* [BUG] android: possible ABBA deadlock in print_binder_proc() and binder_get_txn_from_and_acq_inner()
@ 2021-09-07 2:29 Jia-Ju Bai
2021-09-07 19:29 ` Todd Kjos
0 siblings, 1 reply; 3+ messages in thread
From: Jia-Ju Bai @ 2021-09-07 2:29 UTC (permalink / raw)
To: Greg KH, arve, tkjos, maco, joel, christian, hridya, surenb; +Cc: linux-kernel
Hello,
My static analysis tool reports a possible ABBA deadlock in the android
driver in Linux 5.10:
print_binder_proc()
binder_inner_proc_lock()
_binder_inner_proc_lock()
spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
print_binder_thread_ilocked()
print_binder_transaction_ilocked()
spin_lock(&t->lock); --> Line 5531 (Lock B)
binder_get_txn_from_and_acq_inner()
binder_get_txn_from()
spin_lock(&t->lock); --> Line 1833 (Lock B)
binder_inner_proc_lock()
_binder_inner_proc_lock()
spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
When print_binder_proc() and binder_get_txn_from_and_acq_inner() are
concurrently executed, the deadlock can occur.
I am not quite sure whether this possible deadlock is real and how to
fix it if it is real.
Any feedback would be appreciated, thanks :)
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [BUG] android: possible ABBA deadlock in print_binder_proc() and binder_get_txn_from_and_acq_inner()
2021-09-07 2:29 [BUG] android: possible ABBA deadlock in print_binder_proc() and binder_get_txn_from_and_acq_inner() Jia-Ju Bai
@ 2021-09-07 19:29 ` Todd Kjos
2021-09-14 10:10 ` Jia-Ju Bai
0 siblings, 1 reply; 3+ messages in thread
From: Todd Kjos @ 2021-09-07 19:29 UTC (permalink / raw)
To: Jia-Ju Bai
Cc: Greg KH, arve, tkjos, maco, joel, christian, hridya, surenb,
linux-kernel
On Mon, Sep 6, 2021 at 7:30 PM Jia-Ju Bai <baijiaju1990@gmail.com> wrote:
>
> Hello,
>
> My static analysis tool reports a possible ABBA deadlock in the android
> driver in Linux 5.10:
>
> print_binder_proc()
> binder_inner_proc_lock()
> _binder_inner_proc_lock()
> spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
> print_binder_thread_ilocked()
> print_binder_transaction_ilocked()
> spin_lock(&t->lock); --> Line 5531 (Lock B)
>
> binder_get_txn_from_and_acq_inner()
> binder_get_txn_from()
> spin_lock(&t->lock); --> Line 1833 (Lock B)
> binder_inner_proc_lock()
> _binder_inner_proc_lock()
> spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
Hmm. What kernel version are you looking at? These line numbers don't
match what I see in mainline. Also, the sequence for
binder_get_txn_from_and_acq_inner() looks like this for me:
binder_get_txn_from_and_acq_inner()
binder_get_txn_from()
spin_lock(&t->lock); --> Line 1427 (Lock B)
spin_unlock(&t->lock); --> Line 1431 (Lock B)
binder_inner_proc_lock()
_binder_inner_proc_lock()
spin_lock(&proc->inner_lock); --> Line 256 (Lock A)
Which doesn't have the deadlock hazard.
>
> When print_binder_proc() and binder_get_txn_from_and_acq_inner() are
> concurrently executed, the deadlock can occur.
>
> I am not quite sure whether this possible deadlock is real and how to
> fix it if it is real.
> Any feedback would be appreciated, thanks :)
>
> Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
>
>
> Best wishes,
> Jia-Ju Bai
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [BUG] android: possible ABBA deadlock in print_binder_proc() and binder_get_txn_from_and_acq_inner()
2021-09-07 19:29 ` Todd Kjos
@ 2021-09-14 10:10 ` Jia-Ju Bai
0 siblings, 0 replies; 3+ messages in thread
From: Jia-Ju Bai @ 2021-09-14 10:10 UTC (permalink / raw)
To: Todd Kjos
Cc: Greg KH, arve, tkjos, maco, joel, christian, hridya, surenb,
linux-kernel
Thanks for the reply :)
On 2021/9/8 3:29, Todd Kjos wrote:
> On Mon, Sep 6, 2021 at 7:30 PM Jia-Ju Bai <baijiaju1990@gmail.com> wrote:
>> Hello,
>>
>> My static analysis tool reports a possible ABBA deadlock in the android
>> driver in Linux 5.10:
>>
>> print_binder_proc()
>> binder_inner_proc_lock()
>> _binder_inner_proc_lock()
>> spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
>> print_binder_thread_ilocked()
>> print_binder_transaction_ilocked()
>> spin_lock(&t->lock); --> Line 5531 (Lock B)
>>
>> binder_get_txn_from_and_acq_inner()
>> binder_get_txn_from()
>> spin_lock(&t->lock); --> Line 1833 (Lock B)
>> binder_inner_proc_lock()
>> _binder_inner_proc_lock()
>> spin_lock(&proc->inner_lock); --> Line 662 (Lock A)
> Hmm. What kernel version are you looking at? These line numbers don't
> match what I see in mainline.
Linux 5.10
> Also, the sequence for
> binder_get_txn_from_and_acq_inner() looks like this for me:
>
> binder_get_txn_from_and_acq_inner()
> binder_get_txn_from()
> spin_lock(&t->lock); --> Line 1427 (Lock B)
> spin_unlock(&t->lock); --> Line 1431 (Lock B)
> binder_inner_proc_lock()
> _binder_inner_proc_lock()
> spin_lock(&proc->inner_lock); --> Line 256 (Lock A)
>
> Which doesn't have the deadlock hazard.
>
Yes, you are right.
My static tool has several errors in the implementation, and thus
reported this false positive, sorry...
Best wishes,
Jia-Ju Bai
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-09-14 10:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-07 2:29 [BUG] android: possible ABBA deadlock in print_binder_proc() and binder_get_txn_from_and_acq_inner() Jia-Ju Bai
2021-09-07 19:29 ` Todd Kjos
2021-09-14 10:10 ` Jia-Ju Bai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).