Re: [PATCH] ALSA: seq: Fix division by zero in initialize_timer()

[Takashi Iwai <tiwai@suse.de>]

On Sat, 25 Jul 2026 08:33:45 +0200,
Norbert Szetei wrote:
> 
> A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set
> the backing snd_timer's hardware resolution to an arbitrary 64-bit value
> via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.
> 
> When such a timer is bound to a sequencer queue, initialize_timer()
> computes the tick period as
> 
> 	tmr->ticks = 1000000000 / (r * freq);
> 
> where r is that user-controlled resolution and freq is the sequencer
> update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).
> A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for
> any even freq, including DEFAULT_FREQUENCY (1000), so the division faults
> with a divide-by-zero.
> 
> The division runs under tmr->lock with interrupts disabled, so the oops
> leaves the spinlock held and hangs the CPU. It is reachable by an
> unprivileged user with access to /dev/snd/timer and /dev/snd/seq.
> 
>   Oops: divide error: 0000 [#1] SMP KASAN PTI
>   CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+
>   RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0
>    snd_seq_timer_start+0x15e/0x2b0
>    snd_seq_control_queue+0x56f/0xba0
>    snd_seq_write+0x3e0/0x730
> 
> Reject an overflowing product with check_mul_overflow() and fall back to
> a single tick, which also avoids feeding a wrapped-but-nonzero divisor
> (e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small
> value) into the period computation.
> 
> Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
> Cc: <stable@vger.kernel.org>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Norbert Szetei <norbert@doyensec.com>

Thanks, applied now.


Takashi