Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

ipmi: fix potential deadlock on &kcs_bmc->lock

As kcs_bmc_handle_event() is executed inside both a timer and a hardirq,
it should disable irq before lock acquisition otherwise deadlock could
happen if the timmer is preemtped by the irq.

Possible deadlock scenario:
aspeed_kcs_check_obe() (timer)
-> kcs_bmc_handle_event()
-> spin_lock(&kcs_bmc->lock)
<irq interruption>
-> aspeed_kcs_irq()
-> kcs_bmc_handle_event()
-> spin_lock(&kcs_bmc->lock) (deadlock here)

This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.

The tentative patch fix the potential deadlock by spin_lock_irqsave()

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Message-Id: <20230627152449.36093-1-dg573847474@gmail.com>
Signed-off-by: Corey Minyard <minyard@acm.org>

authored by

Chengfeng Ye and committed by
Corey Minyard
b02bb79e 6cf1a126

+3 -2
+3 -2
drivers/char/ipmi/kcs_bmc.c
··· 56 56 { 57 57 struct kcs_bmc_client *client; 58 58 irqreturn_t rc = IRQ_NONE; 59 + unsigned long flags; 59 60 60 - spin_lock(&kcs_bmc->lock); 61 + spin_lock_irqsave(&kcs_bmc->lock, flags); 61 62 client = kcs_bmc->client; 62 63 if (client) 63 64 rc = client->ops->event(client); 64 - spin_unlock(&kcs_bmc->lock); 65 + spin_unlock_irqrestore(&kcs_bmc->lock, flags); 65 66 66 67 return rc; 67 68 }