Re: [PATCH] ALSA: usb-audio: Drop capture packets with bogus actual_length

[Takashi Iwai]

On Tue, 10 Nov 2026 07:00:21 +0100,
Gichoon Han wrote:
> 
> retire_capture_urb() copies urb->iso_frame_desc[i].actual_length bytes
> out of urb->transfer_buffer at the packet's offset, but never checks
> that value against the requested packet length.  A host controller
> reporting more data than requested makes memcpy() read past the end
> of the URB transfer buffer.
> 
> Commit 06be918062ad ("ALSA: usb-audio: Bound packet copies by the PCM
> buffer size") clamps the count to the PCM ring buffer size, which
> protects the destination.  The source slot is only ep->curpacksize
> bytes per packet, though, so the over-read remains.
> 
> This was hit on an ARM32 system (vendor 5.4 kernel; the code path is
> unchanged in mainline) with a full-speed UAC1 microphone behind a
> high-speed hub, i.e. the EHCI siTD path.  sitd_complete() computes
> actual_length as desc->length - SITD_LENGTH(t); the controller
> reported a remaining length larger than the programmed one, the value
> wrapped to ~4G, and the capture copy faulted on the first unmapped
> page after the URB buffer:
> 
>   Unable to handle kernel paging request at virtual address e8756000
>   Internal error: Oops: 7 [#1] PREEMPT SMP ARM
>   r3 : 00000000  r2 : 0001e700  r1 : e8756000  r0 : e878fc80
>   Code: ba000002 f5d1f03c f5d1f05c f5d1f07c (e8b151f8)
> 
> A packet can never legitimately carry more than its requested length,
> so warn and skip it instead of copying.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Gichoon Han <gichoon.han@xxxxxxxxxxx>
> ---
> Compile-tested only on linux-next.  The crash was observed in the
> field on a vendor 5.4-based ARM32 kernel with the same code path;
> I don't have a setup to reproduce the bogus siTD length on mainline.

I think the bug is rather in the USB contorller code, but it's still
safer to have a sanity check.  So I applied now.


thanks,

Takashi