Re: [syzbot] [sound?] possible deadlock in __snd_pcm_lib_xfer (2)

Hillf Danton
2025-08-30T00:46:07Z

> Date: Fri, 29 Aug 2025 11:38:35 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 07d9df80082b Merge tag 'perf-tools-fixes-for-v6.17-2025-08..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17333fbc580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e1e1566c7726877e
> dashboard link: https://syzkaller.appspot.com/bug?extid=10b4363fb0f46527f3f3
> compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=160e9262580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17ed0242580000

#syz test

--- x/kernel/time/hrtimer.c
+++ y/kernel/time/hrtimer.c
@@ -1718,7 +1718,7 @@ EXPORT_SYMBOL_GPL(hrtimer_active);
static void __run_hrtimer(struct hrtimer_cpu_base *cpu_base,
struct hrtimer_clock_base *base,
struct hrtimer *timer, ktime_t *now,
- unsigned long flags) __must_hold(&cpu_base->lock)
+ unsigned long flags, bool soft) __must_hold(&cpu_base->lock)
{
enum hrtimer_restart (*fn)(struct hrtimer *);
bool expires_in_hardirq;
@@ -1755,6 +1755,8 @@ static void __run_hrtimer(struct hrtimer
* is dropped.
*/
raw_spin_unlock_irqrestore(&cpu_base->lock, flags);
+ if (soft)
+ hrtimer_cpu_base_unlock_expiry(cpu_base);
trace_hrtimer_expire_entry(timer, now);
expires_in_hardirq = lockdep_hrtimer_enter(timer);

@@ -1762,6 +1764,8 @@ static void __run_hrtimer(struct hrtimer

lockdep_hrtimer_exit(expires_in_hardirq);
trace_hrtimer_expire_exit(timer);
+ if (soft)
+ hrtimer_cpu_base_lock_expiry(cpu_base);
raw_spin_lock_irq(&cpu_base->lock);

/*
@@ -1822,7 +1826,8 @@ static void __hrtimer_run_queues(struct
if (basenow < hrtimer_get_softexpires_tv64(timer))
break;

- __run_hrtimer(cpu_base, base, timer, &basenow, flags);
+ __run_hrtimer(cpu_base, base, timer, &basenow, flags,
+ active_mask == HRTIMER_ACTIVE_SOFT);
if (active_mask == HRTIMER_ACTIVE_SOFT)
hrtimer_sync_wait_running(cpu_base, flags);
}
--