Control: tags -1 + upstream Control: forwarded -1 https://lore.kernel.org/all/shfaXkZCI7FtyNr5tS4kCC_d5E4uQFhc0MtwJa2CQFXpNMfSw7Ub6urwWpGrcoRnHuoneJEi9mLwtnvVImMhz1Hb25iwNJxx8GZZsDCV_HE=@protonmail.com/
Hi On Tue, Nov 03, 2026 at 11:22:16PM +0100, Benjamin Scherrer wrote: > Hi Salvatore, > > thanks a lot for the quick reply. > > It really is an upstream problem. It works with the upstream 6.12.113 kernel > but fails with 6.12.115. > > I dissected it and only built about 10 kernels, haven't done this in years > ;) > > output of last 'git bisect bad': > > --- > 81e4b0009f2acc841d77a24fd796528b0bf62c4e is the first bad commit > commit 81e4b0009f2acc841d77a24fd796528b0bf62c4e (HEAD) > Author: Edward Adam Davis <[email protected]> > Date: Tue Jan 13 16:29:23 2026 +0800 > > ALSA: usb-audio: Prevent excessive number of frames > > [ Upstream commit ef5749ef8b307bf8717945701b1b79d036af0a15 ] > > In this case, the user constructed the parameters with maxpacksize 40 > for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer > size for each data URB is maxpacksize * packets, which in this example > is 40 * 6 = 240; When the user performs a write operation to send audio > data into the ALSA PCM playback stream, the calculated number of frames > is packsize[0] * packets = 264, which exceeds the allocated URB buffer > size, triggering the out-of-bounds (OOB) issue reported by syzbot [1]. > > Added a check for the number of single data URB frames when calculating > the number of frames to prevent [1]. > > [1] > BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460 > sound/usb/pcm.c:1487 > Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506 > Call Trace: > copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487 > prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611 > prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333 > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=6db0415d6d5c635f72cb > Tested-by: [email protected] > Signed-off-by: Edward Adam Davis <[email protected]> > Link: > https://patch.msgid.link/[email protected] > Signed-off-by: Takashi Iwai <[email protected]> > Signed-off-by: Sasha Levin <[email protected]> > > sound/usb/pcm.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > --- > > output of 'git bisect log': > > --- > git bisect start > # Status: warte auf guten und schlechten Commit > # good: [7fdb7c1824a1f9979d648d7ae28ac446bcee9c6e] Linux 6.12.113 > git bisect good 7fdb7c1824a1f9979d648d7ae28ac446bcee9c6e > # Status: warte auf schlechten Commit, 1 guter Commit bekannt > # bad: [03bae623ec326c2738198739625832aab0eb120a] Linux 6.12.115 > git bisect bad 03bae623ec326c2738198739625832aab0eb120a > # bad: [9afcfc4c6597547c20d6354fa68f1d6012e31c0e] wifi: iwlwifi: dvm: pair > transport op-mode enter/leave > git bisect bad 9afcfc4c6597547c20d6354fa68f1d6012e31c0e > # bad: [33201705179d94985c788ae9186ceeab044fb6bd] ceph: Remove uses of page > from ceph_process_folio_batch() > git bisect bad 33201705179d94985c788ae9186ceeab044fb6bd > # good: [39870dbccdea99e1aa0ae445ab913748e912a352] ASoC: Intel: avs: Use > topology information for endpoint numbers > git bisect good 39870dbccdea99e1aa0ae445ab913748e912a352 > # bad: [58a4c2dbe6f746cdf9ea06fcaeda535aecb4b80b] bnxt_en: Update firmware > interface spec to 1.10.3.85 > git bisect bad 58a4c2dbe6f746cdf9ea06fcaeda535aecb4b80b > # good: [20b3c72c1b83054c568d2322a95e217fdc281bc3] bpf: Mark bpf_refcount > field as unique > git bisect good 20b3c72c1b83054c568d2322a95e217fdc281bc3 > # bad: [4eca06a55417c3b2e538656d12c89e224343653e] bpf: Fix exception exit > lock checking for subprogs > git bisect bad 4eca06a55417c3b2e538656d12c89e224343653e > # bad: [f8b8ec0ddde74066d4452a7a961da544f193e00f] riscv: trace: fix snapshot > deadlock with sbi ecall > git bisect bad f8b8ec0ddde74066d4452a7a961da544f193e00f > # good: [f32ae3cfc976074e9c5927893ce49bcf12f53748] idpf: fix error handling > in the init_task on load > git bisect good f32ae3cfc976074e9c5927893ce49bcf12f53748 > # good: [d1e9614a142eff34c93e94a15a71ad0e806799c4] virtio_net: Fix > misalignment bug in struct virtnet_info > git bisect good d1e9614a142eff34c93e94a15a71ad0e806799c4 > # bad: [81e4b0009f2acc841d77a24fd796528b0bf62c4e] ALSA: usb-audio: Prevent > excessive number of frames > git bisect bad 81e4b0009f2acc841d77a24fd796528b0bf62c4e > # first bad commit: [81e4b0009f2acc841d77a24fd796528b0bf62c4e] ALSA: > usb-audio: Prevent excessive number of frames > --- > > I hope this helps! Yes it does, thank you for having taken the time to do his. At same time another user reported already the issue upstream reaching the same commit: https://lore.kernel.org/all/shfaXkZCI7FtyNr5tS4kCC_d5E4uQFhc0MtwJa2CQFXpNMfSw7Ub6urwWpGrcoRnHuoneJEi9mLwtnvVImMhz1Hb25iwNJxx8GZZsDCV_HE=@protonmail.com/ Would it be possible that you check with 6.12.115-2 and the commit 70b4db7d2581 ("ALSA: usb-audio: Use the right limit for PCM OOB check") on top if that fixes your problem? You can either build 6.12.115 upstream with that commit on top, or follow https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#id-1.6.6.4 to make the Debian packaging for 6.12.115-2 with a single patch on top to test the fix. But let me know if that does not help and you need more detailed help. Regards, Salvatore
