2022-02-09 07:41:53

by Jia-Ju Bai

[permalink] [raw]
Subject: [BUG] cw1200: possible deadlock involving three functions

Hello,

My static analysis tool reports a possible deadlock in the cw1200 driver
in Linux 5.16:

cw1200_probe_work()
  mutex_lock(&priv->conf_mutex); --> Line 384 (Lock A)
  wsm_flush_tx()
    wait_event_timeout(priv->bh_evt_wq, ...) --> Line 1208 (Wait X)

cw1200_bh()
  wait_event_interruptible(priv->bh_wq, ...) --> Line 524 (Wait Y)
  wake_up(&priv->bh_evt_wq); --> Line 534 (Wake X)

cw1200_do_join()
  mutex_lock(&priv->conf_mutex); --> Line 1238 (Lock A)
  wsm_unlock_tx()
    cw1200_bh_wakeup()
      wake_up(&priv->bh_wq); --> Line 119 (Wake Y)

When cw1200_probe_work() is executed, "Wait X" is performed by holding
"Lock A". If cw1200_bh() is executed at this time, because "Wait Y" is
performed, "Wake X" cannot be performed to wake up "Wait X". If
cw1200_do_join() is executed at this time, because "Lock A" has already
been hold, "Wake Y" cannot be performed to wake up "Wait Y".
I find that "Wait X" is performed with a timeout, to relieve the
possible deadlock; but I think this timeout can cause inefficient execution.

I am not quite sure whether this possible problem is real and how to fix
it if it is real.
Any feedback would be appreciated, thanks :)

Best wishes,
Jia-Ju Bai