[PATCH] ALSA: usx2y: Count completions apart from the URB array length

[PATCH] ALSA: usx2y: Count completions apart from the URB array length

[Sinan Turunc]

usx2y_rate_set() allocates a snd_usx2y_urb_seq with len set to the
number of URBs, and i_usx2y_04int() decrements len once per completed
URB to know when all of them are done. Since len is also the
__counted_by() bound of the urb[] array, every access to the array after
the first completion is out of range for UBSAN, and the cleanup loop in
usx2y_rate_set() trips it on every prepare:

  UBSAN: array-index-out-of-bounds in sound/usb/usx2y/usbusx2yaudio.c:694:18
  index 0 is out of range for type 'urb *[*]'

Count the completions in a separate field and leave len as the array
length.

Tested on 7.3-rc7 with CONFIG_UBSAN_BOUNDS and an emulated US-122 over
USB/IP: before, the report appears on every prepare; after, a 30 s
capture stream prepares and runs without it and the rate sequence still
completes.

Fixes: f5cc9cdfc96f ("ALSA: usx2y: Annotate struct snd_usx2y_urb_seq with __counted_by")
Signed-off-by: Sinan Turunc <enscrpt@pm.me>
---
 2 file(s) changed, 5 insertions(+), 3 deletions(-)

diff --git a/sound/usb/usx2y/usbusx2y.h b/sound/usb/usx2y/usbusx2y.h
index 7b6deed17d4..17edafdcc89 100644
--- a/sound/usb/usx2y/usbusx2y.h
+++ b/sound/usb/usx2y/usbusx2y.h
@@ -46,6 +46,7 @@ struct snd_usx2y_async_seq {
 struct snd_usx2y_urb_seq {
 	int	submitted;
 	int	len;
+	int	pending;	/* completions still to come */
 	struct urb	*urb[] __counted_by(len);
 };
 
diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
index a3a0bc13632..e03f7e4e8cb 100644
--- a/sound/usb/usx2y/usbusx2yaudio.c
+++ b/sound/usb/usx2y/usbusx2yaudio.c
@@ -643,7 +643,7 @@ static void i_usx2y_04int(struct urb *urb)
 	if (urb->status)
 		dev_err(&urb->dev->dev, "%s() urb->status=%i\n",
 			__func__, urb->status);
-	if (!--usx2y->us04->len)
+	if (!--usx2y->us04->pending)
 		wake_up(&usx2y->in04_wait_queue);
 }
 
@@ -662,6 +662,7 @@ static int usx2y_rate_set(struct usx2ydev *usx2y, int rate)
 			goto cleanup;
 		}
 		us->len = NOOF_SETRATE_URBS;
+		us->pending = NOOF_SETRATE_URBS;
 		usbdata = kmalloc_objs(int, NOOF_SETRATE_URBS);
 		if (!usbdata) {
 			err = -ENOMEM;
@@ -683,9 +684,9 @@ static int usx2y_rate_set(struct usx2ydev *usx2y, int rate)
 			goto cleanup;
 		us->submitted =	0;
 		usx2y->us04 =	us;
-		wait_event_timeout(usx2y->in04_wait_queue, !us->len, HZ);
+		wait_event_timeout(usx2y->in04_wait_queue, !us->pending, HZ);
 		usx2y->us04 =	NULL;
-		if (us->len)
+		if (us->pending)
 			err = -ENODEV;
 	cleanup:
 		if (us) {
-- 
2.56.0