[PATCH v3] watchdog: s3c2410: Fix potential deadlock on &wdt->lock
Guenter Roeck
linux at roeck-us.net
Wed Jul 5 07:53:11 PDT 2023
On 7/5/23 02:09, Chengfeng Ye wrote:
> As &wdt->lock is acquired by hard irq s3c2410wdt_irq(),
> other acquisition of the same lock under process context should
> disable irq, otherwise deadlock could happen if the
> irq preempt the execution while the lock is held in process context
> on the same CPU.
>
> [Deadlock Scenario]
> s3c2410wdt_suspend()
> -> s3c2410wdt_stop()
> -> spin_lock(&wdt->lock)
> <irq iterrupt>
> -> s3c2410wdt_irq()
> -> s3c2410wdt_keepalive()
> -> spin_lock(&wdt->lock) (deadlock here)
>
> [Deadlock Scenario]
> s3c2410wdt_probe()
> -> s3c2410wdt_start()
> -> spin_lock(&wdt->lock)
> <irq iterrupt>
> -> s3c2410wdt_irq()
> -> s3c2410wdt_keepalive()
> -> spin_lock(&wdt->lock) (deadlock here)
>
> [Deadlock Scenario]
> s3c2410wdt_keepalive()
> -> spin_lock(&wdt->lock)
> <irq iterrupt>
> -> s3c2410wdt_irq()
> -> s3c2410wdt_keepalive()
> -> spin_lock(&wdt->lock) (deadlock here)
>
> This flaw was found by an experimental static analysis tool I am
> developing for irq-related deadlock, which reported the above
> warning when analyzing the linux kernel 6.4-rc7 release.
>
> The tentative patch fix the potential deadlock by spin_lock_irqsave()
> under process context.
>
> Signed-off-by: Chengfeng Ye <dg573847474 at gmail.com>
Reviewed-by: Guenter Roeck <linux at roeck-us.net>
> ---
> drivers/watchdog/s3c2410_wdt.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
> index 95416a9bdd4b..e1dc71ece01e 100644
> --- a/drivers/watchdog/s3c2410_wdt.c
> +++ b/drivers/watchdog/s3c2410_wdt.c
> @@ -379,10 +379,11 @@ static int s3c2410wdt_enable(struct s3c2410_wdt *wdt, bool en)
> static int s3c2410wdt_keepalive(struct watchdog_device *wdd)
> {
> struct s3c2410_wdt *wdt = watchdog_get_drvdata(wdd);
> + unsigned long flags;
>
> - spin_lock(&wdt->lock);
> + spin_lock_irqsave(&wdt->lock, flags);
> writel(wdt->count, wdt->reg_base + S3C2410_WTCNT);
> - spin_unlock(&wdt->lock);
> + spin_unlock_irqrestore(&wdt->lock, flags);
>
> return 0;
> }
> @@ -399,10 +400,11 @@ static void __s3c2410wdt_stop(struct s3c2410_wdt *wdt)
> static int s3c2410wdt_stop(struct watchdog_device *wdd)
> {
> struct s3c2410_wdt *wdt = watchdog_get_drvdata(wdd);
> + unsigned long flags;
>
> - spin_lock(&wdt->lock);
> + spin_lock_irqsave(&wdt->lock, flags);
> __s3c2410wdt_stop(wdt);
> - spin_unlock(&wdt->lock);
> + spin_unlock_irqrestore(&wdt->lock, flags);
>
> return 0;
> }
> @@ -411,8 +413,9 @@ static int s3c2410wdt_start(struct watchdog_device *wdd)
> {
> unsigned long wtcon;
> struct s3c2410_wdt *wdt = watchdog_get_drvdata(wdd);
> + unsigned long flags;
>
> - spin_lock(&wdt->lock);
> + spin_lock_irqsave(&wdt->lock, flags);
>
> __s3c2410wdt_stop(wdt);
>
> @@ -433,7 +436,7 @@ static int s3c2410wdt_start(struct watchdog_device *wdd)
> writel(wdt->count, wdt->reg_base + S3C2410_WTDAT);
> writel(wdt->count, wdt->reg_base + S3C2410_WTCNT);
> writel(wtcon, wdt->reg_base + S3C2410_WTCON);
> - spin_unlock(&wdt->lock);
> + spin_unlock_irqrestore(&wdt->lock, flags);
>
> return 0;
> }
More information about the linux-arm-kernel
mailing list