linux-kernel - Re: [syzbot] [sound?] BUG: sleeping function called from invalid context in snd_card

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c57573e5-8208-495f-ba53-4d9962c0e9b6@quicinc.com>
Date: Sat, 1 Mar 2025 17:50:43 +0800
From: Zhongqiu Han <quic_zhonhan@...cinc.com>
To: Takashi Iwai <tiwai@...e.de>
CC: <syzbot+4cb9fad083898f54c517@...kaller.appspotmail.com>,
        <linux-kernel@...r.kernel.org>, <linux-sound@...r.kernel.org>,
        <perex@...ex.cz>, <syzkaller-bugs@...glegroups.com>, <tiwai@...e.com>
Subject: Re: [syzbot] [sound?] BUG: sleeping function called from invalid
 context in snd_card_locked

On 3/1/2025 5:34 PM, Takashi Iwai wrote:
> On Sat, 01 Mar 2025 10:25:55 +0100,
> Zhongqiu Han wrote:
>>
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit:    d082ecbc71e9 Linux 6.14-rc4
>>> git tree:       upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=14e3d7a4580000
>>> kernel config:
>> https://syzkaller.appspot.com/x/.config?x=8f2f8fb6ad08b539
>>> dashboard link:
>> https://syzkaller.appspot.com/bug?extid=4cb9fad083898f54c517
>>> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils
>> for Debian) 2.40
>>
>>
>> BUG: sleeping function called from invalid context and
>> raw_local_irq_restore() called with IRQs enabled seems can be
>> fixed by below change. if it is valid, will arise the PATCH.
> 
> snd_timer_process_callbacks() gets called from two places, one from
> snd_timer_work() and another from snd_timer_interrupt() where both
> caller cover already with guard(spinlock_irqsave).  That is, it's a
> nested lock, hence without _irqsave().
> 
> IMO, the question is rather why the check of "!in_interrupt()" in
> snd_seq_client_use_ptr() passed in this call path.
> 
> 
> thanks,
> 
> Takashi
> 

Thanks Takashi for the discussion.

I have an initial check:
func snd_seq_check_queue is called from func snd_seq_timer_interrupt,
and the scoped_guard can not cover it. maybe this the reason of
!in_interrupt() check pass.

just like my patch shared, snd_timer_process_callbacks called 
spin_unlock but not spin_unlock_irqrestore, which caused
irqs_disabled(): 1 , and then caused the BUG.


BUG: sleeping function called from invalid context at 
kernel/locking/mutex.c:562
in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1167, name: 
kworker/0:1H


please feel free and kindly correct me if any misunderstanding.

>>
>> #syz test:
>>
>> diff --git a/sound/core/timer.c b/sound/core/timer.c
>> index fbada79380f9..5290c1b9f2b8 100644
>> --- a/sound/core/timer.c
>> +++ b/sound/core/timer.c
>> @@ -767,6 +767,7 @@ static void snd_timer_process_callbacks(struct
>> snd_timer *timer,
>>   {
>>          struct snd_timer_instance *ti;
>>          unsigned long resolution, ticks;
>> +       unsigned long flags;
>>
>>          while (!list_empty(head)) {
>>                  ti = list_first_entry(head, struct snd_timer_instance,
>> @@ -780,10 +781,10 @@ static void snd_timer_process_callbacks(struct
>> snd_timer *timer,
>>                          ti->pticks = 0;
>>                          resolution = ti->resolution;
>>                          ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
>> -                       spin_unlock(&timer->lock);
>> +                       spin_unlock_irqrestore(&timer->lock, flags);
>>                          if (ti->callback)
>>                                  ti->callback(ti, resolution, ticks);
>> -                       spin_lock(&timer->lock);
>> +                       spin_lock_irqsave(&timer->lock, flags);
>>                          ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
>>                  }
>>          }
>> @@ -805,14 +806,16 @@ static void snd_timer_clear_callbacks(struct
>> snd_timer *timer,
>>   static void snd_timer_work(struct work_struct *work)
>>   {
>>          struct snd_timer *timer = container_of(work, struct snd_timer,
>> task_work);
>> +       unsigned long flags;
>>
>>          if (timer->card && timer->card->shutdown) {
>>                  snd_timer_clear_callbacks(timer, &timer->sack_list_head);
>>                  return;
>>          }
>>
>> -       guard(spinlock_irqsave)(&timer->lock);
>> +       spin_lock_irqsave(&timer->lock, flags);
>>          snd_timer_process_callbacks(timer, &timer->sack_list_head);
>> +       spin_unlock_irqrestore(&timer->lock, flags);
>>   }
>>
>>   /*
>>
>>
>>
>>
>>
>> Thanks
>> Zhongqiu Han


-- 
Thx and BRs,
Zhongqiu Han