averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

ALSA: usb-audio: Clamp frame size in implicit-feedback mode

Browse Source 
commit 8d7a30c50c upstream.

snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's
stride and stores the result directly in out_packet->packet_size[i]. If a
connected USB device sends an oversized sync packet, this frame count can
exceed ep->maxframesize.

The un-clamped frame count then propagates to the playback endpoint queue,
potentially driving packet transfers beyond the endpoint's hardware frame
limits.

Cap the calculated frame count against ep->maxframesize in
snd_usb_handle_sync_urb() to prevent oversized packets from entering the
playback queue.

Fixes: 28acb12014 ("ALSA: usb-audio: use sender stride for implicit feedback")
Cc: stable@vger.kernel.org
Assisted-by: Jetski:Gemini-3.6-Flash
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
Link: https://patch.msgid.link/20260728202432.2354994-1-sonalipradhan@google.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Sonali Pradhan
2026-08-09 20:21:53 +02:00
committed by Greg Kroah-Hartman
parent 3852974608
commit 56ac3e7c90
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sound/usb/endpoint.c
+5 -3
View File
@@ -1834,11 +1834,13 @@ static void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
out_packet->packets = in_ctx->packets;
for (i = 0; i < in_ctx->packets; i++) {
if (urb->iso_frame_desc[i].status == 0)
out_packet->packet_size[i] =
if (urb->iso_frame_desc[i].status == 0) {
unsigned int frames =
urb->iso_frame_desc[i].actual_length / sender->stride;
else
out_packet->packet_size[i] = min(frames, ep->maxframesize);
} else {
out_packet->packet_size[i] = 0;
}
}
spin_unlock_irqrestore(&ep->lock, flags);