[BUG] block: drbd: possible deadlocks involving waiting and locking operations

From: Jia-Ju Bai
Date: Tue Feb 08 2022 - 06:31:47 EST


Hello,

My static analysis tool reports three possible deadlocks in the drbd driver in Linux 5.16:

#BUG 1
drbd_adm_attach()
  mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1810 (Lock A)
  wait_event(device->misc_wait, ...); --> Line 1824 (Wait X)

drbd_adm_disk_opts()
  mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
  get_ldev()
    get_ldev_if_state()
      _get_ldev_if_state()
        put_ldev()
          wake_up(&device->misc_wait); --> Line 2108 (Wake X)

#BUG 2
drbd_adm_invalidate()
  mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 3024 (Lock A)
  wait_event(device->misc_wait, ...); --> Line 3030 (Wait X)

drbd_adm_disk_opts()
  mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
  get_ldev()
    get_ldev_if_state()
      _get_ldev_if_state()
        put_ldev()
          wake_up(&device->misc_wait); --> Line 2108 (Wake X)

#BUG 3
drbd_adm_invalidate_peer()
  mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 3101 (Lock A)
  wait_event(device->misc_wait, ...); --> Line 3107 (Wait X)

drbd_adm_disk_opts()
  mutex_lock(&adm_ctx.resource->adm_mutex); --> Line 1582 (Lock A)
  get_ldev()
    get_ldev_if_state()
      _get_ldev_if_state()
        put_ldev()
          wake_up(&device->misc_wait); --> Line 2108 (Wake X)

When drbd_adm_attach()/drbd_adm_invalidate()/drbd_adm_invalidate_peer() is executed, "Wait X" is performed by holding "Lock A". If drbd_adm_disk_opts() is executed at this time, because "Lock A" has been already held, "Wake X" cannot be performed to wake up "Wait X", causing possible deadlocks.

I am not quite sure whether these possible problems are real.
Any feedback would be appreciated, thanks :)

Best wishes,
Jia-Ju Bai