Re: [PATCH] media: cec: cancel delayed work before freeing an interrupted transmit

[syzbot]

> If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(),
> the previous cancel_delayed_work_sync() could race with the CEC kthread,
> which might re-arm the timeout *after* the cancel completes. This leads
> to freeing active delayed_work and an ODEBUG warning.
>
> Fix this by cancelling the delayed work only after removing the data from
> the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop
> adap->lock around the synchronous cancel to avoid deadlocking with
> cec_wait_timeout().
>
> Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
> Reported-by: syzbot+051024...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395
> Cc: sta...@vger.kernel.org
> Signed-off-by: Biren Pandya <biren...@gmail.com>
> ---
> #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

This crash does not have a reproducer. I cannot test it.

> drivers/media/cec/core/cec-adap.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> index 8f7244ac1d43..50bd8bbeb5a5 100644
> --- a/drivers/media/cec/core/cec-adap.c
> +++ b/drivers/media/cec/core/cec-adap.c
> @@ -965,7 +965,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
> */
> mutex_unlock(&adap->lock);
> err = wait_for_completion_killable(&data->c);
> - cancel_delayed_work_sync(&data->work);
> mutex_lock(&adap->lock);
>
> if (err)
> @@ -985,6 +984,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
> list_del(&data->list);
> if (WARN_ON(!list_empty(&data->xfer_list)))
> list_del(&data->xfer_list);
> +
> + if (!cancel_delayed_work(&data->work)) {
> + mutex_unlock(&adap->lock);
> + cancel_delayed_work_sync(&data->work);
> + mutex_lock(&adap->lock);
> + }
> +
> kfree(data);
> return 0;
> }
> --
> 2.50.1

[Hillf Danton]

On Sun, 21 Jun 2026 00:45:13 +0530 Biren Pandya wrote:
> If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(),
> the previous cancel_delayed_work_sync() could race with the CEC kthread,
> which might re-arm the timeout *after* the cancel completes. This leads
> to freeing active delayed_work and an ODEBUG warning.
>

Given no specifying how it is armed again after cancel, re-arm in general is
handled by disabling the work item before cancel.

> Fix this by cancelling the delayed work only after removing the data from
> the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop
> adap->lock around the synchronous cancel to avoid deadlocking with
> cec_wait_timeout().
>
> Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
> Reported-by: syzbot+051024...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395

> Signed-off-by: Biren Pandya <biren...@gmail.com>
> ---