ALSA: timer: Reject user params with too small ticks

BugLink: http://bugs.launchpad.net/bugs/1673538
commit 71321eb3f2d0df4e6c327e0b936eec4458a12054 upstream.

When a user sets a too small ticks with a fine-grained timer like
hrtimer, the kernel tries to fire up the timer irq too frequently.
This may lead to the condensed locks, eventually the kernel spinlock
lockup with warnings.

For avoiding such a situation, we define a lower limit of the
resolution, namely 1ms.  When the user passes a too small tick value
that results in less than that, the kernel returns -EINVAL now.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

diff --git a/sound/core/timer.c b/sound/core/timer.c
index ae4ea2e2e7fee752bc478846cc32e445d8e5f642..278a332f97bdeeb2df12ec6cdd72ad2e3ba5d4d2 100644 (file)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1700,9 +1700,21 @@ static int snd_timer_user_params(struct file *file,
                return -EBADFD;
        if (copy_from_user(&params, _params, sizeof(params)))
                return -EFAULT;
-       if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE) && params.ticks < 1) {
-               err = -EINVAL;
-               goto _end;
+       if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
+               u64 resolution;
+
+               if (params.ticks < 1) {
+                       err = -EINVAL;
+                       goto _end;
+               }
+
+               /* Don't allow resolution less than 1ms */
+               resolution = snd_timer_resolution(tu->timeri);
+               resolution *= params.ticks;
+               if (resolution < 1000000) {
+                       err = -EINVAL;
+                       goto _end;
+               }
        }
        if (params.queue_size > 0 &&
            (params.queue_size < 32 || params.queue_size > 1024)) {