[PATCH] ALSA: usx2y: Bound capture copies by the PCM buffer size

[Sinan Turunc]

usx2y_urb_capt_retire() splits the copy into the ALSA ring buffer once
at the buffer end and wraps hwptr_done once, which is only correct when
one packet holds at most buffer_size frames. The packet size is the
endpoint's maxpacksize from usb_maxpacket(), while the hw constraints
allow 64-byte periods with periods_min 2, so a packet can be larger
than the whole buffer.

Clamp len to buffer_size before the copy so the single wrap stays
inside the buffer.

Reproduced on 7.3-rc7 with a USB/IP device presenting the US-122
interface layout and 1024-byte packets into a 512-byte buffer:

  BUG: KASAN: out-of-bounds in i_usx2y_urb_complete+0x1285/0x1ac0
  Read of size 18446744073709551104 at addr ffff88800e448800 by task vhci_rx/83

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Sinan Turunc <enscrpt@xxxxx>
---
 sound/usb/usx2y/usbusx2yaudio.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index a3a0bc13632..ea4ae5caba6 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -51,6 +51,14 @@ static int usx2y_urb_capt_retire(struct snd_usx2y_substream *subs)
 			dev_dbg(&usx2y->dev->dev, "%s: 0 == len ERROR!\n", __func__);
 			continue;
 		}
+		/*
+		 * A packet can carry up to maxpacksize, which the device
+		 * chooses, while the ring buffer can be as small as two
+		 * 64-byte periods. The single wrap below is only valid for
+		 * len <= buffer_size, so keep what fits.
+		 */
+		if (unlikely(len > runtime->buffer_size))
+			len = runtime->buffer_size;
 
 		/* copy a data chunk */
 		if ((hwptr_done + len) > runtime->buffer_size) {
-- 
2.56.0