[PATCH v2] ALSA: linear: Check frame count for all channels

[PATCH v2] ALSA: linear: Check frame count for all channels

[Sreeraj S Kurup]

linear_transfer() checks the available frame count only for
the first destination channel.

Check the available frame count of all source and destination
channels before converting samples.

Use the smallest available frame count to make sure that
conversion does not read or write beyond the channel buffers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
v2:
  Add missing mailing-list recipients

 sound/core/oss/linear.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sound/core/oss/linear.c b/sound/core/oss/linear.c
index 6e51cfdca238..7765ac0ec400 100644
--- a/sound/core/oss/linear.c
+++ b/sound/core/oss/linear.c
@@ -6,6 +6,7 @@
  */
 
 #include <linux/time.h>
+#include <linux/minmax.h>
 #include <sound/core.h>
 #include <sound/pcm.h>
 #include "pcm_plugin.h"
@@ -75,6 +76,8 @@ static snd_pcm_sframes_t linear_transfer(struct snd_pcm_plugin *plugin,
 			       struct snd_pcm_plugin_channel *dst_channels,
 			       snd_pcm_uframes_t frames)
 {
+	unsigned int channel;
+
 	if (snd_BUG_ON(!plugin || !src_channels || !dst_channels))
 		return -ENXIO;
 	if (frames == 0)
@@ -92,8 +95,12 @@ static snd_pcm_sframes_t linear_transfer(struct snd_pcm_plugin *plugin,
 		}
 	}
 #endif
-	if (frames > dst_channels[0].frames)
-		frames = dst_channels[0].frames;
+	for (channel = 0; channel < plugin->src_format.channels; channel++) {
+		frames = min(frames, src_channels[channel].frames);
+
+		frames = min(frames, dst_channels[channel].frames);
+	}
+
 	convert(plugin, src_channels, dst_channels, frames);
 	return frames;
 }
-- 
2.55.0

Re: [PATCH v2] ALSA: linear: Check frame count for all channels

[Takashi Iwai]

On Thu, 05 Nov 2026 15:22:26 +0100,
Sreeraj S Kurup wrote:
> 
> linear_transfer() checks the available frame count only for
> the first destination channel.
> 
> Check the available frame count of all source and destination
> channels before converting samples.
> 
> Use the smallest available frame count to make sure that
> conversion does not read or write beyond the channel buffers.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>

Well, the number of the processed frames must be identical for all
channels.  So this is superfluous.

Or, do you see any real case hitting this?


thanks,

Takashi