2021-09-15 09:15:01

by Jia-Ju Bai

Subject: [BUG] infiniband: hw: hfi1: possible ABBA deadlock in pio_wait() and sc_disable()

Hello,

My static analysis tool reports a possible ABBA deadlock in the hfi1
driver in Linux 5.10:

sc_disable()
  write_seqlock(&sc->waitlock); --> Line 956 (Lock A)
  hfi1_qp_wakeup()
    spin_lock_irqsave(&qp->s_lock, flags); --> Line 441 (Lock B)

pio_wait()
  spin_lock_irqsave(&qp->s_lock, flags); --> Line 939 (Lock B)
  write_seqlock(&sc->waitlock); --> Line 941 (Lock A)

When sc_disable() and pio_wait() are concurrently executed, the deadlock
can occur.

I am not quite sure whether this possible deadlock is real and how to
fix it if it is real.
Any feedback would be appreciated, thanks :)

Reported-by: TOTE Robot <[email protected]>


Best wishes,
Jia-Ju Bai

2021-09-23 19:07:29

by Marciniszyn, Mike

Subject: RE: [BUG] infiniband: hw: hfi1: possible ABBA deadlock in pio_wait() and sc_disable()

>
> Hello,
>
> My static analysis tool reports a possible ABBA deadlock in the hfi1 driver in
> Linux 5.10:
>
> sc_disable()
>   write_seqlock(&sc->waitlock); --> Line 956 (Lock A)
>   hfi1_qp_wakeup()
>     spin_lock_irqsave(&qp->s_lock, flags); --> Line 441 (Lock B)
>
> pio_wait()
>   spin_lock_irqsave(&qp->s_lock, flags); --> Line 939 (Lock B)
>   write_seqlock(&sc->waitlock); --> Line 941 (Lock A)
>
> When sc_disable() and pio_wait() are concurrently executed, the deadlock
> can occur.
>
> I am not quite sure whether this possible deadlock is real and how to fix it if it
> is real.
> Any feedback would be appreciated, thanks :)
>
> Reported-by: TOTE Robot <[email protected]>
>
>
> Best wishes,
> Jia-Ju Bai

I don't think this can occur, but all other callers to hfi1_qp_wakeup() stash the waiters into an array.

I will workup a patch to move the linked list of waiters to a local, drop the lock, and process the local array of waiters.

Mike