[PATCH v4 0/2] ALSA: usx2y: Bound the PCM buffer by the URB size

[Sinan Turunc]

v4 of the usx2y buffer fix. Patch 1 changes only its comments and the
nrpacks note in the changelog. Patch 2 now also sizes the playback ISO
descriptors from whole frames, after the review of v3 found that they
were filled from the raw capture actual_length while
transfer_buffer_length used whole frames, and gives the maxpacksize
check its own message.

Patch 1 replaces the two-packet BUFFER_BYTES bound of v2 with a
two-URB BUFFER_SIZE bound in frames that does not read the endpoint,
and keeps the capture drop guard. Patch 2 adds guards in the playback
prepare path for a URB larger than the buffer and a packet larger than
the playback endpoint's maxpacksize, and sizes each descriptor as
counts * stride, all pre-existing and unchecked.

Tested on 7.3-rc7 with a USB/IP device presenting the US-122 interface
layout. The playback case of patch 2 reproduces on the unpatched driver
with ordinary 48-frame packets and a 100-frame buffer, which the stock
constraints allow. With both patches, buffers below the bound are
refused at hw_params and 400-frame buffers stream in both directions
with no KASAN report, for S16_LE and, on capture, S24_3LE. With
195-byte capture packets the descriptor sizing of patch 2 shows through
USB/IP's completion check, which refused the v3 URBs (descriptors of
780 bytes for 768 bytes of data) and accepts the v4 ones. The results
are in the patch messages.

Sinan Turunc (2):
  ALSA: usx2y: Require a buffer of two URBs
  ALSA: usx2y: Guard the playback copy

 sound/usb/usx2y/usbusx2yaudio.c | 43 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)