From: Takashi Iwai <tiwai@suse.de> stable inclusion from stable-v6.18.10 commit ecd164120c248c2d1db3ebc54f35443b796efe29 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13764 CVE: CVE-2026-23208 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- commit 70b4db7d258118a7464f039112a74ddb49a95b06 upstream. The recent fix commit for addressing the OOB access of PCM URB data buffer caused a regression on Behringer UMC2020HD device, resulting in choppy sound. The fix used ep->max_urb_frames for the upper limit check, and this is no right value to be referred. Use the actual buffer size (ctx->buffer_size) as the upper limit instead, which also avoids the regression on the device above. Fixes: ef5749ef8b30 ("ALSA: usb-audio: Prevent excessive number of frames") Link: https://bugzilla.kernel.org/show_bug.cgi?id=220997 Link: https://patch.msgid.link/20260121082025.718748-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Conflicts: sound/usb/pcm.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4@huawei.com> --- sound/usb/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 3ae68e7ed134..57f3436e4f40 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -1607,7 +1607,8 @@ static void prepare_playback_urb(struct snd_usb_substream *subs, else counts = snd_usb_endpoint_next_packet_size(ep); - if (counts < 0 || frames + counts >= ep->max_urb_frames) + if (counts < 0 || + (frames + counts) * ep->stride > ctx->buffer_size) break; /* set up descriptor */ urb->iso_frame_desc[i].offset = frames * ep->stride; -- 2.43.0