Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Jia-Ju Bai <baijiaju1990@gmail.com>
Subject: [BUG] block: drbd: possible deadlocks involving waiting and locking
 operations
To:     philipp.reisner@linbit.com, lars.ellenberg@linbit.com,
        axboe@kernel.dk
Cc:     drbd-dev@lists.linbit.com, linux-block@vger.kernel.org,
        linux-kernel <linux-kernel@vger.kernel.org>
Message-ID: <3b992e3b-bf1a-426a-5e76-a822f5bf6e6a@gmail.com>
Date:   Tue, 8 Feb 2022 18:55:20 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.4.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Precedence: bulk

Hello,

My static analysis tool reports three possible deadlocks in the drbd 
driver in Linux 5.16:

#BUG 1
drbd_adm_attach()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1810 (Lock A)
   wait_event(device->misc_wait, ...); --> Line 1824 (Wait X)

drbd_adm_disk_opts()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
   get_ldev()
     get_ldev_if_state()
       _get_ldev_if_state()
         put_ldev()
           wake_up(&device->misc_wait); --> Line 2108 (Wake X)

#BUG 2
drbd_adm_invalidate()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 3024 (Lock A)
   wait_event(device->misc_wait, ...); --> Line 3030 (Wait X)

drbd_adm_disk_opts()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
   get_ldev()
     get_ldev_if_state()
       _get_ldev_if_state()
         put_ldev()
           wake_up(&device->misc_wait); --> Line 2108 (Wake X)

#BUG 3
drbd_adm_invalidate_peer()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 3101 (Lock A)
   wait_event(device->misc_wait, ...); --> Line 3107 (Wait X)

drbd_adm_disk_opts()
   mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
   get_ldev()
     get_ldev_if_state()
       _get_ldev_if_state()
         put_ldev()
           wake_up(&device->misc_wait); --> Line 2108 (Wake X)

When drbd_adm_attach()/drbd_adm_invalidate()/drbd_adm_invalidate_peer() 
is executed, "Wait X" is performed by holding "Lock A". If 
drbd_adm_disk_opts() is executed at this time, because "Lock A" has been 
already held, "Wake X" cannot be performed to wake up "Wait X", causing 
possible deadlocks.

I am not quite sure whether these possible problems are real.
Any feedback would be appreciated, thanks :)

Best wishes,
Jia-Ju Bai