Re: [PATCH v2] ALSA: line6: Reject capture buffers smaller than two packets

[Takashi Iwai]

On Tue, 03 Nov 2026 14:22:44 +0100,
Sinan Turunc wrote:
> 
> line6_capture_copy() splits the copy into the ALSA ring buffer once at
> the buffer end and wraps pos_done once, which is only correct when one
> packet holds at most buffer_size frames. The packet size comes from the
> device's endpoint, and the per-device hw structs allow 64-byte periods
> with periods_min 1, so a packet can be larger than the whole buffer.
> audio_in_callback() logs an oversized packet and then copies it anyway.
> 
> The packet size is known at probe time, so constrain
> SNDRV_PCM_HW_PARAM_BUFFER_BYTES in snd_line6_capture_open() to at least
> twice the larger of the two endpoints' packet sizes. Two rather than
> one, because pos_done advances by the packet and wraps once, so a buffer
> of exactly one packet leaves the position unchanged after every packet.
> hw_params then rejects a buffer that cannot hold two packets, and the
> single wrap is valid for every configuration that gets through. Keep a
> guard in line6_capture_copy() that drops an oversized packet with a
> ratelimited error, for the case that should no longer be reachable.
> 
> Reproduced on 7.3-rc7 with a USB/IP device presenting the GuitarPort
> interface layout and 1024-byte packets into a 128-byte buffer: ALSA
> logged "invalid position: pos = 224, buffer size = 32" and the driver
> logged "driver bug: len" on every following packet. With this patch a
> 1024-byte buffer is refused at hw_params, and a 2048-byte buffer streams
> for 30 s with no report and with the position moving inside the buffer.
> 
> Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Sinan Turunc <enscrpt@xxxxx>

Applied now.  Thanks.


Takashi