linux/sound/usb
Takashi Iwai fc9e5af60d ALSA: usb-audio: Add sanity check for OOB writes at silencing
[ Upstream commit fba2105a15 ]

At silencing the playback URB packets in the implicit fb mode before
the actual playback, we blindly assume that the received packets fit
with the buffer size.  But when the setup in the capture stream
differs from the playback stream (e.g. due to the USB core limitation
of max packet size), such an inconsistency may lead to OOB writes to
the buffer, resulting in a crash.

For addressing it, add a sanity check of the transfer buffer size at
prepare_silent_urb(), and stop the data copy if the received data
overflows.  Also, report back the transfer error properly from there,
too.

Note that this doesn't fix the root cause of the playback error
itself, but this merely covers the kernel Oops.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-03-04 07:21:29 -05:00
..
6fire ALSA: 6fire: Release resources at card release 2024-12-05 14:01:58 +01:00
bcd2000 ALSA: bcd2000: refactor deprecated strncpy 2023-07-29 13:53:56 +02:00
caiaq ALSA: caiaq: Use snd_card_free_when_closed() at disconnection 2024-12-05 14:01:58 +01:00
hiface ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
line6 ALSA: line6: update contact information 2024-10-10 14:02:57 +02:00
misc ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
usx2y ALSA: usx2y: validate nrpacks module parameter on probe 2025-03-13 13:02:05 +01:00
card.c ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card 2025-10-23 16:20:37 +02:00
card.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
clock.c ALSA: usb-audio: Fix out of bounds reads when finding clock sources 2024-12-05 14:02:41 +01:00
clock.h ALSA: usb-audio: Constify audioformat pointer references 2020-11-23 15:15:36 +01:00
endpoint.c ALSA: usb-audio: Add sanity check for OOB writes at silencing 2026-03-04 07:21:29 -05:00
endpoint.h ALSA: usb-audio: Remove unused function declaration 2023-08-01 16:56:57 +02:00
format.c ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset 2025-05-09 09:50:29 +02:00
format.h ALSA: usb: initial USB Audio Device Class 3.0 support 2018-03-21 11:46:33 +01:00
helper.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
helper.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
implicit.c ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1 2025-06-19 15:32:34 +02:00
implicit.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
Kconfig ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
Makefile ALSA: usb: Use *-y instead of *-objs in Makefile 2024-05-08 18:17:53 +02:00
media.c ALSA: pcm: Don't embed device 2023-08-17 09:23:45 +02:00
media.h media: sound/usb: Use Media Controller API to share media resources 2019-04-22 11:21:06 -04:00
midi.c ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free 2025-10-12 12:57:18 +02:00
midi.h ALSA: usb-audio: Manage number of rawmidis globally 2023-05-23 12:11:00 +02:00
midi2.c ALSA: usb-audio: Update UMP group attributes for GTB blocks, too 2024-08-07 11:31:38 +02:00
midi2.h ALSA: usb-audio: USB MIDI 2.0 UMP support 2023-05-23 12:11:02 +02:00
mixer.c ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() 2026-01-30 10:28:45 +01:00
mixer.h ALSA: usb-audio: Add input value sanity checks for standard types 2024-08-06 18:27:08 +02:00
mixer_maps.c ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card 2025-06-27 11:11:39 +01:00
mixer_quirks.c ALSA: usb-audio: fix broken logic in snd_audigy2nx_led_update() 2026-02-11 13:40:28 +01:00
mixer_quirks.h ALSA: usb-audio: Drop CONFIG_PM ifdefs 2021-12-06 10:19:40 +01:00
mixer_s1810c.c ALSA: usb-audio: add mono main switch to Presonus S1824c 2025-11-13 15:34:31 -05:00
mixer_s1810c.h ALSA: usb-audio: Add support for Presonus Studio 1810c 2020-02-15 09:46:16 +01:00
mixer_scarlett.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
mixer_scarlett.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mixer_scarlett2.c ALSA: scarlett2: Fix buffer overflow in config retrieval 2026-01-30 10:28:45 +01:00
mixer_scarlett2.h ALSA: scarlett2: Rename scarlett_gen2 to scarlett2 2023-10-27 11:22:59 +02:00
mixer_us16x08.c ALSA: usb-mixer: us16x08: validate meter packet indices 2026-01-08 10:14:08 +01:00
mixer_us16x08.h ALSA: usb: Constify snd_kcontrol_new items 2020-01-03 09:24:34 +01:00
pcm.c ALSA: usb-audio: Fix broken resume due to UAC3 power state 2023-06-16 09:28:08 +02:00
pcm.h ALSA: usb-audio: Add new quirk FIXED_RATE for JBL Quantum810 Wireless 2022-12-22 09:13:54 +01:00
power.c ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
power.h ALSA: usb-audio: Support multiple control interfaces 2024-08-12 16:17:46 +02:00
proc.c ALSA: usb-audio: Show sync endpoint information in proc outputs 2020-11-23 15:16:45 +01:00
proc.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
quirks-table.h ALSA: usb-audio: Add extra PID for RME Digiface USB 2024-12-14 20:03:23 +01:00
quirks.c ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio 2026-03-04 07:21:10 -05:00
quirks.h ALSA: usb-audio: Register card at the last interface 2022-09-06 11:04:56 +02:00
stream.c ALSA: usb-audio: Fix size validation in convert_chmap_v3() 2025-08-28 16:31:13 +02:00
stream.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
usbaudio.h ALSA: usb-audio: move mixer_quirks' min_mute into common quirk 2025-10-02 13:44:07 +02:00
validate.c ALSA: usb-audio: Add validation of UAC2/UAC3 effect units 2025-11-13 15:34:14 -05:00