Re: [BUG] sound/usb: out-of-bounds in prepare_playback_urb()

[Takashi Iwai <tiwai@suse.de>]

On Sat, 12 Sep 2026 04:09:23 +0200,
co wrote:
> 
> This is a bug report, not a patch submission.
> 
> We found a bug reachable in:
> 
>     path    sound/usb/endpoint.c` (the overwrite) and `sound/usb
>     crash   out-of-bounds in prepare_playback_urb()
>     commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you fix this bug, this tag credits the report and lets us
>     close it on our side:
> 
> Reported-by: co+8eacd4fa193b1b28@bugs.sh
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an unreviewed LLM-generated analysis and candidate
>     patch. The same reproducer panics the unpatched kernel and runs
>     clean with that patch applied. Use it as a starting point, or ignore
>     it and write your own:
> 
>         patch.diff  https://bugs.sh/b/8eacd4fa193b1b28/patch.diff
>         report.md   https://bugs.sh/b/8eacd4fa193b1b28/report.md
> 
>     A guide to taking it from here to a sendable patch, including the
>     trailers to add: https://bugs.sh/patch.html
> 
>     Happy to test patches. Complaints and suggestions about our work
>     are welcome at:
> 
>         cedalion@bugs.sh

The suggested patch looks reasonable.  Could you just submit it in a
proper format for upstream (after verifying that the issue still
happens in the latest upstream)?


thanks,

Takashi