[BUG] infiniband: hw: hfi1: possible ABBA deadlock in pio_wait() and sc_disable()

[BUG] infiniband: hw: hfi1: possible ABBA deadlock in pio_wait() and sc_disable()

[Jia-Ju Bai]

Hello,

My static analysis tool reports a possible ABBA deadlock in the hfi1 
driver in Linux 5.10:

sc_disable()
   write_seqlock(&sc->waitlock); --> Line 956 (Lock A)
   hfi1_qp_wakeup()
     spin_lock_irqsave(&qp->s_lock, flags); --> Line 441 (Lock B)

pio_wait()
   spin_lock_irqsave(&qp->s_lock, flags); --> Line 939 (Lock B)
   write_seqlock(&sc->waitlock); --> Line 941 (Lock A)

When sc_disable() and pio_wait() are concurrently executed, the deadlock 
can occur.

I am not quite sure whether this possible deadlock is real and how to 
fix it if it is real.
Any feedback would be appreciated, thanks :)

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>


Best wishes,
Jia-Ju Bai

RE: [BUG] infiniband: hw: hfi1: possible ABBA deadlock in pio_wait() and sc_disable()

[Marciniszyn, Mike]

> 
> Hello,
> 
> My static analysis tool reports a possible ABBA deadlock in the hfi1 driver in
> Linux 5.10:
> 
> sc_disable()
>    write_seqlock(&sc->waitlock); --> Line 956 (Lock A)
>    hfi1_qp_wakeup()
>      spin_lock_irqsave(&qp->s_lock, flags); --> Line 441 (Lock B)
> 
> pio_wait()
>    spin_lock_irqsave(&qp->s_lock, flags); --> Line 939 (Lock B)
>    write_seqlock(&sc->waitlock); --> Line 941 (Lock A)
> 
> When sc_disable() and pio_wait() are concurrently executed, the deadlock
> can occur.
> 
> I am not quite sure whether this possible deadlock is real and how to fix it if it
> is real.
> Any feedback would be appreciated, thanks :)
> 
> Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
> 
> 
> Best wishes,
> Jia-Ju Bai

I don't think this can occur, but all other callers to hfi1_qp_wakeup() stash the waiters into an array.

I will workup a patch to move the linked list of waiters to a local, drop the lock, and process the local array of waiters.

Mike