[PATCH] ALSA: seq: Fix division by zero in initialize_timer()

[PATCH] ALSA: seq: Fix division by zero in initialize_timer()

[Norbert Szetei]

A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set
the backing snd_timer's hardware resolution to an arbitrary 64-bit value
via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.

When such a timer is bound to a sequencer queue, initialize_timer()
computes the tick period as

	tmr->ticks = 1000000000 / (r * freq);

where r is that user-controlled resolution and freq is the sequencer
update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).
A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for
any even freq, including DEFAULT_FREQUENCY (1000), so the division faults
with a divide-by-zero.

The division runs under tmr->lock with interrupts disabled, so the oops
leaves the spinlock held and hangs the CPU. It is reachable by an
unprivileged user with access to /dev/snd/timer and /dev/snd/seq.

  Oops: divide error: 0000 [#1] SMP KASAN PTI
  CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+
  RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0
   snd_seq_timer_start+0x15e/0x2b0
   snd_seq_control_queue+0x56f/0xba0
   snd_seq_write+0x3e0/0x730

Reject an overflowing product with check_mul_overflow() and fall back to
a single tick, which also avoids feeding a wrapped-but-nonzero divisor
(e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small
value) into the period computation.

Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
Cc: <stable@vger.kernel.org>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
---
diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
index 419288eec4bb..7b671e270ef4 100644
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -362,11 +362,10 @@ static int initialize_timer(struct snd_seq_timer *tmr)
 	tmr->ticks = 1;
 	if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) {
 		unsigned long r = snd_timer_resolution(tmr->timeri);
-		if (r) {
-			tmr->ticks = (unsigned int)(1000000000uL / (r * freq));
-			if (! tmr->ticks)
-				tmr->ticks = 1;
-		}
+		unsigned long den;
+
+		if (r && !check_mul_overflow(r, freq, &den))
+			tmr->ticks = max(1U, (unsigned int)(1000000000uL / den));
 	}
 	tmr->initialized = 1;
 	return 0;
-- 
2.55.0

Re: [PATCH] ALSA: seq: Fix division by zero in initialize_timer()

[Takashi Iwai]

On Sat, 25 Jul 2026 08:33:45 +0200,
Norbert Szetei wrote:
> 
> A userspace-driven ALSA timer (SND_UTIMER) lets an unprivileged user set
> the backing snd_timer's hardware resolution to an arbitrary 64-bit value
> via SNDRV_TIMER_IOCTL_CREATE. snd_utimer_create() only rejects zero.
> 
> When such a timer is bound to a sequencer queue, initialize_timer()
> computes the tick period as
> 
> 	tmr->ticks = 1000000000 / (r * freq);
> 
> where r is that user-controlled resolution and freq is the sequencer
> update rate in Hz, clamped to MIN_FREQUENCY..MAX_FREQUENCY (10..6250).
> A resolution of 2^63 makes the 64-bit product r * freq wrap to zero for
> any even freq, including DEFAULT_FREQUENCY (1000), so the division faults
> with a divide-by-zero.
> 
> The division runs under tmr->lock with interrupts disabled, so the oops
> leaves the spinlock held and hangs the CPU. It is reachable by an
> unprivileged user with access to /dev/snd/timer and /dev/snd/seq.
> 
>   Oops: divide error: 0000 [#1] SMP KASAN PTI
>   CPU: 7 UID: 1000 PID: 456 Comm: alsa_seq_utimer Not tainted 7.2.0-rc4+
>   RIP: 0010:initialize_timer.constprop.0+0x20a/0x2d0
>    snd_seq_timer_start+0x15e/0x2b0
>    snd_seq_control_queue+0x56f/0xba0
>    snd_seq_write+0x3e0/0x730
> 
> Reject an overflowing product with check_mul_overflow() and fall back to
> a single tick, which also avoids feeding a wrapped-but-nonzero divisor
> (e.g. 2^63 * 1000 mod 2^64 == 0, or other resolutions wrapping to a small
> value) into the period computation.
> 
> Fixes: 37745918e0e7 ("ALSA: timer: Introduce virtual userspace-driven timers")
> Cc: <stable@vger.kernel.org>
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Norbert Szetei <norbert@doyensec.com>

Thanks, applied now.


Takashi