From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-57-210.mail.qq.com (out162-62-57-210.mail.qq.com [162.62.57.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E95F730FC30 for ; Tue, 13 Jan 2026 07:57:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.57.210 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768291058; cv=none; b=mjTESWrlpil342mAj8X6skyx4+B2Xqr9NXZNVrhP56Q7XLdytErzm+DvoNJmQbGUZm4OCWcvC84l8KI6LYto0UDuhhoMi3XT/lrqFcUVJOm4kg0mRggvaC1OOo1pIL5ba15Kq28ugamke4iaeVdUQ1C8f56ZkDd9QDBuIwndJBA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768291058; c=relaxed/simple; bh=Jh+MJBN3QR3Zf5bcx6RNv4d4s9lz5r9dlSS+jn8TK3E=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=IX5J/vp1Y5dV9E1Op7SP3w3uRePLTL29curks7eTFrMK3EtNFf0v8Ec5CPR/3Mpa74Y7bFcTAIUwogZ1mRClDVb/1+RPRZYu4Dr5y0TDPrrtQH7LioiUmROT7Vyn2LeCUnMEtiErqLEcbfReyX8ekyM4e+Hv7f8xypIEhzEOYdw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=pSC+Vtk0; arc=none smtp.client-ip=162.62.57.210 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="pSC+Vtk0" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1768291045; bh=nx6ZGHKrbQNkuA7GCkmsdEPC9PprhxJjUAUAarU+6Xk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=pSC+Vtk0OYtpoZRQ3cZly5CL28yKJG0r8GEw6jHuqJf9AHz1WqWb5isTrdqMLLLuW D4RWqFRfeiVpDKbKtfC2GmeGvkw2G4PHJqnvpICAp+FxDW70vy5YcUhMqqU3sy+72/ wl6poYk3LNbzXaAWtFp8cvLDH/nJENV2Z+Bhh+qE= Received: from lxu-ped-host.. ([114.244.57.237]) by newxmesmtplogicsvrsza56-0.qq.com (NewEsmtp) with SMTP id D853660C; Tue, 13 Jan 2026 15:54:05 +0800 X-QQ-mid: xmsmtpt1768290845tjgkehsqn Message-ID: X-QQ-XMAILINFO: MDbayGdXPuoeBnIyyvVaMFEv0f6Y9WrAQdp3FE9yrsCPtys1UsSMcHvir/5idb Y53I83AcWfX8sDyPO/epYlZ8vORECuhQTkpFfU3J54WVwxu73qBvJCbA+t2EyKXz8n8hPD6ZSCmt 9ns11/CViMohADeGHv9INn8HYGjejmyd+sKJbVBXi5+XEZClVpsc8WnGHqu6Hfl45aC/L4WNtpvp JI0qRbmxi4RhvmPVnMCutv/HKfM3SLOf+rYa3X9i+5cbXcJaeZAmxO1V9KrPbHkY23FSYLsTLjNS LY/Hxs5ntcHdl6xhKySbHdzo5QtM20GIn5wNyVIVjPIqKRhPFdyaKDuvPr6NRs3+MU8IS2wDW/tf OTqJKwm+6MtaJ9UuV0RcjMwLR8ekX7JaAW8z4FQ5o4uiKpxRhaKYHJ6h/daKiznSPdYHL9wnn8pK 8MgKJZFEIR1cYsPSTPy1uMRVBqLIAJsg4XQ1dwAgKFIH6DCTrRjmzCnv0/m3Xd4CLBbRuxEcFZZR B2UlJXtKehKCfi7snAyG+8uVt64N3h8WKkJHycl1UWQY/E3nUIaZ6N9/p+Ihl0WVXritiLGogUi/ dROuBlltuKOM+fX+vfTQ5RICiusv5BL39dLJSfSgdERaTAnLlnuhORiZEFFee79dWawBM+H+s13V Ov1Uv012iN/F9BcN/IP3sKjnuBj40DQtEX/mgDdqzeDWbtHlg8njKz4516mohGGQf/Aau62lDVKR Ulx30A8j26hHjISKalfY+H5X2H2W/HOvANZq1rvp5Pw7p8SgDBccyEt3pi/34Nwth3jqs9m8zWFJ SVXbav5UMGXdv5IEmRAlkL5lgArHUhTFRsk6/iIfXig0btMl58fC3Zg2O6Qi9ly0FSXUcXPJs6Xm RwUkr04cxEFI6tEyLDym0cKeN+nvgKZZKMtJn+YbIWNvHV7KyhWqn67P3amEZXXvX6rV/an68dMs 1SoFcIM1Lcrt4TvIewztC54fFv/jtHGkz1vMIFfVgUBrrVOQWR3RJHCgakUxCL X-QQ-XMRINFO: Nq+8W0+stu50tPAe92KXseR0ZZmBTk3gLg== From: Edward Adam Davis To: syzbot+6db0415d6d5c635f72cb@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [sound?] [usb?] KASAN: slab-out-of-bounds Write in copy_to_urb (2) Date: Tue, 13 Jan 2026 15:54:05 +0800 X-OQ-MSGID: <20260113075404.679705-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6965a06e.050a0220.38aacd.0004.GAE@google.com> References: <6965a06e.050a0220.38aacd.0004.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 54d01dfd820f..263abb36bb2d 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -1553,7 +1553,7 @@ static int prepare_playback_urb(struct snd_usb_substream *subs, for (i = 0; i < ctx->packets; i++) { counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail); - if (counts < 0) + if (counts < 0 || frames + counts >= ep->max_urb_frames) break; /* set up descriptor */ urb->iso_frame_desc[i].offset = frames * stride;