Re: [PATCH] ALSA: usb-audio: Clamp frame size in implicit-feedback mode
Takashi Iwai <[email protected]>
| Newsgroups | org.kernel.vger.linux-sound,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 28 Jul 2026 22:24:32 +0200,
Sonali Pradhan wrote:
>
> snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's
> stride and stores the result directly in out_packet->packet_size[i]. If a
> connected USB device sends an oversized sync packet, this frame count can
> exceed ep->maxframesize.
>
> The un-clamped frame count then propagates to the playback endpoint queue,
> potentially driving packet transfers beyond the endpoint's hardware frame
> limits.
>
> Cap the calculated frame count against ep->maxframesize in
> snd_usb_handle_sync_urb() to prevent oversized packets from entering the
> playback queue.
>
> Fixes: 28acb12014fb ("ALSA: usb-audio: use sender stride for implicit feedback")
> Cc: [email protected]
> Assisted-by: Jetski:Gemini-3.6-Flash
> Signed-off-by: Sonali Pradhan <[email protected]>
Applied now. Thanks.
Takashi