Re: [PATCH] usb: gadget: midi2: prevent in/out jack from oob

[Edward Adam Davis]

From: Edward Aadm Davis <eadavis@xxxxxxxx>

On Fri, 28 Aug 2026 14:07:43 +0200, Takashi Iwai wrote:
> > The increment of config->jack_out in append_midi1_out_jack() lacked
> > bounds checking, triggering issue [1] when the value approached the
> > limit MAX_CABLES.
> >
> > A similar out-of-bounds issue exists in append_midi1_in_jack(), so it
> > is being fixed as well.
> >
> > Before incrementing jack_out/in, the code now checks if the value has
> > reached the upper limit MAX_CABLES; if so, it exits and returns -EINVAL.
> >
> > Additionally, the jack_id assignment is moved to occur after the jack_out
> > bounds check to prevent wasting IDs on invalid increments.
> 
> I think the bug is rather the arrays are too small; they should have
> been twice as the jacks can be added from both input and output.
> 
> Both append_midi1_out_jack() and append_midi1_in_jack() are called
> from the loops of midi2->num_midi1_out and midi2->num_midi1_in
> counts, and they are properly upper-bound to MAX_CABLES.
In reproducer, set num_groups and midi1_num_groups to 16, this will cause
num_midi1_in and num_midi1_out to both be 16 (total 32), overflowing the
MAX_CABLES (16) sized arrays on the stack during bind.
> 
> Could you check whether the fix below works instead?
Yes, the fix below works.

cheers,
Edward
> 
> 
> thanks,
> 
> Takashi
> 
> --- a/drivers/usb/gadget/function/f_midi2.c
> +++ b/drivers/usb/gadget/function/f_midi2.c
> @@ -1634,8 +1634,8 @@ struct f_midi2_usb_config {
> 
>  	/* MIDI 1.0 jacks */
>  	unsigned char jack_in, jack_out, jack_id;
> -	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES];
> -	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES];
> +	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES * 2];
> +	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES * 2];
>  };
> 
>  static int append_config(struct f_midi2_usb_config *config, void *d)