linux-kernel - [BUG] block: drbd: possible deadlocks involving waiting and locking operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <3b992e3b-bf1a-426a-5e76-a822f5bf6e6a@gmail.com>
Date:   Tue, 8 Feb 2022 18:55:20 +0800
From:   Jia-Ju Bai <baijiaju1990@...il.com>
To:     philipp.reisner@...bit.com, lars.ellenberg@...bit.com,
        axboe@...nel.dk
Cc:     drbd-dev@...ts.linbit.com, linux-block@...r.kernel.org,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: [BUG] block: drbd: possible deadlocks involving waiting and locking
 operations

Hello,

My static analysis tool reports three possible deadlocks in the drbd 
driver in Linux 5.16:

#BUG 1
drbd_adm_attach()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1810 (Lock A)
   wait_event(device->misc_wait, ...); --> Line 1824 (Wait X)

drbd_adm_disk_opts()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
   get_ldev()
     get_ldev_if_state()
       _get_ldev_if_state()
         put_ldev()
           wake_up(&device->misc_wait); --> Line 2108 (Wake X)

#BUG 2
drbd_adm_invalidate()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 3024 (Lock A)
   wait_event(device->misc_wait, ...); --> Line 3030 (Wait X)

drbd_adm_disk_opts()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
   get_ldev()
     get_ldev_if_state()
       _get_ldev_if_state()
         put_ldev()
           wake_up(&device->misc_wait); --> Line 2108 (Wake X)

#BUG 3
drbd_adm_invalidate_peer()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 3101 (Lock A)
   wait_event(device->misc_wait, ...); --> Line 3107 (Wait X)

drbd_adm_disk_opts()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
   get_ldev()
     get_ldev_if_state()
       _get_ldev_if_state()
         put_ldev()
           wake_up(&device->misc_wait); --> Line 2108 (Wake X)

When drbd_adm_attach()/drbd_adm_invalidate()/drbd_adm_invalidate_peer() 
is executed, "Wait X" is performed by holding "Lock A". If 
drbd_adm_disk_opts() is executed at this time, because "Lock A" has been 
already held, "Wake X" cannot be performed to wake up "Wait X", causing 
possible deadlocks.

I am not quite sure whether these possible problems are real.
Any feedback would be appreciated, thanks :)

Best wishes,
Jia-Ju Bai