ALSA: usb-audio: Use the right limit for PCM OOB check

commit 70b4db7d258118a7464f039112a74ddb49a95b06 upstream.

The recent fix commit for addressing the OOB access of PCM URB data
buffer caused a regression on Behringer UMC2020HD device, resulting in
choppy sound.  The fix used ep->max_urb_frames for the upper limit
check, and this is no right value to be referred.

Use the actual buffer size (ctx->buffer_size) as the upper limit
instead, which also avoids the regression on the device above.

Fixes: ef5749ef8b30 ("ALSA: usb-audio: Prevent excessive number of frames")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220997
Link: https://patch.msgid.link/20260121082025.718748-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 263abb36bb2d1c0493486bdf62776bb1b178b490..682b6c1fe76bac0da615592474c9b2d7f5c6294f 100644 (file)
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1553,7 +1553,8 @@ static int prepare_playback_urb(struct snd_usb_substream *subs,
 
                for (i = 0; i < ctx->packets; i++) {
                        counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, avail);
-                       if (counts < 0 || frames + counts >= ep->max_urb_frames)
+                       if (counts < 0 ||
+                           (frames + counts) * stride > ctx->buffer_size)
                                break;
                        /* set up descriptor */
                        urb->iso_frame_desc[i].offset = frames * stride;