Re: [syzbot] [sound?] BUG: sleeping function called from invalid context in snd_card_locked

[syzbot <syzbot+4cb9fad083898f54c517@syzkaller.appspotmail.com>]

>  > Hello,
>  >
>  > syzbot found the following issue on:
>  >
>  > HEAD commit:    d082ecbc71e9 Linux 6.14-rc4
>  > git tree:       upstream
>  > console output: https://syzkaller.appspot.com/x/log.txt?x=14e3d7a4580000
>  > kernel config: 
> https://syzkaller.appspot.com/x/.config?x=8f2f8fb6ad08b539
>  > dashboard link: 
> https://syzkaller.appspot.com/bug?extid=4cb9fad083898f54c517
>  > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils 
> for Debian) 2.40
>
>
> BUG: sleeping function called from invalid context and
> raw_local_irq_restore() called with IRQs enabled seems can be
> fixed by below change. if it is valid, will arise the PATCH.
>
> #syz test:

want either no args or 2 args (repo, branch), got 4

>
> diff --git a/sound/core/timer.c b/sound/core/timer.c
> index fbada79380f9..5290c1b9f2b8 100644
> --- a/sound/core/timer.c
> +++ b/sound/core/timer.c
> @@ -767,6 +767,7 @@ static void snd_timer_process_callbacks(struct 
> snd_timer *timer,
>   {
>          struct snd_timer_instance *ti;
>          unsigned long resolution, ticks;
> +       unsigned long flags;
>
>          while (!list_empty(head)) {
>                  ti = list_first_entry(head, struct snd_timer_instance,
> @@ -780,10 +781,10 @@ static void snd_timer_process_callbacks(struct 
> snd_timer *timer,
>                          ti->pticks = 0;
>                          resolution = ti->resolution;
>                          ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
> -                       spin_unlock(&timer->lock);
> +                       spin_unlock_irqrestore(&timer->lock, flags);
>                          if (ti->callback)
>                                  ti->callback(ti, resolution, ticks);
> -                       spin_lock(&timer->lock);
> +                       spin_lock_irqsave(&timer->lock, flags);
>                          ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
>                  }
>          }
> @@ -805,14 +806,16 @@ static void snd_timer_clear_callbacks(struct 
> snd_timer *timer,
>   static void snd_timer_work(struct work_struct *work)
>   {
>          struct snd_timer *timer = container_of(work, struct snd_timer, 
> task_work);
> +       unsigned long flags;
>
>          if (timer->card && timer->card->shutdown) {
>                  snd_timer_clear_callbacks(timer, &timer->sack_list_head);
>                  return;
>          }
>
> -       guard(spinlock_irqsave)(&timer->lock);
> +       spin_lock_irqsave(&timer->lock, flags);
>          snd_timer_process_callbacks(timer, &timer->sack_list_head);
> +       spin_unlock_irqrestore(&timer->lock, flags);
>   }
>
>   /*
>
>
>
>
>
> Thanks
> Zhongqiu Han