5.15-stable patches

added patches:
	alsa-timer-set-lower-bound-of-start-tick-time.patch

diff --git a/queue-5.15/alsa-timer-set-lower-bound-of-start-tick-time.patch b/queue-5.15/alsa-timer-set-lower-bound-of-start-tick-time.patch
new file mode 100644 (file)
index 0000000..cd4505a
--- /dev/null
+++ b/queue-5.15/alsa-timer-set-lower-bound-of-start-tick-time.patch
@@ -0,0 +1,53 @@
+From 4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 14 May 2024 20:27:36 +0200
+Subject: ALSA: timer: Set lower bound of start tick time
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e upstream.
+
+Currently ALSA timer doesn't have the lower limit of the start tick
+time, and it allows a very small size, e.g. 1 tick with 1ns resolution
+for hrtimer.  Such a situation may lead to an unexpected RCU stall,
+where  the callback repeatedly queuing the expire update, as reported
+by fuzzer.
+
+This patch introduces a sanity check of the timer start tick time, so
+that the system returns an error when a too small start size is set.
+As of this patch, the lower limit is hard-coded to 100us, which is
+small enough but can still work somehow.
+
+Reported-by: syzbot+43120c2af6ca2938cc38@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/r/000000000000fa00a1061740ab6d@google.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20240514182745.4015-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+[ backport note: the error handling is changed, as the original commit
+  is based on the recent cleanup with guard() in commit beb45974dd49
+  -- tiwai ]
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/timer.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -553,6 +553,16 @@ static int snd_timer_start1(struct snd_t
+               goto unlock;
+       }
+ 
++      /* check the actual time for the start tick;
++       * bail out as error if it's way too low (< 100us)
++       */
++      if (start) {
++              if ((u64)snd_timer_hw_resolution(timer) * ticks < 100000) {
++                      result = -EINVAL;
++                      goto unlock;
++              }
++      }
++
+       if (start)
+               timeri->ticks = timeri->cticks = ticks;
+       else if (!timeri->cticks)

diff --git a/queue-5.15/series b/queue-5.15/series
index 7bed71eb0e4c7f01f7ac83ffed8466d368b483b1..aa2a7c44a779bc7b01d529c2aa0bec022402c543 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -334,3 +334,4 @@ net-ena-fix-redundant-device-numa-node-override.patch
 ipvlan-dont-use-skb-sk-in-ipvlan_process_v-4-6-_outb.patch
 powerpc-uaccess-use-yz-asm-constraint-for-ld.patch
 hwmon-shtc1-fix-property-misspelling.patch
+alsa-timer-set-lower-bound-of-start-tick-time.patch