Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #94774

Bug#1152888: Regression: MOTU M4 USB audio playback fails with EIO on Linux 6.12.115 (works on 6.12.113)

Cross-posted to 2 groups.

Show all headers | View raw

Hi Salvatore,

I downloaded upstream 6.12.115, applied patch 70b4db7d2581.patch from 
torvalds' repository with the diff

###
git diff -- sound/usb/pcm.c
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 3a4666e3b..bbffd978b 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -1505,7 +1505,8 @@ static int prepare_playback_urb(struct 
snd_usb_substream *subs,

         for (i = 0; i < ctx->packets; i++) {
                 counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 
avail);
-               if (counts < 0 || frames + counts >= ep->max_urb_frames)
+                       if (counts < 0 ||
+                           (frames + counts) * stride > ctx->buffer_size)
                         break;
                 /* set up descriptor */
                 urb->iso_frame_desc[i].offset = frames * stride;
###

After compiling and booting into that kernel, the sound works!

Best regards
Benjamin

Am 04.11.26 um 05:49 schrieb Salvatore Bonaccorso:
> Control: tags -1 + upstream
> Control: forwarded -1 https://lore.kernel.org/all/shfaXkZCI7FtyNr5tS4kCC_d5E4uQFhc0MtwJa2CQFXpNMfSw7Ub6urwWpGrcoRnHuoneJEi9mLwtnvVImMhz1Hb25iwNJxx8GZZsDCV_HE=@protonmail.com/
> 
> Hi
> On Tue, Nov 03, 2026 at 11:22:16PM +0100, Benjamin Scherrer wrote:
>> Hi Salvatore,
>>
>> thanks a lot for the quick reply.
>>
>> It really is an upstream problem. It works with the upstream 6.12.113 kernel
>> but fails with 6.12.115.
>>
>> I dissected it and only built about 10 kernels, haven't done this in years
>> ;)
>>
>> output of last 'git bisect bad':
>>
>> ---
>> 81e4b0009f2acc841d77a24fd796528b0bf62c4e is the first bad commit
>> commit 81e4b0009f2acc841d77a24fd796528b0bf62c4e (HEAD)
>> Author: Edward Adam Davis <eadavis@qq.com>
>> Date:   Tue Jan 13 16:29:23 2026 +0800
>>
>>      ALSA: usb-audio: Prevent excessive number of frames
>>
>>      [ Upstream commit ef5749ef8b307bf8717945701b1b79d036af0a15 ]
>>
>>      In this case, the user constructed the parameters with maxpacksize 40
>>      for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer
>>      size for each data URB is maxpacksize * packets, which in this example
>>      is 40 * 6 = 240; When the user performs a write operation to send audio
>>      data into the ALSA PCM playback stream, the calculated number of frames
>>      is packsize[0] * packets = 264, which exceeds the allocated URB buffer
>>      size, triggering the out-of-bounds (OOB) issue reported by syzbot [1].
>>
>>      Added a check for the number of single data URB frames when calculating
>>      the number of frames to prevent [1].
>>
>>      [1]
>>      BUG: KASAN: slab-out-of-bounds in copy_to_urb+0x261/0x460
>> sound/usb/pcm.c:1487
>>      Write of size 264 at addr ffff88804337e800 by task syz.0.17/5506
>>      Call Trace:
>>       copy_to_urb+0x261/0x460 sound/usb/pcm.c:1487
>>       prepare_playback_urb+0x953/0x13d0 sound/usb/pcm.c:1611
>>       prepare_outbound_urb+0x377/0xc50 sound/usb/endpoint.c:333
>>
>>      Reported-by: syzbot+6db0415d6d5c635f72cb@syzkaller.appspotmail.com
>>      Closes: https://syzkaller.appspot.com/bug?extid=6db0415d6d5c635f72cb
>>      Tested-by: syzbot+6db0415d6d5c635f72cb@syzkaller.appspotmail.com
>>      Signed-off-by: Edward Adam Davis <eadavis@qq.com>
>>      Link:
>> https://patch.msgid.link/tencent_9AECE6CD2C7A826D902D696C289724E8120A@qq.com
>>      Signed-off-by: Takashi Iwai <tiwai@suse.de>
>>      Signed-off-by: Sasha Levin <sashal@kernel.org>
>>
>>   sound/usb/pcm.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>> ---
>>
>> output of 'git bisect log':
>>
>> ---
>> git bisect start
>> # Status: warte auf guten und schlechten Commit
>> # good: [7fdb7c1824a1f9979d648d7ae28ac446bcee9c6e] Linux 6.12.113
>> git bisect good 7fdb7c1824a1f9979d648d7ae28ac446bcee9c6e
>> # Status: warte auf schlechten Commit, 1 guter Commit bekannt
>> # bad: [03bae623ec326c2738198739625832aab0eb120a] Linux 6.12.115
>> git bisect bad 03bae623ec326c2738198739625832aab0eb120a
>> # bad: [9afcfc4c6597547c20d6354fa68f1d6012e31c0e] wifi: iwlwifi: dvm: pair
>> transport op-mode enter/leave
>> git bisect bad 9afcfc4c6597547c20d6354fa68f1d6012e31c0e
>> # bad: [33201705179d94985c788ae9186ceeab044fb6bd] ceph: Remove uses of page
>> from ceph_process_folio_batch()
>> git bisect bad 33201705179d94985c788ae9186ceeab044fb6bd
>> # good: [39870dbccdea99e1aa0ae445ab913748e912a352] ASoC: Intel: avs: Use
>> topology information for endpoint numbers
>> git bisect good 39870dbccdea99e1aa0ae445ab913748e912a352
>> # bad: [58a4c2dbe6f746cdf9ea06fcaeda535aecb4b80b] bnxt_en: Update firmware
>> interface spec to 1.10.3.85
>> git bisect bad 58a4c2dbe6f746cdf9ea06fcaeda535aecb4b80b
>> # good: [20b3c72c1b83054c568d2322a95e217fdc281bc3] bpf: Mark bpf_refcount
>> field as unique
>> git bisect good 20b3c72c1b83054c568d2322a95e217fdc281bc3
>> # bad: [4eca06a55417c3b2e538656d12c89e224343653e] bpf: Fix exception exit
>> lock checking for subprogs
>> git bisect bad 4eca06a55417c3b2e538656d12c89e224343653e
>> # bad: [f8b8ec0ddde74066d4452a7a961da544f193e00f] riscv: trace: fix snapshot
>> deadlock with sbi ecall
>> git bisect bad f8b8ec0ddde74066d4452a7a961da544f193e00f
>> # good: [f32ae3cfc976074e9c5927893ce49bcf12f53748] idpf: fix error handling
>> in the init_task on load
>> git bisect good f32ae3cfc976074e9c5927893ce49bcf12f53748
>> # good: [d1e9614a142eff34c93e94a15a71ad0e806799c4] virtio_net: Fix
>> misalignment bug in struct virtnet_info
>> git bisect good d1e9614a142eff34c93e94a15a71ad0e806799c4
>> # bad: [81e4b0009f2acc841d77a24fd796528b0bf62c4e] ALSA: usb-audio: Prevent
>> excessive number of frames
>> git bisect bad 81e4b0009f2acc841d77a24fd796528b0bf62c4e
>> # first bad commit: [81e4b0009f2acc841d77a24fd796528b0bf62c4e] ALSA:
>> usb-audio: Prevent excessive number of frames
>> ---
>>
>> I hope this helps!
> 
> Yes it does, thank you for having taken the time to do his. At same
> time another user reported already the issue upstream reaching the
> same commit:
> https://lore.kernel.org/all/shfaXkZCI7FtyNr5tS4kCC_d5E4uQFhc0MtwJa2CQFXpNMfSw7Ub6urwWpGrcoRnHuoneJEi9mLwtnvVImMhz1Hb25iwNJxx8GZZsDCV_HE=@protonmail.com/
> 
> Would it be possible that you check with 6.12.115-2 and the commit
> 70b4db7d2581 ("ALSA: usb-audio: Use the right limit for PCM OOB
> check") on top if that fixes your problem?
> 
> You can either build 6.12.115 upstream with that commit on top, or
> follow
> https://kernel-team.pages.debian.net/kernel-handbook/ch-common-tasks.html#id-1.6.6.4
> to make the Debian packaging for 6.12.115-2 with a single patch on top
> to test the fix.
> 
> But let me know if that does not help and you need more detailed help.
> 
> Regards,
> Salvatore
> 

Back to linux.debian.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1152888: Regression: MOTU M4 USB audio playback fails with EIO on Linux 6.12.115 (works on 6.12.113) Benjamin Scherrer <benjamin@wagnerbrutal.de> - 2026-11-02 22:20 +0100
  Processed: Re: Bug#1152888: Regression: MOTU M4 USB audio  playback fails with EIO on Linux 6.12.115 (works on 6.12.113) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-11-03 17:20 +0100
  Bug#1152888: Regression: MOTU M4 USB audio playback fails with EIO on Linux 6.12.115 (works on 6.12.113) Salvatore Bonaccorso <carnil@debian.org> - 2026-11-03 17:20 +0100
    Bug#1152888: Regression: MOTU M4 USB audio playback fails with EIO on Linux 6.12.115 (works on 6.12.113) Benjamin Scherrer <benjamin@wagnerbrutal.de> - 2026-11-03 23:50 +0100
  Bug#1152888: Regression: MOTU M4 USB audio playback fails with EIO on Linux 6.12.115 (works on 6.12.113) Sebastian Kiesel <sebastian-debian-reportbug@skiesel.de> - 2026-11-03 17:40 +0100
  Bug#1152888:  Michele Zelioli <michele.zelioli@ik.me> - 2026-11-03 21:50 +0100
  Bug#1152888: MOTU M2 also affected by 6.12.115 USB audio regression Christopher Ludwin <cjludwin@pm.me> - 2026-11-03 23:10 +0100
  Bug#1152888: Regression: MOTU M4 USB audio playback fails with  EIO on Linux 6.12.115 (works on 6.12.113) "smg" <smgdream@foxmail.com> - 2026-11-04 04:20 +0100
  Processed: Re: Bug#1152888: Regression: MOTU M4 USB audio  playback fails with EIO on Linux 6.12.115 (works on 6.12.113) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-11-04 06:00 +0100
  Bug#1152888: Regression: MOTU M4 USB audio playback fails with  EIO on Linux 6.12.115 (works on 6.12.113) "smg" <smgdream@foxmail.com> - 2026-11-04 16:20 +0100
  Bug#1152888: Regression: MOTU M4 USB audio playback fails with EIO on Linux 6.12.115 (works on 6.12.113) Benjamin Scherrer <benjamin@wagnerbrutal.de> - 2026-11-04 17:30 +0100
  Bug#1152888: Regression: MOTU M4 USB audio playback fails with EIO on Linux 6.12.115 (works on 6.12.113) Sebastian Kiesel <sebastian-debian-reportbug@skiesel.de> - 2026-11-04 18:50 +0100
  Processed: Re: Bug#1152888: Regression: MOTU M4 USB audio  playback fails with EIO on Linux 6.12.115 (works on 6.12.113) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-11-05 07:50 +0100

csiph-web