From: Hillf Danton <hdanton@sina.com>
To: Takashi Iwai <tiwai@suse.de>
Cc: Lizhi Xu <lizhi.xu@windriver.com>,
linux-kernel@vger.kernel.org, linux-sound@vger.kernel.org,
linux-usb@vger.kernel.org, perex@perex.cz,
syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com,
syzkaller-bugs@googlegroups.com, tiwai@suse.com
Subject: Re: [PATCH] ALSA: usb-audio: Prevent urb from writing out of bounds
Date: Fri, 7 Nov 2025 07:51:26 +0800 [thread overview]
Message-ID: <20251106235128.8908-1-hdanton@sina.com> (raw)
In-Reply-To: <87h5v7ru58.wl-tiwai@suse.de>
On Thu, 06 Nov 2025 17:41:07 +0100 Takashi Iwai wrote:
> OK, then a fix like below would work?
Test Takashi's fix.
#syz test
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -1362,6 +1362,11 @@ int snd_usb_endpoint_set_params(struct snd_usb_audio *chip,
ep->sample_rem = ep->cur_rate % ep->pps;
ep->packsize[0] = ep->cur_rate / ep->pps;
ep->packsize[1] = (ep->cur_rate + (ep->pps - 1)) / ep->pps;
+ if (ep->packsize[1] > ep->maxpacksize) {
+ usb_audio_dbg(chip, "Too small maxpacksize %u for rate %u / pps %u\n",
+ ep->maxpacksize, ep->cur_rate, ep->pps);
+ return -EINVAL;
+ }
/* calculate the frequency in 16.16 format */
ep->freqm = ep->freqn;
--
next prev parent reply other threads:[~2025-11-06 23:52 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-05 15:20 [syzbot] [sound?] [usb?] KASAN: slab-out-of-bounds Write in copy_to_urb syzbot
2025-11-06 2:10 ` Hillf Danton
2025-11-06 2:32 ` syzbot
2025-11-06 7:50 ` Forwarded: " syzbot
2025-11-06 8:33 ` [PATCH] ALSA: usb-audio: Prevent urb from writing out of bounds Lizhi Xu
2025-11-06 10:02 ` Takashi Iwai
2025-11-06 11:31 ` Lizhi Xu
2025-11-06 11:49 ` Takashi Iwai
2025-11-06 14:35 ` Lizhi Xu
2025-11-06 16:41 ` Takashi Iwai
2025-11-06 23:51 ` Hillf Danton [this message]
2025-11-07 0:12 ` [syzbot] [sound?] [usb?] KASAN: slab-out-of-bounds Write in copy_to_urb syzbot
2025-11-07 0:54 ` [PATCH] ALSA: usb-audio: Prevent urb from writing out of bounds Lizhi Xu
2025-11-07 1:13 ` Lizhi Xu
2025-11-08 7:54 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251106235128.8908-1-hdanton@sina.com \
--to=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=lizhi.xu@windriver.com \
--cc=perex@perex.cz \
--cc=syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tiwai@suse.com \
--cc=tiwai@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox