Re: [PATCH RESEND] dmaengine: milbeaut-hdmac: Fix potential deadlock on &mc->vc.lock

[Jassi Brar]

On Wed, 26 Jul 2023 at 04:06, Chengfeng Ye <dg573847474@xxxxxxxxx> wrote:
>
> As &mc->vc.lock is acquired by milbeaut_hdmac_interrupt() under irq
> context, other acquisition of the same lock under process context should
> disable irq, otherwise deadlock could happen if the irq preempts the
> execution of process context code while the lock is held in process context
> on the same CPU.
>
> milbeaut_hdmac_chan_config(), milbeaut_hdmac_chan_resume() and
> milbeaut_hdmac_chan_pause() are such callback functions not disable irq by
> default.
>
> Possible deadlock scenario:
> milbeaut_hdmac_chan_config()
>     -> spin_lock(&mc->vc.lock)
>         <hard interruption>
>         -> milbeaut_hdmac_interrupt()
>         -> spin_lock(&mc->vc.lock); (deadlock here)
>
> This flaw was found by an experimental static analysis tool I am developing
> for irq-related deadlock.
>
> The tentative patch fixes the potential deadlock by spin_lock_irqsave() in
> the three callback functions to disable irq while lock is held.
>
> Signed-off-by: Chengfeng Ye <dg573847474@xxxxxxxxx>
> ---
>  drivers/dma/milbeaut-hdmac.c | 15 +++++++++------
>  1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/dma/milbeaut-hdmac.c b/drivers/dma/milbeaut-hdmac.c
> index 1b0a95892627..6151c830ff6e 100644
> --- a/drivers/dma/milbeaut-hdmac.c
> +++ b/drivers/dma/milbeaut-hdmac.c
> @@ -214,10 +214,11 @@ milbeaut_hdmac_chan_config(struct dma_chan *chan, struct dma_slave_config *cfg)
>  {
>         struct virt_dma_chan *vc = to_virt_chan(chan);
>         struct milbeaut_hdmac_chan *mc = to_milbeaut_hdmac_chan(vc);
> +       unsigned long flags;
>
> -       spin_lock(&mc->vc.lock);
> +       spin_lock_irqsave(&mc->vc.lock, flags);
>
while at it, maybe also use vc->lock, instead of mc->vc.lock here and
in other two places, just like the rest of driver.

Acked-by: Jassi Brar <jaswinder.singh@xxxxxxxxxx>

thanks.