[PATCH] media: cec: cancel delayed work before freeing an interrupted transmit

[Biren Pandya]

If wait_for_completion_killable() is interrupted in cec_transmit_msg_fh(),
the previous cancel_delayed_work_sync() could race with the CEC kthread,
which might re-arm the timeout *after* the cancel completes. This leads
to freeing active delayed_work and an ODEBUG warning.

Fix this by cancelling the delayed work only after removing the data from
the transmit and wait queues, ensuring the kthread cannot re-arm it. Drop
adap->lock around the synchronous cancel to avoid deadlocking with
cec_wait_timeout().

Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work")
Reported-by: syzbot+051024d603432b4ab395@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395
Signed-off-by: Biren Pandya <birenpandya@xxxxxxxxx>
---
 drivers/media/cec/core/cec-adap.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
index 8f7244ac1d43..50bd8bbeb5a5 100644
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -965,7 +965,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 	 */
 	mutex_unlock(&adap->lock);
 	err = wait_for_completion_killable(&data->c);
-	cancel_delayed_work_sync(&data->work);
 	mutex_lock(&adap->lock);
 
 	if (err)
@@ -985,6 +984,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 		list_del(&data->list);
 	if (WARN_ON(!list_empty(&data->xfer_list)))
 		list_del(&data->xfer_list);
+
+	if (!cancel_delayed_work(&data->work)) {
+		mutex_unlock(&adap->lock);
+		cancel_delayed_work_sync(&data->work);
+		mutex_lock(&adap->lock);
+	}
+
 	kfree(data);
 	return 0;
 }
-- 
2.50.1