Re: [PATCH] media: cec: cancel delayed work before freeing an interrupted transmit

[syzbot <syzbot+051024d603432b4ab395@syzkaller.appspotmail.com>]

> If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(),
> the previous cancel_delayed_work_sync() could race with the CEC kthread,
> which might re-arm the timeout *after* the cancel completes. This leads
> to freeing active delayed_work and an ODEBUG warning.
>
> Fix this by cancelling the delayed work only after removing the data from
> the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop
> adap->lock around the synchronous cancel to avoid deadlocking with
> cec_wait_timeout().
>
> Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
> Reported-by: syzbot+051024d603432b4ab395@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395
> Cc: stable@vger.kernel.org
> Signed-off-by: Biren Pandya <birenpandya@gmail.com>
> ---
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

>  drivers/media/cec/core/cec-adap.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> index 8f7244ac1d43..50bd8bbeb5a5 100644
> --- a/drivers/media/cec/core/cec-adap.c
> +++ b/drivers/media/cec/core/cec-adap.c
> @@ -965,7 +965,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
>  	 */
>  	mutex_unlock(&adap->lock);
>  	err = wait_for_completion_killable(&data->c);
> -	cancel_delayed_work_sync(&data->work);
>  	mutex_lock(&adap->lock);
>  
>  	if (err)
> @@ -985,6 +984,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
>  		list_del(&data->list);
>  	if (WARN_ON(!list_empty(&data->xfer_list)))
>  		list_del(&data->xfer_list);
> +
> +	if (!cancel_delayed_work(&data->work)) {
> +		mutex_unlock(&adap->lock);
> +		cancel_delayed_work_sync(&data->work);
> +		mutex_lock(&adap->lock);
> +	}
> +
>  	kfree(data);
>  	return 0;
>  }
> -- 
> 2.50.1