Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Sender: Guenter Roeck <groeck7@gmail.com>
Message-ID: <7266dc04-8db3-a48b-6844-8530ae7b8adf@roeck-us.net>
Date:   Wed, 5 Jul 2023 07:53:11 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: [PATCH v3] watchdog: s3c2410: Fix potential deadlock on
 &wdt->lock
Content-Language: en-US
To:     Chengfeng Ye <dg573847474@gmail.com>,
        krzysztof.kozlowski@linaro.org, alim.akhtar@samsung.com,
        wim@linux-watchdog.org
Cc:     linux-arm-kernel@lists.infradead.org,
        linux-samsung-soc@vger.kernel.org, linux-watchdog@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20230705090951.63762-1-dg573847474@gmail.com>
From:   Guenter Roeck <linux@roeck-us.net>
In-Reply-To: <20230705090951.63762-1-dg573847474@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 7/5/23 02:09, Chengfeng Ye wrote:
> As &wdt->lock is acquired by hard irq s3c2410wdt_irq(),
> other acquisition of the same lock under process context should
> disable irq, otherwise deadlock could happen if the
> irq preempt the execution while the lock is held in process context
> on the same CPU.
> 
> [Deadlock Scenario]
> s3c2410wdt_suspend()
>      -> s3c2410wdt_stop()
>      -> spin_lock(&wdt->lock)
>          <irq iterrupt>
>          -> s3c2410wdt_irq()
>          -> s3c2410wdt_keepalive()
>          -> spin_lock(&wdt->lock) (deadlock here)
> 
> [Deadlock Scenario]
> s3c2410wdt_probe()
>      -> s3c2410wdt_start()
>      -> spin_lock(&wdt->lock)
>          <irq iterrupt>
>          -> s3c2410wdt_irq()
>          -> s3c2410wdt_keepalive()
>          -> spin_lock(&wdt->lock) (deadlock here)
> 
> [Deadlock Scenario]
> s3c2410wdt_keepalive()
>      -> spin_lock(&wdt->lock)
>          <irq iterrupt>
>          -> s3c2410wdt_irq()
>          -> s3c2410wdt_keepalive()
>          -> spin_lock(&wdt->lock) (deadlock here)
> 
> This flaw was found by an experimental static analysis tool I am
> developing for irq-related deadlock, which reported the above
> warning when analyzing the linux kernel 6.4-rc7 release.
> 
> The tentative patch fix the potential deadlock by spin_lock_irqsave()
> under process context.
> 
> Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>

Reviewed-by: Guenter Roeck <linux@roeck-us.net>

> ---
>   drivers/watchdog/s3c2410_wdt.c | 15 +++++++++------
>   1 file changed, 9 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
> index 95416a9bdd4b..e1dc71ece01e 100644
> --- a/drivers/watchdog/s3c2410_wdt.c
> +++ b/drivers/watchdog/s3c2410_wdt.c
> @@ -379,10 +379,11 @@ static int s3c2410wdt_enable(struct s3c2410_wdt *wdt, bool en)
>   static int s3c2410wdt_keepalive(struct watchdog_device *wdd)
>   {
>   	struct s3c2410_wdt *wdt = watchdog_get_drvdata(wdd);
> +	unsigned long flags;
>   
> -	spin_lock(&wdt->lock);
> +	spin_lock_irqsave(&wdt->lock, flags);
>   	writel(wdt->count, wdt->reg_base + S3C2410_WTCNT);
> -	spin_unlock(&wdt->lock);
> +	spin_unlock_irqrestore(&wdt->lock, flags);
>   
>   	return 0;
>   }
> @@ -399,10 +400,11 @@ static void __s3c2410wdt_stop(struct s3c2410_wdt *wdt)
>   static int s3c2410wdt_stop(struct watchdog_device *wdd)
>   {
>   	struct s3c2410_wdt *wdt = watchdog_get_drvdata(wdd);
> +	unsigned long flags;
>   
> -	spin_lock(&wdt->lock);
> +	spin_lock_irqsave(&wdt->lock, flags);
>   	__s3c2410wdt_stop(wdt);
> -	spin_unlock(&wdt->lock);
> +	spin_unlock_irqrestore(&wdt->lock, flags);
>   
>   	return 0;
>   }
> @@ -411,8 +413,9 @@ static int s3c2410wdt_start(struct watchdog_device *wdd)
>   {
>   	unsigned long wtcon;
>   	struct s3c2410_wdt *wdt = watchdog_get_drvdata(wdd);
> +	unsigned long flags;
>   
> -	spin_lock(&wdt->lock);
> +	spin_lock_irqsave(&wdt->lock, flags);
>   
>   	__s3c2410wdt_stop(wdt);
>   
> @@ -433,7 +436,7 @@ static int s3c2410wdt_start(struct watchdog_device *wdd)
>   	writel(wdt->count, wdt->reg_base + S3C2410_WTDAT);
>   	writel(wdt->count, wdt->reg_base + S3C2410_WTCNT);
>   	writel(wtcon, wdt->reg_base + S3C2410_WTCON);
> -	spin_unlock(&wdt->lock);
> +	spin_unlock_irqrestore(&wdt->lock, flags);
>   
>   	return 0;
>   }