Potential double-lock BUG in drivers/infiniband/core/umem_odp.c (Linux 4.9-rc7)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

With the help of a static bug finder (EBA -
http://www.iagoabal.eu/eba) I have found a potential double-lock in
drivers/infiniband/core/umem_odp.c: there seems to be a recursive lock
on `umem->odp_data->umem_mutex' in function
`ib_umem_odp_map_dma_pages'.

This problem may have been introduced by commit c1d383b5785b
("IB/core: dma map/unmap locking optimizations").

If this is indeed a bug, I could try to help with a patch... although
it doesn't look trivial to fix at first sight.

The trace is as follows:

1. Function `ib_umem_odp_map_dma_pages' takes the lock for the first
time in line 589:

    // see https://github.com/torvalds/linux/blob/v4.9-rc7/drivers/infiniband/core/umem_odp.c#L589
    mutex_lock(&umem->odp_data->umem_mutex);

2. Call to function `ib_umem_odp_map_dma_single_page' in line 591;

3. Call to function `invalidate_page_trampoline' in line 486;

4. Call to function `ib_umem_notifier_start_account' in line 160;

5. Lock is taken for the second time in line 46:

    // see https://github.com/torvalds/linux/blob/v4.9-rc7/drivers/infiniband/core/umem_odp.c#L46
    mutex_lock(&item->odp_data->umem_mutex);

Hope it helps!

-- iago
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux