From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f199.google.com (mail-pf1-f199.google.com [209.85.210.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D22533BE644 for ; Tue, 28 Jul 2026 20:24:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785270278; cv=none; b=TGUAcZokTATzJmlmqeDloJvbBLkOOK6AUdcQQeujqs7zF/RMLO2h9kLmPOiplKBBmfItpTZioMVOjhW5hPOKodcJdhcr6xuhO7AMS9XOySF2j7jmOi171SG5w2O18wB6zazps1OlBj8IXfVsueQlJW4/XdNbniSLt88uJ74coR0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785270278; c=relaxed/simple; bh=0C8Tq5YfGX8WpFK4ZOwqBmOj+yCq8Q83lfGoQo9S19Q=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=nrD5+gDh6pPedglRF7/nAlFpvz63W6uD3ayOof8pbyhaAMOYlRUUzIQTMjFE/h7qHtv797avyQn/UaYVSefOST+ZlcJ5prhpAX7yPwV4xj6Zybhpk8wwojylYzWElTwOrdsgm4wG9TbWVvcU6mJep3W6LIuck7H2+dZgzKxuLlg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--sonalipradhan.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=h5DSyVsw; arc=none smtp.client-ip=209.85.210.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--sonalipradhan.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="h5DSyVsw" Received: by mail-pf1-f199.google.com with SMTP id d2e1a72fcca58-848474825ffso248633b3a.0 for ; Tue, 28 Jul 2026 13:24:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1785270276; x=1785875076; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=jvfS7+DfF3iiBgb3oPyQP0D1CeHx3J7Dwnq1yIu+FCg=; b=h5DSyVswgNLoFDI8Yj57klgLR8G1gVjao8L2ooqeEfT1uV9aT3sCKqdj9q6aWx+tHk 9zRRL7x4FHlgYqwEmoQ1e6ixT8+oUYsiSPKHcHe+/pQJgUChRDPqGt1tdKD0Y+Dao+Qu zixw1kKj3BqzSC5+XNh5EAHGYdR2QfETCEysGuIM1RZNEVsKIOh6yBgNVegRVMgMf1DC HseoJb935ofH67LjyRZRQUi5m36PfGL8VX/V6kSWdv9JHPWCb3u2xvk3tRVGDXPj4+ms hhmnlrv5t7KGjDLIOgp884eBGzK4ES0RLWiOdTm0K36b9V8D38tGdVnzINYpaiph7p2g 54nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785270276; x=1785875076; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=jvfS7+DfF3iiBgb3oPyQP0D1CeHx3J7Dwnq1yIu+FCg=; b=LvZbfYUoOVrns9jZC5K0D+JbFkQryjwwxJJldFUMAiPwwp14tsVo26ohEayQYXLubf MZoH7/qyUF30xFyCIPQW+cD2oNZXckUa903ANomtO8isNkMT1d16e6goyM6MuwB1ojeR /WckOyvPHfqMHmcw7QOiRumQY8WsEj0EwF0fj9eZN4s9sVfmeEMAF8YUidhsk9KYahmK WDd3UwvtyaqNWfZQhFNRiCet5DEK59YbdQaJrR2lirGfNjSNGZAP3r3bU+4R3F8Rt3OO 1hGmeRsDZ3sNyLGGPzmqOxxpO52YH2NuUVCo7YTDBcjHA7sGAvbNDT3UNcWL8HfAzzar sApA== X-Forwarded-Encrypted: i=1; AHgh+RoFNYyNK1akwdxDmBi6abjondr1OHR3LVwr7RGlC8aCTou1IVPtt5l4Cn8lwSfjrT9fIu5ZY4FZCMDWL48=@vger.kernel.org X-Gm-Message-State: AOJu0YyMxPmf9bBLmnPrJ9zHq/f7T05fdSscCzfkoxqCE9znnwDrQ9uQ yG+vW/Wt7QOCJx5Pm1ypAcXDEHVJWH09IH07cUBfR2Vlc1NXxx1745R8X3m+oZ8Vs1NY96Nf5XW Ty0j/uyVTnZkO22FgAdO4WcYLzKS5KsT3rw== X-Received: from pfih13.prod.google.com ([2002:a05:6a00:218d:b0:84a:2e3e:e52c]) (user=sonalipradhan job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:4ac8:b0:846:5d1f:56d4 with SMTP id d2e1a72fcca58-84e931249cdmr3727958b3a.14.1785270275858; Tue, 28 Jul 2026 13:24:35 -0700 (PDT) Date: Tue, 28 Jul 2026 20:24:32 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.55.0.487.gaf234c4eb3-goog Message-ID: <20260728202432.2354994-1-sonalipradhan@google.com> Subject: [PATCH] ALSA: usb-audio: Clamp frame size in implicit-feedback mode From: Sonali Pradhan To: Takashi Iwai , Jaroslav Kysela Cc: Eldad Zack , Gordon Chen , Kees Cook , Jussi Laako , linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Sonali Pradhan Content-Type: text/plain; charset="UTF-8" snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue. Fixes: 28acb12014fb ("ALSA: usb-audio: use sender stride for implicit feedback") Cc: stable@vger.kernel.org Assisted-by: Jetski:Gemini-3.6-Flash Signed-off-by: Sonali Pradhan --- sound/usb/endpoint.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c index 24cd7692bd01..f127eaf2a1ae 100644 --- a/sound/usb/endpoint.c +++ b/sound/usb/endpoint.c @@ -1817,11 +1817,13 @@ static void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep, out_packet->packets = in_ctx->packets; for (i = 0; i < in_ctx->packets; i++) { - if (urb->iso_frame_desc[i].status == 0) - out_packet->packet_size[i] = + if (urb->iso_frame_desc[i].status == 0) { + unsigned int frames = urb->iso_frame_desc[i].actual_length / sender->stride; - else + out_packet->packet_size[i] = min(frames, ep->maxframesize); + } else { out_packet->packet_size[i] = 0; + } } spin_unlock_irqrestore(&ep->lock, flags); -- 2.55.0.487.gaf234c4eb3-goog