Re: [syzbot] [sound?] BUG: sleeping function called from invalid context in snd_card_locked

[Zhongqiu Han <quic_zhonhan@xxxxxxxxxxx>]

> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    d082ecbc71e9 Linux 6.14-rc4
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14e3d7a4580000
> kernel config: 
https://syzkaller.appspot.com/x/.config?x=8f2f8fb6ad08b539
> dashboard link: 
https://syzkaller.appspot.com/bug?extid=4cb9fad083898f54c517
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils 
for Debian) 2.40


BUG: sleeping function called from invalid context and
raw_local_irq_restore() called with IRQs enabled seems can be
fixed by below change. if it is valid, will arise the PATCH.

#syz test:

diff --git a/sound/core/timer.c b/sound/core/timer.c
index fbada79380f9..5290c1b9f2b8 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -767,6 +767,7 @@ static void snd_timer_process_callbacks(struct 
snd_timer *timer,
 {
        struct snd_timer_instance *ti;
        unsigned long resolution, ticks;
+       unsigned long flags;

        while (!list_empty(head)) {
                ti = list_first_entry(head, struct snd_timer_instance,
@@ -780,10 +781,10 @@ static void snd_timer_process_callbacks(struct 
snd_timer *timer,
                        ti->pticks = 0;
                        resolution = ti->resolution;
                        ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
-                       spin_unlock(&timer->lock);
+                       spin_unlock_irqrestore(&timer->lock, flags);
                        if (ti->callback)
                                ti->callback(ti, resolution, ticks);
-                       spin_lock(&timer->lock);
+                       spin_lock_irqsave(&timer->lock, flags);
                        ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
                }
        }
@@ -805,14 +806,16 @@ static void snd_timer_clear_callbacks(struct 
snd_timer *timer,
 static void snd_timer_work(struct work_struct *work)
 {
        struct snd_timer *timer = container_of(work, struct snd_timer, 
task_work);
+       unsigned long flags;

        if (timer->card && timer->card->shutdown) {
                snd_timer_clear_callbacks(timer, &timer->sack_list_head);
                return;
        }

-       guard(spinlock_irqsave)(&timer->lock);
+       spin_lock_irqsave(&timer->lock, flags);
        snd_timer_process_callbacks(timer, &timer->sack_list_head);
+       spin_unlock_irqrestore(&timer->lock, flags);
 }

 /*





Thanks
Zhongqiu Han