Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Jia-Ju Bai <baijiaju1990@gmail.com>
Subject: [BUG] block: drbd: four possible ABBA deadlocks
To:     philipp.reisner@linbit.com, lars.ellenberg@linbit.com,
        Jens Axboe <axboe@kernel.dk>
Cc:     drbd-dev@lists.linbit.com, linux-block@vger.kernel.org,
        linux-kernel <linux-kernel@vger.kernel.org>
Message-ID: <f425ae14-8857-28d7-a27a-d25da83e1bd6@gmail.com>
Date:   Thu, 19 Aug 2021 17:31:04 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.4.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Precedence: bulk

Hello,

My static analysis tool reports four possible ABBA deadlocks in the drbd 
drivers in Linux 5.10:

### Deadlock A ###
w_after_conn_state_ch()
   mutex_lock(&connection->resource->conf_update); --> line 2065
   conn_free_crypto()
     drbd_free_sock()
       drbd_free_one_sock(&connection->data)
         mutex_lock(&ds->mutex); --> line 2967

drbd_adm_net_opts()
   mutex_lock(&connection->data.mutex); --> line 2445
   mutex_lock(&connection->resource->conf_update); --> line 2446

When w_after_conn_state_ch() and drbd_adm_net_opts() are concurrently 
executed, the deadlock can occur.

### Deadlock B ###
drbd_adm_connect()
   mutex_lock(&adm_ctx.resource->conf_update); --> line 2644
   conn_free_crypto()
     drbd_free_one_sock(&connection->data)
       mutex_lock(&ds->mutex); --> line 2967

drbd_adm_net_opts()
   mutex_lock(&connection->data.mutex); --> line 2445
   mutex_lock(&connection->resource->conf_update); --> line 2446

When drbd_adm_connect() and drbd_adm_net_opts() are concurrently 
executed, the deadlock can occur.

### Deadlock C ###
w_after_conn_state_ch()
   mutex_lock(&connection->resource->conf_update); --> line 2065
   conn_free_crypto()
     drbd_free_sock()
       drbd_free_one_sock(&connection->data)
         mutex_lock(&ds->mutex); --> line 2967

receive_protocol()
   mutex_lock(&connection->data.mutex); --> line 3778
   mutex_lock(&connection->resource->conf_update); --> line 3779

When w_after_conn_state_ch() and receive_protocol() are concurrently 
executed, the deadlock can occur.

### Deadlock D ###
drbd_adm_connect()
   mutex_lock(&adm_ctx.resource->conf_update); --> line 2644
   conn_free_crypto()
     drbd_free_one_sock(&connection->data)
       mutex_lock(&ds->mutex); --> line 2967

receive_protocol()
   mutex_lock(&connection->data.mutex); --> line 3778
   mutex_lock(&connection->resource->conf_update); --> line 3779

When drbd_adm_connect() and receive_protocol() are concurrently 
executed, the deadlock can occur.

I am not quite sure whether these possible deadlocks are real and how to 
fix them if they are real.
Any feedback would be appreciated, thanks

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>


Best wishes,
Jia-Ju Bai