CVE-2026-98312: ALSA: 6fire: fix OOB write from device-reported iso length

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: fix OOB write from device-reported iso length

usb6firepcminurbhandler() sizes each outgoing isochronous packet as (actuallength - 4) / (innanalog << 2) (outnanalog << 2) + 4, where actuallength is the unsigned length the device reported for the matching IN packet. A packet completed with status 0 and actuallength < 4 wraps the subtraction to 0x7fffffec; a zero-length isochronous packet is legal on the bus, and the preceding loop rejects only non-zero status. The sum reaches memset() on outurb->buffer, a 4832-byte object from kcalloc(PCMMAXPACKETSIZE, PCMNPACKETSPERURB).

Even without the wrap the result is out of bounds: at 88.2/96 kHz the 4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight packets span 5024 bytes of that buffer. usbsubmiturb() rejects an over-long descriptor only after the memset() and the usb6firepcmplayback() copy of user PCM data have run.

Guard the subtraction as the sibling usb6firepcmcapture() already does, and limit the frame count to what fits in rt->outpacketsize, the OUT endpoint's wMaxPacketSize. This bounds totallength by the buffer size while keeping each packet length aligned to a whole output frame.

BUG: KASAN: out-of-bounds in usb6firepcminurbhandler (sound/usb/6fire/pcm.c:338) Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhcirx/5018 Call Trace: dumpstacklvl (lib/dumpstack.c:94 lib/dumpstack.c:120) printreport (mm/kasan/report.c:378 mm/kasan/report.c:482) kasanreport (mm/kasan/report.c:595) kasancheckrange (mm/kasan/generic.c:186 mm/kasan/generic.c:200) asanmemset (mm/kasan/shadow.c:84) usb6firepcminurbhandler (sound/usb/6fire/pcm.c:338) usbhcdgivebackurb (drivers/usb/core/hcd.c:1657) usbhcdgivebackurb (drivers/usb/core/hcd.c:1741) vhcirxloop (drivers/usb/usbip/vhcirx.c:107 drivers/usb/usbip/vhcirx.c:242) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245)

Allocated by task 10: kmalloccachenoprof (mm/slub.c:5563) usb6firepcminit (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595) usb6firechipprobe (sound/usb/6fire/chip.c:133) usbprobeinterface (drivers/usb/core/driver.c:399)

The buggy address belongs to the object at ffff88802a3d0000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 0 bytes inside of 4832-byte region [ffff88802a3d0000, ffff88802a3d12e0) Kernel panic - not syncing: Fatal exception in interrupt