[PATCH] ALSA: usb-audio: Clamp frame size in implicit-feedback mode

[PATCH] ALSA: usb-audio: Clamp frame size in implicit-feedback mode

[Sonali Pradhan]

snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's
stride and stores the result directly in out_packet->packet_size[i]. If a
connected USB device sends an oversized sync packet, this frame count can
exceed ep->maxframesize.

The un-clamped frame count then propagates to the playback endpoint queue,
potentially driving packet transfers beyond the endpoint's hardware frame
limits.

Cap the calculated frame count against ep->maxframesize in
snd_usb_handle_sync_urb() to prevent oversized packets from entering the
playback queue.

Fixes: 28acb12014fb ("ALSA: usb-audio: use sender stride for implicit feedback")
Cc: stable@vger.kernel.org
Assisted-by: Jetski:Gemini-3.6-Flash
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
---
 sound/usb/endpoint.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 24cd7692bd01..f127eaf2a1ae 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -1817,11 +1817,13 @@ static void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep,
 
 		out_packet->packets = in_ctx->packets;
 		for (i = 0; i < in_ctx->packets; i++) {
-			if (urb->iso_frame_desc[i].status == 0)
-				out_packet->packet_size[i] =
+			if (urb->iso_frame_desc[i].status == 0) {
+				unsigned int frames =
 					urb->iso_frame_desc[i].actual_length / sender->stride;
-			else
+				out_packet->packet_size[i] = min(frames, ep->maxframesize);
+			} else {
 				out_packet->packet_size[i] = 0;
+			}
 		}
 
 		spin_unlock_irqrestore(&ep->lock, flags);
-- 
2.55.0.487.gaf234c4eb3-goog

Re: [PATCH] ALSA: usb-audio: Clamp frame size in implicit-feedback mode

[Takashi Iwai]

On Tue, 28 Jul 2026 22:24:32 +0200,
Sonali Pradhan wrote:
> 
> snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's
> stride and stores the result directly in out_packet->packet_size[i]. If a
> connected USB device sends an oversized sync packet, this frame count can
> exceed ep->maxframesize.
> 
> The un-clamped frame count then propagates to the playback endpoint queue,
> potentially driving packet transfers beyond the endpoint's hardware frame
> limits.
> 
> Cap the calculated frame count against ep->maxframesize in
> snd_usb_handle_sync_urb() to prevent oversized packets from entering the
> playback queue.
> 
> Fixes: 28acb12014fb ("ALSA: usb-audio: use sender stride for implicit feedback")
> Cc: stable@vger.kernel.org
> Assisted-by: Jetski:Gemini-3.6-Flash
> Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>

Applied now.  Thanks.


Takashi