[PATCH] ALSA: caiaq: Allow zero-length packet handling for EP1

From: Takashi Iwai

Date: Tue Oct 06 2026 - 09:47:58 EST


The recent fix to avoid OOB access for malformed packets added a
packet length check and returns immediately if it's too short.
However, this can be lead to a regression because the completion
handler doesn't resubmit the packet, while a zero-length packet itself
is valid, per se.

For addressing the potential regression above, change the handling for
a zero-length packet to just resubmit without processing the incoming
contents.

Fixes: aba30af07d4f ("ALSA: usb-audio: caiaq: validate EP1 reply lengths")
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
---
resubmitted due to a typo in the address, sorry for inconvenience!

sound/usb/caiaq/device.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index dea3a68ca896..a596f5f763b8 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -143,7 +143,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
return;
}
if (urb->actual_length < 1)
- return;
+ goto resubmit;

payload_len = urb->actual_length - 1;

@@ -193,6 +193,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb)
break;
}

+ resubmit:
cdev->ep1_in_urb->actual_length = 0;
ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC);
if (ret < 0)
--
2.55.0