I am not quite sure whether this possible problem is real and how to fix 
it if it is real.
Any feedback would be appreciated, thanks :)

Best wishes,
Jia-Ju Bai