linux-kernel - Re: [syzbot] [sound?] BUG: sleeping function called from invalid context in snd_card

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6610cdb8-072e-47fe-b9bc-f4f5b9a79f8e@quicinc.com>
Date: Sat, 1 Mar 2025 17:25:55 +0800
From: Zhongqiu Han <quic_zhonhan@...cinc.com>
To: <syzbot+4cb9fad083898f54c517@...kaller.appspotmail.com>
CC: <linux-kernel@...r.kernel.org>, <linux-sound@...r.kernel.org>,
        <perex@...ex.cz>,
        <syzbot+4cb9fad083898f54c517@...kaller.appspotmail.com>,
        <syzkaller-bugs@...glegroups.com>, <tiwai@...e.com>
Subject: Re: [syzbot] [sound?] BUG: sleeping function called from invalid
 context in snd_card_locked

 > Hello,
 >
 > syzbot found the following issue on:
 >
 > HEAD commit:    d082ecbc71e9 Linux 6.14-rc4
 > git tree:       upstream
 > console output: https://syzkaller.appspot.com/x/log.txt?x=14e3d7a4580000
 > kernel config: 
https://syzkaller.appspot.com/x/.config?x=8f2f8fb6ad08b539
 > dashboard link: 
https://syzkaller.appspot.com/bug?extid=4cb9fad083898f54c517
 > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils 
for Debian) 2.40


BUG: sleeping function called from invalid context and
raw_local_irq_restore() called with IRQs enabled seems can be
fixed by below change. if it is valid, will arise the PATCH.

#syz test:

diff --git a/sound/core/timer.c b/sound/core/timer.c
index fbada79380f9..5290c1b9f2b8 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -767,6 +767,7 @@ static void snd_timer_process_callbacks(struct 
snd_timer *timer,
  {
         struct snd_timer_instance *ti;
         unsigned long resolution, ticks;
+       unsigned long flags;

         while (!list_empty(head)) {
                 ti = list_first_entry(head, struct snd_timer_instance,
@@ -780,10 +781,10 @@ static void snd_timer_process_callbacks(struct 
snd_timer *timer,
                         ti->pticks = 0;
                         resolution = ti->resolution;
                         ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
-                       spin_unlock(&timer->lock);
+                       spin_unlock_irqrestore(&timer->lock, flags);
                         if (ti->callback)
                                 ti->callback(ti, resolution, ticks);
-                       spin_lock(&timer->lock);
+                       spin_lock_irqsave(&timer->lock, flags);
                         ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
                 }
         }
@@ -805,14 +806,16 @@ static void snd_timer_clear_callbacks(struct 
snd_timer *timer,
  static void snd_timer_work(struct work_struct *work)
  {
         struct snd_timer *timer = container_of(work, struct snd_timer, 
task_work);
+       unsigned long flags;

         if (timer->card && timer->card->shutdown) {
                 snd_timer_clear_callbacks(timer, &timer->sack_list_head);
                 return;
         }

-       guard(spinlock_irqsave)(&timer->lock);
+       spin_lock_irqsave(&timer->lock, flags);
         snd_timer_process_callbacks(timer, &timer->sack_list_head);
+       spin_unlock_irqrestore(&timer->lock, flags);
  }

  /*





Thanks
Zhongqiu Han