Re: [PATCH v4 0/2] ALSA: usx2y: Bound the PCM buffer by the URB size

[Takashi Iwai <tiwai@suse.de>]

On Wed, 04 Nov 2026 13:21:52 +0100,
Sinan Turunc wrote:
> 
> v4 of the usx2y buffer fix. Patch 1 changes only its comments and the
> nrpacks note in the changelog. Patch 2 now also sizes the playback ISO
> descriptors from whole frames, after the review of v3 found that they
> were filled from the raw capture actual_length while
> transfer_buffer_length used whole frames, and gives the maxpacksize
> check its own message.
> 
> Patch 1 replaces the two-packet BUFFER_BYTES bound of v2 with a
> two-URB BUFFER_SIZE bound in frames that does not read the endpoint,
> and keeps the capture drop guard. Patch 2 adds guards in the playback
> prepare path for a URB larger than the buffer and a packet larger than
> the playback endpoint's maxpacksize, and sizes each descriptor as
> counts * stride, all pre-existing and unchecked.
> 
> Tested on 7.3-rc7 with a USB/IP device presenting the US-122 interface
> layout. The playback case of patch 2 reproduces on the unpatched driver
> with ordinary 48-frame packets and a 100-frame buffer, which the stock
> constraints allow. With both patches, buffers below the bound are
> refused at hw_params and 400-frame buffers stream in both directions
> with no KASAN report, for S16_LE and, on capture, S24_3LE. With
> 195-byte capture packets the descriptor sizing of patch 2 shows through
> USB/IP's completion check, which refused the v3 URBs (descriptors of
> 780 bytes for 768 bytes of data) and accepts the v4 ones. The results
> are in the patch messages.
> 
> Sinan Turunc (2):
>   ALSA: usx2y: Require a buffer of two URBs
>   ALSA: usx2y: Guard the playback copy

Applied both patches now.  Thanks.


Takashi