diff options
| author | Takashi Iwai <tiwai@suse.de> | 2026-01-21 09:20:20 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-02-11 13:42:01 +0100 |
| commit | ecd164120c248c2d1db3ebc54f35443b796efe29 (patch) | |
| tree | c18a756cb071db0967a65b7d76f1f766d241e66b | |
| parent | 24ad4cfac0b8e7864cd5cd09c61b990aec683667 (diff) | |
ALSA: usb-audio: Use the right limit for PCM OOB check
commit 70b4db7d258118a7464f039112a74ddb49a95b06 upstream.
The recent fix commit for addressing the OOB access of PCM URB data
buffer caused a regression on Behringer UMC2020HD device, resulting in
choppy sound. The fix used ep->max_urb_frames for the upper limit
check, and this is no right value to be referred.
Use the actual buffer size (ctx->buffer_size) as the upper limit
instead, which also avoids the regression on the device above.
Fixes: ef5749ef8b30 ("ALSA: usb-audio: Prevent excessive number of frames")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220997
Link: https://patch.msgid.link/20260121082025.718748-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | sound/usb/pcm.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 263abb36bb2d..682b6c1fe76b 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -1553,7 +1553,8 @@ static int prepare_playback_urb(struct snd_usb_substream *subs, for (i = 0; i < ctx->packets; i++) { counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail); - if (counts < 0 || frames + counts >= ep->max_urb_frames) + if (counts < 0 || + (frames + counts) * stride > ctx->buffer_size) break; /* set up descriptor */ urb->iso_frame_desc[i].offset = frames * stride; |