Re: [PATCH] ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set

[Takashi Iwai <tiwai@suse.de>]

On Tue, 28 Jul 2026 22:17:16 +0200,
Sonali Pradhan wrote:
> 
> When a USB audio endpoint requests full packet transfers via the fill_max
> descriptor flag, data_ep_set_params() promotes ep->curpacksize to
> ep->maxpacksize. However, maxsize is left at the original sample-rate
> derived value.
> 
> Since u->buffer_size is allocated as maxsize * packets, the resulting
> DMA buffer is far too small for the requested transfer length. When the
> USB host controller streams up to curpacksize bytes per packet, it writes
> past the end of the buffer via DMA, corrupting kernel heap memory.
> 
> Update maxsize to curpacksize when fill_max is set so that the allocated
> DMA buffer size matches the actual transfer request size.
> 
> Fixes: 8fdff6a319e7 ("ALSA: snd-usb: implement new endpoint streaming model")
> Cc: stable@vger.kernel.org
> Assisted-by: Jetski:Gemini-3.6-Flash
> Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
> ---
>  sound/usb/endpoint.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
> index 24cd7692bd01..d825c09a766a 100644
> --- a/sound/usb/endpoint.c
> +++ b/sound/usb/endpoint.c
> @@ -1172,6 +1172,7 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep)
>  		ep->curpacksize = ep->maxpacksize;
>  	else
>  		ep->curpacksize = maxsize;
> +	maxsize = ep->curpacksize;
>  

Unconditionally reassigning here makes harder to understand the
intention.  So I modified slightly to make the reassignment
conditional, only when ep->fill_max is set.

	if (ep->fill_max) {
		ep->curpacksize = ep->maxpacksize;
		maxsize = ep->curpacksize;
	} else {
		ep->curpacksize = maxsize;
	}

Applied the fix in the form above now.  Thanks.


Takashi