Re: [PATCH 1/2] ALSA: usbusx2y: fix in04_last array size causing slab OOB read

[Takashi Iwai <tiwai@suse.de>]

On Fri, 04 Sep 2026 11:51:54 +0200,
Tristan Madani wrote:
> 
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> The in04_last array in struct usx2ydev is declared as char[24], but
> in04_buf (the source for memcpy) is allocated with kmalloc(21).  In
> i_usx2y_in04_int(), when ctl_snapshot_last == -2 (initialization path):
> 
>     memcpy(usx2y->in04_last, usx2y->in04_buf, sizeof(usx2y->in04_last));
> 
> This copies 24 bytes from a 21-byte slab allocation, reading 3 bytes
> past the end of the kmalloc-32 object.
> 
> The comparison loop already uses the correct bound of 21:
> 
>     for (i = 0; i < 21; i++) {
> 
> Fix by reducing the in04_last array to 21 bytes, matching the actual
> USB interrupt transfer size and the in04_buf allocation.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Better to introduce a constant definition and use it in all places
instead of magic numbers.  Could you rework your patches with it?


thanks,

Takashi