github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ALSA: caiaq: Allow zero-length packet handling for EP1

Browse Source 
The recent fix to avoid OOB access for malformed packets added a
packet length check and returns immediately if it's too short.
However, this can be lead to a regression because the completion
handler doesn't resubmit the packet, while a zero-length packet itself
is valid, per se.

For addressing the potential regression above, change the handling for
a zero-length packet to just resubmit without processing the incoming
contents.

Fixes: aba30af07d ("ALSA: usb-audio: caiaq: validate EP1 reply lengths")
Link: https://patch.msgid.link/20261006134405.479603-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2026-10-06 15:44:04 +02:00
parent 5cc1749b5f
commit ccfe6ab672
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sound/usb/caiaq/device.c
View File

@ -143,7 +143,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
return;
}
if (urb->actual_length < 1)
return;
goto resubmit;
payload_len = urb->actual_length - 1;
@ -193,6 +193,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
break;
}
resubmit:
cdev->ep1_in_urb->actual_length = 0;
ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
if (ret < 0)