[BUG] sound/usb: out-of-bounds in start_usb_playback()

[co]

This is a bug report, not a patch submission.

We found a bug reachable in:

    path    sound/usb/misc
    crash   out-of-bounds in start_usb_playback()
    commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you fix this bug, this tag credits the report and lets us
    close it on our side:

Reported-by: co+24304d323d28f156@xxxxxxx

    Everything in this mail is validated by the reproducer below.

    We also hold an unreviewed LLM-generated analysis and candidate
    patch. The same reproducer panics the unpatched kernel and runs
    clean with that patch applied. Use it as a starting point, or ignore
    it and write your own:

        patch.diff  https://bugs.sh/b/24304d323d28f156/patch.diff
        report.md   https://bugs.sh/b/24304d323d28f156/report.md

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@xxxxxxx

== Environment =========================================================
    Reproduced on  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
    VM setup       https://bugs.sh/b/24304d323d28f156/run.sh
    config         https://bugs.sh/b/24304d323d28f156/config.gz
    poc            https://bugs.sh/b/24304d323d28f156/repro.c

== Sanitizer Report ====================================================
BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound/usb/misc/ua101.c:586 (discriminator 3))
Write of size 2048 at addr ffff88802322f700 by task exploit/5017
CPU: 1 UID: 0 PID: 5017 Comm: exploit Not tainted 7.2.0-rc7 #1 PREEMPT(full)
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)
__asan_memset (mm/kasan/shadow.c:84 (discriminator 1))
start_usb_playback (sound/usb/misc/ua101.c:586 (discriminator 3))
playback_pcm_open (sound/usb/misc/ua101.c:679)
snd_pcm_open_substream (sound/core/pcm_native.c:2827)
snd_pcm_open (sound/core/pcm_native.c:2863 sound/core/pcm_native.c:2928)
snd_pcm_playback_open (sound/core/pcm_native.c:2888 sound/core/pcm_native.c:2880)
snd_open (sound/core/sound.c:166)
chrdev_open (fs/char_dev.c:411)
do_dentry_open (fs/open.c:947)
vfs_open (fs/open.c:1052)
path_openat (fs/namei.c:4700 fs/namei.c:4863)
do_file_open (fs/namei.c:4892)
do_sys_openat2 (fs/open.c:1368 (discriminator 1))
__x64_sys_openat (fs/open.c:1374 fs/open.c:1390 fs/open.c:1385 fs/open.c:1385)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Allocated by task 10:
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:5359)
hcd_buffer_alloc (./include/linux/slab.h:992 drivers/usb/core/buffer.c:134)
usb_alloc_coherent (drivers/usb/core/usb.c:1011)
alloc_stream_buffers (sound/usb/misc/ua101.c:1031)
ua101_probe (sound/usb/misc/ua101.c:1244)
usb_probe_interface (drivers/usb/core/driver.c:396)
The buggy address belongs to the object at ffff88802322f700
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@xxxxxxx

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup