[BUG] cw1200: possible deadlock involving three functions

From: Jia-Ju Bai
Date: Mon Feb 07 2022 - 11:16:52 EST


Hello,

My static analysis tool reports a possible deadlock in the cw1200 driver in Linux 5.16:

cw1200_probe_work()
  mutex_lock(&priv->conf_mutex); --> Line 384 (Lock A)
  wsm_flush_tx()
    wait_event_timeout(priv->bh_evt_wq, ...) --> Line 1208 (Wait X)

cw1200_bh()
  wait_event_interruptible(priv->bh_wq, ...) --> Line 524 (Wait Y)
  wake_up(&priv->bh_evt_wq); --> Line 534 (Wake X)

cw1200_do_join()
  mutex_lock(&priv->conf_mutex); --> Line 1238 (Lock A)
  wsm_unlock_tx()
    cw1200_bh_wakeup()
      wake_up(&priv->bh_wq); --> Line 119 (Wake Y)

When cw1200_probe_work() is executed, "Wait X" is performed by holding "Lock A". If cw1200_bh() is executed at this time, because "Wait Y" is performed, "Wake X" cannot be performed to wake up "Wait X". If cw1200_do_join() is executed at this time, because "Lock A" has already been hold, "Wake Y" cannot be performed to wake up "Wait Y".
I find that "Wait X" is performed with a timeout, to relieve the possible deadlock; but I think this timeout can cause inefficient execution.

I am not quite sure whether this possible problem is real and how to fix it if it is real.
Any feedback would be appreciated, thanks :)

Best wishes,
Jia-Ju Bai