Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <4a850d04-ed6a-5802-7038-a94ad0d466c5@gmail.com>
Date:   Mon, 7 Feb 2022 23:16:14 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.1
Content-Language: en-US
To:     tariqt@nvidia.com, davem@davemloft.net, kuba@kernel.org
Cc:     netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
        linux-kernel@vger.kernel.org
From:   Jia-Ju Bai <baijiaju1990@gmail.com>
Subject: [BUG] net: mellanox: mlx4: possible deadlock in mlx4_xdp_set() and
 mlx4_en_reset_config()
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hello,

My static analysis tool reports a possible deadlock in the mlx4 driver 
in Linux 5.16:

mlx4_xdp_set()
   mutex_lock(&mdev->state_lock); --> Line 2778 (Lock A)
   mlx4_en_try_alloc_resources()
     mlx4_en_alloc_resources()
       mlx4_en_destroy_tx_ring()
         mlx4_qp_free()
           wait_for_completion(&qp->free); --> Line 528 (Wait X)

mlx4_en_reset_config()
   mutex_lock(&mdev->state_lock); --> Line 3522 (Lock A)
   mlx4_en_try_alloc_resources()
     mlx4_en_alloc_resources()
       mlx4_en_destroy_tx_ring()
         mlx4_qp_free()
           complete(&qp->free); --> Line 527 (Wake X)

When mlx4_xdp_set() is executed, "Wait X" is performed by holding "Lock 
A". If mlx4_en_reset_config() is executed at this time, "Wake X" cannot 
be performed to wake up "Wait X" in mlx4_xdp_set(), because "Lock A" has 
been already hold by mlx4_xdp_set(), causing a possible deadlock.

I am not quite sure whether this possible problem is real and how to fix 
it if it is real.
Any feedback would be appreciated, thanks :)


Best wishes,
Jia-Ju Bai