The playback buffer is sized from the OUT endpoint's max_packet_size_out, but submit_audio_out_urb() takes the length to write into it from prev_fsize, which audio_in_callback() derived from the IN endpoint. Both come from the device's own descriptors and nothing relates them, so a device declaring a large iso IN and a small iso OUT wMaxPacketSize overflows the buffer. usb_submit_urb() rejects the oversized URB, but only after the write has run. Attaching the device is the whole trigger: toneport_startup() acquires the monitor stream and starts both URB streams on its own, so the overflow happens in the URB completion handler with no local process involved. Clamp the length to max_packet_size_out. A device whose OUT endpoint matches the audio format it announces never reaches the limit. BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound/usb/line6/playback.c:242) Write of size 1024 at addr ffff88801b94bc00 by task vhci_rx/183 Call Trace: kasan_report (mm/kasan/report.c:595) kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200) __asan_memset (mm/kasan/shadow.c:84) submit_audio_out_urb (sound/usb/line6/playback.c:242) audio_out_callback (sound/usb/line6/playback.c:354) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741) vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The buggy address belongs to the object at ffff88801b94bc00 which belongs to the cache kmalloc-512 of size 512 Cc: stable@vger.kernel.org Fixes: 7a0f55aeeb8f ("ALSA: line6: Support assymetrical in/out configurations") Reported-by: Assisted-by: LLM Signed-off-by: Xiang Mei --- sound/usb/line6/playback.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/usb/line6/playback.c b/sound/usb/line6/playback.c index 7ebaf125f969..cfb20585c5ea 100644 --- a/sound/usb/line6/playback.c +++ b/sound/usb/line6/playback.c @@ -181,6 +181,7 @@ static int submit_audio_out_urb(struct snd_line6_pcm *line6pcm) } fsize *= bytes_per_frame; + fsize = min(fsize, line6pcm->max_packet_size_out); fout->offset = urb_size; fout->length = fsize; -- 2.43.0