[PATCH 1/3] ALSA: usb-audio: Check mixer matrix size for UAC2/3 at parsing

[Takashi Iwai]

The matrix of input/output channels specified in a UAC2/3 mixer unit
must fit to the upper limit 256.  Add a sanity check and returns an
error if an invalid size is detected.

Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
 sound/usb/mixer.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 33a6a1281410..ddfd7e01a3ef 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2436,6 +2436,16 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
 	num_outs = err;
 	input_pins = desc->bNrInPins;
 
+	if (state->mixer->protocol == UAC_VERSION_2 ||
+	    state->mixer->protocol == UAC_VERSION_3) {
+		if (input_pins * num_outs > 256) {
+			usb_audio_err(state->chip,
+				      "invalid channels for MIXER UNIT %d: input=%d, output=%d\n",
+				      unitid, input_pins, num_outs);
+			return -EINVAL;
+		}
+	}
+
 	num_ins = 0;
 	ich = 0;
 	for (pin = 0; pin < input_pins; pin++) {
-- 
2.55.0


--Multipart_Thu_Sep_17_16:49:35_2026-1
Content-Type: application/octet-stream; type=patch; name="0002-ALSA-usb-audio-Fix-UAC2-mixer-unit-request-handling.patch"
Content-Disposition: attachment; filename="0002-ALSA-usb-audio-Fix-UAC2-mixer-unit-request-handling.patch"
Content-Transfer-Encoding: 7bit