From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8A5FE33262B for ; Thu, 18 Jun 2026 06:03:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781762604; cv=none; b=dASdN1DIJBOrybC8AOrLe4GnaBaaTb+LMA9L/eaQesH6l/Hwy60ITkLOq37cENy1Rz3ud+I/VvjHKY3/wDxTjsEc8HC1Ulx5saarCleQbpSa9GsVWSKt5zpd0QccMUWgScbWqsPfwNJoiYxc/ayacRpZ25czC+Fak1ZV3XdHrZw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781762604; c=relaxed/simple; bh=9hQ+y+2cB15DUeIjOLSE02Hu+4OpuQWzjib/vlo+S1w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=UmofQegAwsYlDBFN4a0Lj6/Oc2cBW7ieYA8Z/2rFs6vvsW9OkmHMTRt6uwM9oFLAcD2YFhDBNExS14t0scLYVelYU0qShRBPotJH0JAE2BU6OHULxxJv+8r8mQpzNLBAhc24QqPbEVmDDTHx8+9HbvS1oiAwxFEE689Y0F3mKBY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=C2bB8ny/; arc=none smtp.client-ip=209.85.214.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="C2bB8ny/" Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2c0aa420401so3542225ad.3 for ; Wed, 17 Jun 2026 23:03:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781762603; x=1782367403; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Q4dlGRcZf924ZYYuth1VpGV6uM41UtMmDO7yTax51U0=; b=C2bB8ny/Z4NgwWuErQcy0Cr+4oCUWVdnTUTuydkOEnHPKRctswagQqPJXTnN8X5+LO zbSSj/o1IXoiJTDaex509npau3rJ6pOUOf5/CH2F5Sn0JKe0wZ/Ke7891PFXx54ivFXl xj/hgoT9beLh18LgmsUCV9/46JdueGfj5ru/gBimcLBTcZaQCkfNzpSK6YQvudWHsr2t t1CtKGRcYuMIRXzhm8UbXmzfCgbbCrzUjm67XD22/6UjDnrQUMDUuzrfG5tXNHqlg/6q f2CzRq/RBmFtQaWkLJDUUsbSA3rIl0ZXS/NG7R3vhaBSap/j9XQBRgvT65VlSUPAjnDL u/8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781762603; x=1782367403; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Q4dlGRcZf924ZYYuth1VpGV6uM41UtMmDO7yTax51U0=; b=JvDWlrVn0j9/kYDVL9TcrEeFtYPnX73Iwns+R0ZUFGMNFzKOA3okLb6w2YU6dAMaGD WAblYnEGEWcHl8HbBuUG2/DObNKlJU7XkrlBNZsacquxM/uia7loNOsAjDDnUTVF8Evz ISe9IK5K2FC+8y9qF4ppBGTHt8N+2wWYGPB+XIGghz481BhShnbqcXfoQx/RZEjnFVjv ERs0+XU5iL96OTwLWaPiFkCju2/7f2FjSx/ZC2coXAtJbKTAdJsqNOlJT6+1eHx5i8vm KxJGOZbHOHfcYzVhIV52W9tKsPTnCE+2lTBP8D1rNzPiQAcFUWmXuHLLeoGwRKfbi61A 4Mow== X-Forwarded-Encrypted: i=1; AFNElJ/8F5YR+z7Pc/asSeENaB+5agTqzmXpa2Hfmzq/hSw70cco1gdFfKS3SM995mx1uG6IicAHFa/0nYtSHs8=@vger.kernel.org X-Gm-Message-State: AOJu0Yxc1c/JDQ6qhARpDzWYx4LgRN32Njy/7y1zGnva8P6pWysNV/9h b0k/mYttrj2bp3ACNuzV+ldVc9o1LG/8h4a7Yynky3Ixp1JgodR9zcuS X-Gm-Gg: AfdE7ckQLvofSo9bAYtSbFTuTc3J0TmAwUtek05fPcMN9pvfDoyl85AQMhNTsIIJNA6 cxR/4FWimYjnwrysTnjjwDci3Th6N+pLii1j1gl8DJwfliLcSHoWIIM7Yhhwekk94rQSZ0PagsP JUT6xs3hz2yQdsqRoKBwBA2Arx/82gqMw3Uvq+/hnTa36pLqZ9MEQg9XFA533pWH+IN9DSS1uTm X2uVx5Z0y0PI8UDz6cKwEv2tsmSrW9w/Lk4ItZ/SI3Oyc2/eKEjsL0KhTQ4XkS6tGvzogEhTiHf ftiJA0zDtGLvI2HUgJbbN5FBZp9njOBSdvoOXJ9yfCUm35HfgJyAgV6l/qrwpAGdCrr65bU0C1L 0pz9/IqtV/86bfUoBVKYmR9JKW02FgIHBp/G9ReS7ESwCaGU/BROnVgWYA6ckkOnzWWHiS81b41 VfBY/x5ZGQ1iWUSpEkvbVh+LDe4nSYuv/uKTC0sg== X-Received: by 2002:a17:903:2b03:b0:2c6:afa8:c181 with SMTP id d9443c01a7336-2c6bc0b11a9mr77756305ad.1.1781762602788; Wed, 17 Jun 2026 23:03:22 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c6be262b93sm42757485ad.68.2026.06.17.23.03.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Jun 2026 23:03:21 -0700 (PDT) From: Maoyi Xie To: Daniel Mack , Jaroslav Kysela , Takashi Iwai Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Date: Thu, 18 Jun 2026 14:03:15 +0800 Message-ID: <178176259547.3343534.2724779296835237429@maoyixie.com> In-Reply-To: <178176259547.3343534.6658931377288378506@maoyixie.com> References: <178176259547.3343534.6658931377288378506@maoyixie.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every iteration it advances buf and subtracts the block size while looping on "while (len)". len is urb->actual_length. That value is supplied by the device and is not guaranteed to be a multiple of 16. When a final short block leaves len between 1 and 15, the loop runs once more, reads up to buf[15], and then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows to a huge value. The loop then keeps iterating and walking buf far past the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus block id happens to be hit. Iterate only while a full message block is available. This stops the unsigned underflow and silently drops any trailing partial block, which carries no complete control value anyway. The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1 and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor urb->actual_length before dispatching. Fixes: 15c5ab607045 ("ALSA: snd-usb-caiaq: Add support for Traktor Kontrol S4") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie --- sound/usb/caiaq/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c index 5c70fdf61cc1..2db4d1332df1 100644 --- a/sound/usb/caiaq/input.c +++ b/sound/usb/caiaq/input.c @@ -330,7 +330,7 @@ static void snd_usb_caiaq_tks4_dispatch(struct snd_usb_caiaqdev *cdev, { struct device *dev = caiaqdev_to_dev(cdev); - while (len) { + while (len >= TKS4_MSGBLOCK_SIZE) { unsigned int i, block_id = (buf[0] << 8) | buf[1]; switch (block_id) { -- 2.34.1