Re: [PATCH] usb: gadget: midi2: prevent in/out jack from oob

[Takashi Iwai <tiwai@suse.de>]

On Wed, 26 Aug 2026 15:46:06 +0200,
Edward Adam Davis wrote:
> 
> The increment of config->jack_out in append_midi1_out_jack() lacked
> bounds checking, triggering issue [1] when the value approached the
> limit MAX_CABLES.
> 
> A similar out-of-bounds issue exists in append_midi1_in_jack(), so it
> is being fixed as well.
> 
> Before incrementing jack_out/in, the code now checks if the value has
> reached the upper limit MAX_CABLES; if so, it exits and returns -EINVAL.
> 
> Additionally, the jack_id assignment is moved to occur after the jack_out
> bounds check to prevent wasting IDs on invalid increments.

I think the bug is rather the arrays are too small; they should have
been twice as the jacks can be added from both input and output.

Both append_midi1_out_jack() and append_midi1_in_jack() are called
from the loops of midi2->num_midi1_out and midi2->num_midi1_in
counts, and they are properly upper-bound to MAX_CABLES.

Could you check whether the fix below works instead?


thanks,

Takashi

--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -1634,8 +1634,8 @@ struct f_midi2_usb_config {
 
 	/* MIDI 1.0 jacks */
 	unsigned char jack_in, jack_out, jack_id;
-	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES];
-	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES];
+	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES * 2];
+	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES * 2];
 };
 
 static int append_config(struct f_midi2_usb_config *config, void *d)