Re: [PATCH v2] ALSA: usx2y: Reject buffers smaller than two packets

[Sinan Turunc <enscrpt@pm.me>]

On Wed, 04 Nov 2026 08:34:19 +0100,
Takashi Iwai wrote:
> ... and I noticed Sashiko warnings now, so dropped again from the
> queue. Could you verify whether those complaints are valid or not?

Yes, both are valid.

The critical one: usx2y_urb_play_prepare() copies a whole URB of
nr_of_packs() packets out of the ring buffer with a single wrap, so with
a buffer smaller than one URB the copy reads past the end of the buffer,
and on a later URB the length goes negative and memcpy() gets a huge
size. This is pre-existing. The stock constraints allow a buffer of two
1 ms periods, below one default URB of up to 200 frames. On 7.3-rc7,
with 48-frame packets, inside the 43 to 50 frames the driver accepts,
and a 100-frame playback buffer, KASAN reports:

  BUG: KASAN: out-of-bounds in i_usx2y_urb_complete+0x79b/0x1ac0
  Read of size 18446744073709551280 at addr ffff88800e6b02e0 by task vhci_rx/80

v2 did not cause it, but its two-packet bound and its comment did not
cover it.

The medium one: v2 read usb_maxpacket() in snd_usx2y_pcm_open(), before
usx2y_format_set() selects the altsetting in prepare, so the bound could
be stale or 0. The capture copy stayed safe through its per-packet check
against runtime->buffer_size; only the bound was unreliable.

v3 replaces the byte bound with a frame bound of two URBs,
2 * nr_of_packs() * 50, which does not depend on the altsetting, and
adds the playback guards as a separate patch. It follows as a two-patch
series. Tested on 7.3-rc7 with an emulated US-122: buffers below the
bound are refused at hw_params, and 400-frame buffers stream in both
directions for S16_LE and on capture for S24_3LE, with no KASAN report.

Thanks,
Sinan