From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f169.google.com (mail-pl1-f169.google.com [209.85.214.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C44DE1E7C2E for ; Sat, 20 Jun 2026 19:15:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781982929; cv=none; b=NNEWTu0hC8NW7nLVId7lAtOc5WWgjHWN28XMK48cPu2H8nuTmTJ/tVFhKkmFWQ3Kb/JouHzQl+P92+CgElmNIdE4L0MgFSL396PGMubIUZvhsZwfkLtYSY+dT3RVW/HmcfeaDeCEH71w2y4WL7CrpwegAOtqhGEUji5hbXyBRTg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781982929; c=relaxed/simple; bh=VFBwOlnqefXRtkqyWJWmvbxNXf55m3uapOuWCpXfuwU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=J/TfkoBMZ0lGCYw6wIuVgjteyEb/DJP86PdMlhSWwHTppk5fFg+gGinHMSdkRLlyRvVY7GHnFt2/S/Obx+5LWNbHyV70KPjUhhvMQyGGstxSOqPD+yv5Bf2xG1OJD3tu7+oFpupEVIsB8MwhJxFcHvx9zQy8AT8Jdw/4FK5hig4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bGC0wRQz; arc=none smtp.client-ip=209.85.214.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bGC0wRQz" Received: by mail-pl1-f169.google.com with SMTP id d9443c01a7336-2c6bb8a5980so21494575ad.2 for ; Sat, 20 Jun 2026 12:15:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781982927; x=1782587727; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=q2LUf4/h3bsaXpFBm9VmVxZv5sbzexG6A7SGGqxs2XA=; b=bGC0wRQzYXFfNx6iiEG7621vyjvBaD9+/0f2RWOJpYeJFs/OPkBdWahPYc9KZB2Z+S PdxWkeMXq+RqwO4Xa9aGKMoEReP7dvALo9mqtas+Q9hIDSZ+2/RQdKaJNDM4c68eARxG A4GtvSUAN9gYuxWVG8ZXJ5djuhG+XtuQa3GBidxdOliWKFnE1bto8YLMumva2Yxpoxv+ Vx4mn7+4tGEyp58BWS/mRee0kyZ2O0zJ8UOcrjGU4G5ubdiCM9Bsnz41zyRG3DGPg+m0 XedcyA23PKdFOPAbR4B6nucCIOgmkZeGlL0jbY7cAso2ymUjLaaTeJzJkVoq2IL/hH/O h9kA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781982927; x=1782587727; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=q2LUf4/h3bsaXpFBm9VmVxZv5sbzexG6A7SGGqxs2XA=; b=CYaCsaXPs6yza954HmTzaEIQkEN+o2Uy+NW3elYQBYWQRe29Q1OWaEnNpVVumT0AwK E3nDz65Y8mTDGao/5KwNtRqFeCotSkqfajw+oLorqu/cgTJQqXFNrR14mCvtkyi/0FEc hZ4yO0Cs8uvhmVblbf1RIGNnjmCrIiLutoT5QIbfE3YRtFPROLXOzQUNWwgsym36rqKo FLFDurVqLjwxGOBHyXO8T9KVQGk4yv6yc97thgXOSF1FsAiuaJaU1AugwoyMa0P3Hl80 McJ8s4ZH0o1iGio5dyYkaRRhG3/eSbQIHvca6iyboEyC7Vt2PnBUOfspVtJLR+Akyoy4 uHWA== X-Forwarded-Encrypted: i=1; AHgh+RooeGunuG1v40T0gdxwljCcAqwf0SYbkdhA9ZGqr4JvL32to7R3254qRX5GVvBon5eYhI99j3wtRzyaIeM=@vger.kernel.org X-Gm-Message-State: AOJu0Yy/v3l5fgN416Z0pMI/GMzcW8rYcP1csILINeddEMvY/qFqnH1y eZ21+iYYZ/tc6+hd23ETu5JMSAX89iIl3mpP4RYFT+FEoLymLethFmlTDJ5KVHYn X-Gm-Gg: AfdE7ckMpNPMTcOp3fjThlXNzru626CU/tKapwhJ5iW5V6176UhoMh7GnA+UAx2MwCs rg8Ihju9QJtkMjSnbe7ANrq3SQZki611s8MjUqkqu6gIiEDwCzAMU87iTF9x8tyrtuVi4eXJ7w7 v8AJ+8bcxgq7GJPSS64mCcO2ej18PolonZtXsz1bqCAQMX9xYHikj0kSqTLeV9SU6NB3fTvSP2V MZSMjJy6pF93Q5/sXUslfPP/yXOscbDEsdjX9zRgu1CCcDGh77YLPo7brO8HxNG9zLB9EeUrTDG pRXduf4po2w2H9/Ch+jO0WxsnP0cF8juVpdqhghwBunPuPanUMsFvA9ZsK1aFF6K+2C7Vm2tsY8 nsfrL/BT2BG08QJCadwnNmtnEelo56/Ky4EbVzjlV9mccc/aDnl76r1NUGyi4+78xUOxBV7XR9S Qm7vVKFzKCXDoerdAZywR3QXTnk5yx1YkPrxnuKxxzEA== X-Received: by 2002:a17:903:2b0c:b0:2c0:cb0e:ac42 with SMTP id d9443c01a7336-2c718f201dfmr89775985ad.3.1781982926862; Sat, 20 Jun 2026 12:15:26 -0700 (PDT) Received: from localhost.localdomain ([49.207.234.96]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c7439f8cfbsm29450665ad.45.2026.06.20.12.15.23 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sat, 20 Jun 2026 12:15:26 -0700 (PDT) From: Biren Pandya To: Hans Verkuil , Mauro Carvalho Chehab , Kees Cook , linux-media@vger.kernel.org (open list:CEC FRAMEWORK), linux-kernel@vger.kernel.org (open list) Cc: Biren Pandya , syzbot+051024d603432b4ab395@syzkaller.appspotmail.com Subject: [PATCH] media: cec: cancel delayed work before freeing an interrupted transmit Date: Sun, 21 Jun 2026 00:45:13 +0530 Message-ID: <20260620191515.50238-2-birenpandya@gmail.com> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(), the previous cancel_delayed_work_sync() could race with the CEC kthread, which might re-arm the timeout *after* the cancel completes. This leads to freeing active delayed_work and an ODEBUG warning. Fix this by cancelling the delayed work only after removing the data from the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop adap->lock around the synchronous cancel to avoid deadlocking with cec_wait_timeout(). Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work") Reported-by: syzbot+051024d603432b4ab395@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395 Signed-off-by: Biren Pandya --- drivers/media/cec/core/cec-adap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c index 8f7244ac1d43..50bd8bbeb5a5 100644 --- a/drivers/media/cec/core/cec-adap.c +++ b/drivers/media/cec/core/cec-adap.c @@ -965,7 +965,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, */ mutex_unlock(&adap->lock); err = wait_for_completion_killable(&data->c); - cancel_delayed_work_sync(&data->work); mutex_lock(&adap->lock); if (err) @@ -985,6 +984,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, list_del(&data->list); if (WARN_ON(!list_empty(&data->xfer_list))) list_del(&data->xfer_list); + + if (!cancel_delayed_work(&data->work)) { + mutex_unlock(&adap->lock); + cancel_delayed_work_sync(&data->work); + mutex_lock(&adap->lock); + } + kfree(data); return 0; } -- 2.50.1