Patch "ALSA: timer: Reject user params with too small ticks" has been added to the 4.9-stable tree

[<gregkh@xxxxxxxxxxxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ALSA: timer: Reject user params with too small ticks

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-timer-reject-user-params-with-too-small-ticks.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From 71321eb3f2d0df4e6c327e0b936eec4458a12054 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@xxxxxxx>
Date: Tue, 28 Feb 2017 14:49:07 +0100
Subject: ALSA: timer: Reject user params with too small ticks

From: Takashi Iwai <tiwai@xxxxxxx>

commit 71321eb3f2d0df4e6c327e0b936eec4458a12054 upstream.

When a user sets a too small ticks with a fine-grained timer like
hrtimer, the kernel tries to fire up the timer irq too frequently.
This may lead to the condensed locks, eventually the kernel spinlock
lockup with warnings.

For avoiding such a situation, we define a lower limit of the
resolution, namely 1ms.  When the user passes a too small tick value
that results in less than that, the kernel returns -EINVAL now.

Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

---
 sound/core/timer.c |   18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1702,9 +1702,21 @@ static int snd_timer_user_params(struct
 		return -EBADFD;
 	if (copy_from_user(&params, _params, sizeof(params)))
 		return -EFAULT;
-	if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE) && params.ticks < 1) {
-		err = -EINVAL;
-		goto _end;
+	if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
+		u64 resolution;
+
+		if (params.ticks < 1) {
+			err = -EINVAL;
+			goto _end;
+		}
+
+		/* Don't allow resolution less than 1ms */
+		resolution = snd_timer_resolution(tu->timeri);
+		resolution *= params.ticks;
+		if (resolution < 1000000) {
+			err = -EINVAL;
+			goto _end;
+		}
 	}
 	if (params.queue_size > 0 &&
 	    (params.queue_size < 32 || params.queue_size > 1024)) {


Patches currently in stable-queue which might be from tiwai@xxxxxxx are

queue-4.9/alsa-hda-add-subwoofer-support-for-dell-inspiron-17-7000-gaming.patch
queue-4.9/alsa-seq-fix-link-corruption-by-event-error-handling.patch
queue-4.9/alsa-hda-fix-micmute-hotkey-problem-for-a-lenovo-aio-machine.patch
queue-4.9/alsa-ctxfi-fallback-dma-mask-to-32bit.patch
queue-4.9/alsa-timer-reject-user-params-with-too-small-ticks.patch
queue-4.9/alsa-hda-fix-lewisburg-audio-issue.patch
queue-4.9/alsa-hda-realtek-cannot-adjust-speaker-s-volume-on-a-dell-aio.patch