[PATCH] usb: gadget: u_audio: don't exceed maxpacket when adding a residue frame

[Kyle Farrell <kaf@nwlink.com>]

u_audio_iso_complete() clamps the base packet size to ep->maxpacket
and accumulates fractional-frame residue in p_residue_mil. Once a
whole frame has accumulated, it is appended to the packet without
checking whether it fits within ep->maxpacket.

Only append the extra frame if it fits. Consume the accumulated
residue whether or not the frame is sent, preventing it from growing
when the additional frame cannot fit. When the frame fits, behavior
is unchanged. Otherwise, the stream cannot sustain the requested
sample rate.

For example, with 27 channels of 32-bit samples at 19200 Hz on a
high-speed link with p_hs_bint=3, the required packet size of 1080
bytes is capped at 1024. The base packet is 972 bytes, but appending
a residue frame increases it to 1080 bytes, exceeding the allocated
request buffer by 56 bytes.

Fixes: 9bb87f168931 ("usb: gadget: f_uac2: send reasonably sized packets")
Link: https://lore.kernel.org/linux-usb/sashiko-outbox-174688@kernel.org/
Signed-off-by: Kyle Farrell <kaf@nwlink.com>
---
 drivers/usb/gadget/function/u_audio.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index f0ee83abcebc..f73d1085c1d1 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -230,9 +230,13 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 		do_div(div_result, uac->p_interval);
 		do_div(div_result, 1000000);
 		if ((unsigned int) div_result >= uac->p_framesize) {
-			req->length += uac->p_framesize;
+			/* req->length is bounded by ep->maxpacket above. */
+			if (uac->p_framesize <= ep->maxpacket - req->length) {
+				req->length += uac->p_framesize;
+				pr_debug("increased req length to %d\n", req->length);
+			}
+
 			uac->p_residue_mil -= uac->p_framesize * p_interval_mil;
-			pr_debug("increased req length to %d\n", req->length);
 		}
 		pr_debug("remains uac->p_residue_mil %llu\n", uac->p_residue_mil);
 

base-commit: bdf12cde30830d46a8ef1ba93986356f1164b4f1
-- 
2.34.1