[PATCH RESEND] ALSA: scarlett2: Fix buffer overflow in config retrieval

[PATCH RESEND] ALSA: scarlett2: Fix buffer overflow in config retrieval

[Samasth Norway Ananda]

The scarlett2_usb_get_config() function has a logic error in the
endianness conversion code that can cause buffer overflows when
count > 1.

The code checks `if (size == 2)` where `size` is the total buffer size in
bytes, then loops `count` times treating each element as u16 (2 bytes).
This causes the loop to access `count * 2` bytes when the buffer only
has `size` bytes allocated.

Fix by checking the element size (config_item->size) instead of the
total buffer size. This ensures the endianness conversion matches the
actual element type.

Fixes: ac34df733d2d ("ALSA: usb-audio: scarlett2: Update get_config to do endian conversion")
Cc: stable@vger.kernel.org
Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
---
 sound/usb/mixer_scarlett2.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
index 1150cf104985..8ec436cf10e4 100644
--- a/sound/usb/mixer_scarlett2.c
+++ b/sound/usb/mixer_scarlett2.c
@@ -2489,13 +2489,13 @@ static int scarlett2_usb_get_config(
 		err = scarlett2_usb_get(mixer, config_item->offset, buf, size);
 		if (err < 0)
 			return err;
-		if (size == 2) {
+		if (config_item->size == 16) {
 			u16 *buf_16 = buf;
 
 			for (i = 0; i < count; i++, buf_16++)
 				*buf_16 = le16_to_cpu(*(__le16 *)buf_16);
-		} else if (size == 4) {
-			u32 *buf_32 = buf;
+		} else if (config_item->size == 32) {
+			u32 *buf_32 = (u32 *)buf;
 
 			for (i = 0; i < count; i++, buf_32++)
 				*buf_32 = le32_to_cpu(*(__le32 *)buf_32);
-- 
2.50.1

Re: [PATCH RESEND] ALSA: scarlett2: Fix buffer overflow in config retrieval

[Takashi Iwai]

On Sat, 17 Jan 2026 02:27:06 +0100,
Samasth Norway Ananda wrote:
> 
> The scarlett2_usb_get_config() function has a logic error in the
> endianness conversion code that can cause buffer overflows when
> count > 1.
> 
> The code checks `if (size == 2)` where `size` is the total buffer size in
> bytes, then loops `count` times treating each element as u16 (2 bytes).
> This causes the loop to access `count * 2` bytes when the buffer only
> has `size` bytes allocated.
> 
> Fix by checking the element size (config_item->size) instead of the
> total buffer size. This ensures the endianness conversion matches the
> actual element type.
> 
> Fixes: ac34df733d2d ("ALSA: usb-audio: scarlett2: Update get_config to do endian conversion")
> Cc: stable@vger.kernel.org
> Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>

Applied now.  Thanks.


Takashi