lkml.org 
[lkml]   [2016]   [Sep]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 185/192] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Vegard Nossum <vegard.nossum@oracle.com>

    commit 6b760bb2c63a9e322c0e4a0b5daf335ad93d5a33 upstream.

    I got this:

    divide error: 0000 [#1] PREEMPT SMP KASAN
    CPU: 1 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #189
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
    task: ffff8801120a9580 task.stack: ffff8801120b0000
    RIP: 0010:[<ffffffff82c8bd9a>] [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0
    RSP: 0018:ffff88011aa87da8 EFLAGS: 00010006
    RAX: 0000000000004f76 RBX: ffff880112655e88 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffff880112655ea0 RDI: 0000000000000001
    RBP: ffff88011aa87e00 R08: ffff88013fff905c R09: ffff88013fff9048
    R10: ffff88013fff9050 R11: 00000001050a7b8c R12: ffff880114778a00
    R13: ffff880114778ab4 R14: ffff880114778b30 R15: 0000000000000000
    FS: 00007f071647c700(0000) GS:ffff88011aa80000(0000) knlGS:0000000000000000
    CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000603001 CR3: 0000000112021000 CR4: 00000000000006e0
    Stack:
    0000000000000000 ffff880114778ab8 ffff880112655ea0 0000000000004f76
    ffff880112655ec8 ffff880112655e80 ffff880112655e88 ffff88011aa98fc0
    00000000b97ccf2b dffffc0000000000 ffff88011aa98fc0 ffff88011aa87ef0
    Call Trace:
    <IRQ>
    [<ffffffff813abce7>] __hrtimer_run_queues+0x347/0xa00
    [<ffffffff82c8bbc0>] ? snd_hrtimer_close+0x130/0x130
    [<ffffffff813ab9a0>] ? retrigger_next_event+0x1b0/0x1b0
    [<ffffffff813ae1a6>] ? hrtimer_interrupt+0x136/0x4b0
    [<ffffffff813ae220>] hrtimer_interrupt+0x1b0/0x4b0
    [<ffffffff8120f91e>] local_apic_timer_interrupt+0x6e/0xf0
    [<ffffffff81227ad3>] ? kvm_guest_apic_eoi_write+0x13/0xc0
    [<ffffffff83c35086>] smp_apic_timer_interrupt+0x76/0xa0
    [<ffffffff83c3416c>] apic_timer_interrupt+0x8c/0xa0
    <EOI>
    [<ffffffff83c3239c>] ? _raw_spin_unlock_irqrestore+0x2c/0x60
    [<ffffffff82c8185d>] snd_timer_start1+0xdd/0x670
    [<ffffffff82c87015>] snd_timer_continue+0x45/0x80
    [<ffffffff82c88100>] snd_timer_user_ioctl+0x1030/0x2830
    [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430
    [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80
    [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90
    [<ffffffff815aa4f8>] ? handle_mm_fault+0xbc8/0x27f0
    [<ffffffff815a9930>] ? __pmd_alloc+0x370/0x370
    [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80
    [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050
    [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200
    [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0
    [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0
    [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190
    [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0
    [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0
    [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0
    [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050
    [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0
    [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25
    Code: e8 fc 42 7b fe 8b 0d 06 8a 50 03 49 0f af cf 48 85 c9 0f 88 7c 01 00 00 48 89 4d a8 e8 e0 42 7b fe 48 8b 45 c0 48 8b 4d a8 48 99 <48> f7 f9 49 01 c7 e8 cb 42 7b fe 48 8b 55 d0 48 b8 00 00 00 00
    RIP [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0
    RSP <ffff88011aa87da8>
    ---[ end trace 6aa380f756a21074 ]---

    The problem happens when you call ioctl(SNDRV_TIMER_IOCTL_CONTINUE) on a
    completely new/unused timer -- it will have ->sticks == 0, which causes a
    divide by 0 in snd_hrtimer_callback().

    Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/core/timer.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/sound/core/timer.c
    +++ b/sound/core/timer.c
    @@ -837,6 +837,7 @@ int snd_timer_new(struct snd_card *card,
    timer->tmr_subdevice = tid->subdevice;
    if (id)
    strlcpy(timer->id, id, sizeof(timer->id));
    + timer->sticks = 1;
    INIT_LIST_HEAD(&timer->device_list);
    INIT_LIST_HEAD(&timer->open_list_head);
    INIT_LIST_HEAD(&timer->active_list_head);

    \
     
     \ /
      Last update: 2016-09-17 09:59    [W:3.538 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site