Re: [PATCH] media: cec: cancel delayed work before freeing an interrupted transmit

Re: [PATCH] media: cec: cancel delayed work before freeing an interrupted transmit

[syzbot]

> If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(),
> the previous cancel_delayed_work_sync() could race with the CEC kthread,
> which might re-arm the timeout *after* the cancel completes. This leads
> to freeing active delayed_work and an ODEBUG warning.
>
> Fix this by cancelling the delayed work only after removing the data from
> the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop
> adap->lock around the synchronous cancel to avoid deadlocking with
> cec_wait_timeout().
>
> Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
> Reported-by: syzbot+051024d603432b4ab395@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395
> Cc: stable@vger.kernel.org
> Signed-off-by: Biren Pandya <birenpandya@gmail.com>
> ---
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>  drivers/media/cec/core/cec-adap.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> index 8f7244ac1d43..50bd8bbeb5a5 100644
> --- a/drivers/media/cec/core/cec-adap.c
> +++ b/drivers/media/cec/core/cec-adap.c
> @@ -965,7 +965,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
>  	 */
>  	mutex_unlock(&adap->lock);
>  	err = wait_for_completion_killable(&data->c);
> -	cancel_delayed_work_sync(&data->work);
>  	mutex_lock(&adap->lock);
>  
>  	if (err)
> @@ -985,6 +984,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
>  		list_del(&data->list);
>  	if (WARN_ON(!list_empty(&data->xfer_list)))
>  		list_del(&data->xfer_list);
> +
> +	if (!cancel_delayed_work(&data->work)) {
> +		mutex_unlock(&adap->lock);
> +		cancel_delayed_work_sync(&data->work);
> +		mutex_lock(&adap->lock);
> +	}
> +
>  	kfree(data);
>  	return 0;
>  }
> -- 
> 2.50.1

[PATCH] media: cec: cancel delayed work before freeing an interrupted transmit

[Biren Pandya]

If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(),
the previous cancel_delayed_work_sync() could race with the CEC kthread,
which might re-arm the timeout *after* the cancel completes. This leads
to freeing active delayed_work and an ODEBUG warning.

Fix this by cancelling the delayed work only after removing the data from
the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop
adap->lock around the synchronous cancel to avoid deadlocking with
cec_wait_timeout().

Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
Reported-by: syzbot+051024d603432b4ab395@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
---
 drivers/media/cec/core/cec-adap.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
index 8f7244ac1d43..50bd8bbeb5a5 100644
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -965,7 +965,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 	 */
 	mutex_unlock(&adap->lock);
 	err = wait_for_completion_killable(&data->c);
-	cancel_delayed_work_sync(&data->work);
 	mutex_lock(&adap->lock);
 
 	if (err)
@@ -985,6 +984,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 		list_del(&data->list);
 	if (WARN_ON(!list_empty(&data->xfer_list)))
 		list_del(&data->xfer_list);
+
+	if (!cancel_delayed_work(&data->work)) {
+		mutex_unlock(&adap->lock);
+		cancel_delayed_work_sync(&data->work);
+		mutex_lock(&adap->lock);
+	}
+
 	kfree(data);
 	return 0;
 }
-- 
2.50.1

Re: [PATCH] media: cec: cancel delayed work before freeing an interrupted transmit

[Hillf Danton]

On Sun, 21 Jun 2026 00:45:13 +0530 Biren Pandya wrote:
> If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(),
> the previous cancel_delayed_work_sync() could race with the CEC kthread,
> which might re-arm the timeout *after* the cancel completes. This leads
> to freeing active delayed_work and an ODEBUG warning.
> 
Given no specifying how it is armed again after cancel, re-arm in general is
handled by disabling the work item before cancel.

> Fix this by cancelling the delayed work only after removing the data from
> the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop
> adap->lock around the synchronous cancel to avoid deadlocking with
> cec_wait_timeout().
> 
> Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
> Reported-by: syzbot+051024d603432b4ab395@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395
> Signed-off-by: Biren Pandya <birenpandya@gmail.com>
> ---
>  drivers/media/cec/core/cec-adap.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> index 8f7244ac1d43..50bd8bbeb5a5 100644
> --- a/drivers/media/cec/core/cec-adap.c
> +++ b/drivers/media/cec/core/cec-adap.c
> @@ -965,7 +965,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
>  	 */
>  	mutex_unlock(&adap->lock);
>  	err = wait_for_completion_killable(&data->c);
> -	cancel_delayed_work_sync(&data->work);
>  	mutex_lock(&adap->lock);
>  
>  	if (err)
> @@ -985,6 +984,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
>  		list_del(&data->list);
>  	if (WARN_ON(!list_empty(&data->xfer_list)))
>  		list_del(&data->xfer_list);
> +
> +	if (!cancel_delayed_work(&data->work)) {
> +		mutex_unlock(&adap->lock);
> +		cancel_delayed_work_sync(&data->work);
> +		mutex_lock(&adap->lock);
> +	}
> +
>  	kfree(data);
>  	return 0;
>  }
> -- 
> 2.50.1