tipc: fix a potential deadlock on &tx->lock

It seems that tipc_crypto_key_revoke() could be be invoked by
wokequeue tipc_crypto_work_rx() under process context and
timer/rx callback under softirq context, thus the lock acquisition
on &tx->lock seems better use spin_lock_bh() to prevent possible
deadlock.

This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.

tipc_crypto_work_rx() <workqueue>
--> tipc_crypto_key_distr()
--> tipc_bcast_xmit()
--> tipc_bcbase_xmit()
--> tipc_bearer_bc_xmit()
--> tipc_crypto_xmit()
--> tipc_ehdr_build()
--> tipc_crypto_key_revoke()
--> spin_lock(&tx->lock)
<timer interrupt>
   --> tipc_disc_timeout()
   --> tipc_bearer_xmit_skb()
   --> tipc_crypto_xmit()
   --> tipc_ehdr_build()
   --> tipc_crypto_key_revoke()
   --> spin_lock(&tx->lock) <deadlock here>

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication")
Link: https://lore.kernel.org/r/20230927181414.59928-1-dg573847474@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
index 302fd749c4249a9644dbc907ca5f9d11f8014d2b..43c3f1c971b8fdf43e93b1616483fb2d8fef3d57 100644 (file)
--- a/net/tipc/crypto.c
+++ b/net/tipc/crypto.c
@@ -1441,14 +1441,14 @@ static int tipc_crypto_key_revoke(struct net *net, u8 tx_key)
        struct tipc_crypto *tx = tipc_net(net)->crypto_tx;
        struct tipc_key key;
 
-       spin_lock(&tx->lock);
+       spin_lock_bh(&tx->lock);
        key = tx->key;
        WARN_ON(!key.active || tx_key != key.active);
 
        /* Free the active key */
        tipc_crypto_key_set_state(tx, key.passive, 0, key.pending);
        tipc_crypto_key_detach(tx->aead[key.active], &tx->lock);
-       spin_unlock(&tx->lock);
+       spin_unlock_bh(&tx->lock);
 
        pr_warn("%s: key is revoked\n", tx->name);
        return -EKEYREVOKED;