Re: [PATCH v2] ALSA: usx2y: Reject buffers smaller than two packets

[Takashi Iwai <tiwai@suse.de>]

On Tue, 03 Nov 2026 14:23:03 +0100,
Sinan Turunc wrote:
> 
> usx2y_urb_capt_retire() splits the copy into the ALSA ring buffer once
> at the buffer end and wraps hwptr_done once, which is only correct when
> one packet holds at most buffer_size frames. The packet size is the
> endpoint's maxpacksize from usb_maxpacket(), while the hw constraints
> allow 64-byte periods with periods_min 2, so a packet can be larger than
> the whole buffer.
> 
> The endpoint is known at probe time, so constrain
> SNDRV_PCM_HW_PARAM_BUFFER_BYTES in snd_usx2y_pcm_open() to at least
> twice the endpoint's packet size. Two packets, matching the line6 fix.
> The bound makes the copy safe, but it does not make every larger buffer
> progress: the position is reported once per URB of 4 packets, so a
> buffer that divides one URB's data returns to the same position at every
> callback. That was already the case before this patch and is not changed
> here. Keep a guard in usx2y_urb_capt_retire() that drops an oversized
> packet with a ratelimited error, for the case that should no longer be
> reachable.
> 
> Reproduced on 7.3-rc7 with a USB/IP device presenting the US-122
> interface layout and 1024-byte packets into a 512-byte buffer:
> 
>   BUG: KASAN: out-of-bounds in i_usx2y_urb_complete+0x1285/0x1ac0
>   Read of size 18446744073709551104 at addr ffff88800e448800 by task vhci_rx/83
> 
> With this patch a 1024-byte buffer is refused at hw_params; a 2048-byte
> buffer is accepted and safe but barely advances (hw_ptr 9216 after 30 s,
> for the reason above); a 3072-byte buffer streams for 30 s with no
> report and with the position moving inside the buffer.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sinan Turunc <enscrpt@pm.me>

Applied now.  thanks.


Takashi