From ccfe6ab672c020fca56988e634088bfb7764e2a7 Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Tue, 6 Oct 2026 15:44:04 +0200 Subject: [PATCH] ALSA: caiaq: Allow zero-length packet handling for EP1 The recent fix to avoid OOB access for malformed packets added a packet length check and returns immediately if it's too short. However, this can be lead to a regression because the completion handler doesn't resubmit the packet, while a zero-length packet itself is valid, per se. For addressing the potential regression above, change the handling for a zero-length packet to just resubmit without processing the incoming contents. Fixes: aba30af07d4f ("ALSA: usb-audio: caiaq: validate EP1 reply lengths") Link: https://patch.msgid.link/20261006134405.479603-1-tiwai@suse.de Signed-off-by: Takashi Iwai --- sound/usb/caiaq/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index dea3a68ca896..a596f5f763b8 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -143,7 +143,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) return; } if (urb->actual_length < 1) - return; + goto resubmit; payload_len = urb->actual_length - 1; @@ -193,6 +193,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) break; } + resubmit: cdev->ep1_in_urb->actual_length = 0; ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); if (ret < 0)