Re: [BUG] sound/usb: out-of-bounds in prepare_playback_urb()
From: Xiang Mei
Date: Sat Sep 12 2026 - 16:12:06 EST
On Sat, Sep 12, 2026 at 9:31 AM Takashi Iwai <tiwai@xxxxxxx> wrote:
>
> On Sat, 12 Sep 2026 04:09:23 +0200,
> co wrote:
> >
> > This is a bug report, not a patch submission.
> >
> > We found a bug reachable in:
> >
> > path sound/usb/endpoint.c` (the overwrite) and `sound/usb
> > crash out-of-bounds in prepare_playback_urb()
> > commit 2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
> >
> > Config, environment, the sanitizer report and a C reproducer follow.
> >
> > == Notes ===============================================================
> > If you fix this bug, this tag credits the report and lets us
> > close it on our side:
> >
> > Reported-by: co+8eacd4fa193b1b28@xxxxxxx
> >
> > Everything in this mail is validated by the reproducer below.
> >
> > We also hold an unreviewed LLM-generated analysis and candidate
> > patch. The same reproducer panics the unpatched kernel and runs
> > clean with that patch applied. Use it as a starting point, or ignore
> > it and write your own:
> >
> > patch.diff https://bugs.sh/b/8eacd4fa193b1b28/patch.diff
> > report.md https://bugs.sh/b/8eacd4fa193b1b28/report.md
> >
> > A guide to taking it from here to a sendable patch, including the
> > trailers to add: https://bugs.sh/patch.html
> >
> > Happy to test patches. Complaints and suggestions about our work
> > are welcome at:
> >
> > cedalion@xxxxxxx
>
> The suggested patch looks reasonable. Could you just submit it in a
> proper format for upstream (after verifying that the issue still
> happens in the latest upstream)?
>
Thanks for checking.
The patch has been tested on the latest upstream (tiwai/sound.git).
And I have checked related functionality and ensured the patch fixes
the bug (to my knowledge):
https://lore.kernel.org/linux-sound/20260912200530.1955491-1-xmei5@xxxxxxx/T/#u
Xiang
> thanks,
>
> Takashi
>