ALSA: usb-audio: caiaq: validate EP1 reply lengths

usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then
reads command-specific fixed items from the same URB buffer. Several
paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that
urb->actual_length contains those bytes.

Add per-command length checks, use a payload length derived from the
bytes after the command byte for the control-state copy, and reject short
analog input payloads before the input helper reads fixed offsets from
the EP1 reply.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260705084601.56400-1-pengpeng@iscas.ac.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index b20aae0caf60a4be06a5109d243d030a5c248290..a16e5924848033ba872465f2bc0774b8e195246b 100644 (file)
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -134,14 +134,22 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
        struct device *dev = &urb->dev->dev;
        struct snd_usb_caiaqdev *cdev = urb->context;
        unsigned char *buf = urb->transfer_buffer;
+       unsigned int payload_len;
+       unsigned int copy_len;
 
        if (urb->status || !cdev) {
                dev_warn(dev, "received EP1 urb->status = %i\n", urb->status);
                return;
        }
+       if (urb->actual_length < 1)
+               return;
+
+       payload_len = urb->actual_length - 1;
 
        switch(buf[0]) {
        case EP1_CMD_GET_DEVICE_INFO:
+               if (payload_len < sizeof(struct caiaq_device_spec))
+                       break;
                memcpy(&cdev->spec, buf+1, sizeof(struct caiaq_device_spec));
                cdev->spec.fw_version = le16_to_cpu(cdev->spec.fw_version);
                dev_dbg(dev, "device spec (firmware %d): audio: %d in, %d out, "
@@ -157,18 +165,21 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
                wake_up(&cdev->ep1_wait_queue);
                break;
        case EP1_CMD_AUDIO_PARAMS:
+               if (payload_len < 1)
+                       break;
                cdev->audio_parm_answer = buf[1];
                wake_up(&cdev->ep1_wait_queue);
                break;
        case EP1_CMD_MIDI_READ:
+               if (urb->actual_length < 3 || urb->actual_length - 3 < buf[2])
+                       break;
                snd_usb_caiaq_midi_handle_input(cdev, buf[1], buf + 3, buf[2]);
                break;
        case EP1_CMD_READ_IO:
                if (cdev->chip.usb_id ==
                        USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO8DJ)) {
-                       if (urb->actual_length > sizeof(cdev->control_state))
-                               urb->actual_length = sizeof(cdev->control_state);
-                       memcpy(cdev->control_state, buf + 1, urb->actual_length);
+                       copy_len = min_t(unsigned int, payload_len, sizeof(cdev->control_state));
+                       memcpy(cdev->control_state, buf + 1, copy_len);
                        wake_up(&cdev->ep1_wait_queue);
                        break;
                }

diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c
index eabbf41fdfb2b21874542a75a2c49ef312054fcf..8d924330c54c884878cc556888ffebcdfb4cae9a 100644 (file)
--- a/sound/usb/caiaq/input.c
+++ b/sound/usb/caiaq/input.c
@@ -203,6 +203,8 @@ static void snd_caiaq_input_read_analog(struct snd_usb_caiaqdev *cdev,
 
        switch (cdev->chip.usb_id) {
        case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_RIGKONTROL2):
+               if (len < 6)
+                       return;
                snd_caiaq_input_report_abs(cdev, ABS_X, buf, 2);
                snd_caiaq_input_report_abs(cdev, ABS_Y, buf, 0);
                snd_caiaq_input_report_abs(cdev, ABS_Z, buf, 1);
@@ -210,11 +212,15 @@ static void snd_caiaq_input_read_analog(struct snd_usb_caiaqdev *cdev,
        case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_RIGKONTROL3):
        case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_KORECONTROLLER):
        case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_KORECONTROLLER2):
+               if (len < 6)
+                       return;
                snd_caiaq_input_report_abs(cdev, ABS_X, buf, 0);
                snd_caiaq_input_report_abs(cdev, ABS_Y, buf, 1);
                snd_caiaq_input_report_abs(cdev, ABS_Z, buf, 2);
                break;
        case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_TRAKTORKONTROLX1):
+               if (len < 16)
+                       return;
                snd_caiaq_input_report_abs(cdev, ABS_HAT0X, buf, 4);
                snd_caiaq_input_report_abs(cdev, ABS_HAT0Y, buf, 2);
                snd_caiaq_input_report_abs(cdev, ABS_HAT1X, buf, 6);