linux-kernel - Re: [syzbot] [sound?] BUG: sleeping function called from invalid context in snd_card

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87y0xp9jr8.wl-tiwai@suse.de>
Date: Sat, 01 Mar 2025 10:34:51 +0100
From: Takashi Iwai <tiwai@...e.de>
To: Zhongqiu Han <quic_zhonhan@...cinc.com>
Cc: <syzbot+4cb9fad083898f54c517@...kaller.appspotmail.com>,
	<linux-kernel@...r.kernel.org>,
	<linux-sound@...r.kernel.org>,
	<perex@...ex.cz>,
	<syzkaller-bugs@...glegroups.com>,
	<tiwai@...e.com>
Subject: Re: [syzbot] [sound?] BUG: sleeping function called from invalid context in snd_card_locked

On Sat, 01 Mar 2025 10:25:55 +0100,
Zhongqiu Han wrote:
> 
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    d082ecbc71e9 Linux 6.14-rc4
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=14e3d7a4580000
> > kernel config:
> https://syzkaller.appspot.com/x/.config?x=8f2f8fb6ad08b539
> > dashboard link:
> https://syzkaller.appspot.com/bug?extid=4cb9fad083898f54c517
> > compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils
> for Debian) 2.40
> 
> 
> BUG: sleeping function called from invalid context and
> raw_local_irq_restore() called with IRQs enabled seems can be
> fixed by below change. if it is valid, will arise the PATCH.

snd_timer_process_callbacks() gets called from two places, one from
snd_timer_work() and another from snd_timer_interrupt() where both
caller cover already with guard(spinlock_irqsave).  That is, it's a
nested lock, hence without _irqsave().

IMO, the question is rather why the check of "!in_interrupt()" in 
snd_seq_client_use_ptr() passed in this call path.


thanks,

Takashi

> 
> #syz test:
> 
> diff --git a/sound/core/timer.c b/sound/core/timer.c
> index fbada79380f9..5290c1b9f2b8 100644
> --- a/sound/core/timer.c
> +++ b/sound/core/timer.c
> @@ -767,6 +767,7 @@ static void snd_timer_process_callbacks(struct
> snd_timer *timer,
>  {
>         struct snd_timer_instance *ti;
>         unsigned long resolution, ticks;
> +       unsigned long flags;
> 
>         while (!list_empty(head)) {
>                 ti = list_first_entry(head, struct snd_timer_instance,
> @@ -780,10 +781,10 @@ static void snd_timer_process_callbacks(struct
> snd_timer *timer,
>                         ti->pticks = 0;
>                         resolution = ti->resolution;
>                         ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
> -                       spin_unlock(&timer->lock);
> +                       spin_unlock_irqrestore(&timer->lock, flags);
>                         if (ti->callback)
>                                 ti->callback(ti, resolution, ticks);
> -                       spin_lock(&timer->lock);
> +                       spin_lock_irqsave(&timer->lock, flags);
>                         ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
>                 }
>         }
> @@ -805,14 +806,16 @@ static void snd_timer_clear_callbacks(struct
> snd_timer *timer,
>  static void snd_timer_work(struct work_struct *work)
>  {
>         struct snd_timer *timer = container_of(work, struct snd_timer,
> task_work);
> +       unsigned long flags;
> 
>         if (timer->card && timer->card->shutdown) {
>                 snd_timer_clear_callbacks(timer, &timer->sack_list_head);
>                 return;
>         }
> 
> -       guard(spinlock_irqsave)(&timer->lock);
> +       spin_lock_irqsave(&timer->lock, flags);
>         snd_timer_process_callbacks(timer, &timer->sack_list_head);
> +       spin_unlock_irqrestore(&timer->lock, flags);
>  }
> 
>  /*
> 
> 
> 
> 
> 
> Thanks
> Zhongqiu Han