Re: [syzbot] [usb?] KASAN: stack-out-of-bounds Write in append_midi1_out_jack

[syzbot <syzbot+c35f34092a4bc9855be6@syzkaller.appspotmail.com>]

> From: Edward Aadm Davis <eadavis@sina.com>
>
> #syz test

"" does not look like a valid git branch or commit.

>
> diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c
> index 19fdac024343..06a3add05447 100644
> --- a/drivers/usb/gadget/function/f_midi2.c
> +++ b/drivers/usb/gadget/function/f_midi2.c
> @@ -1675,11 +1675,15 @@ static int append_midi1_in_jack(struct f_midi2 *midi2,
>  				struct midi1_cable_mapping *map,
>  				unsigned int type)
>  {
> -	struct usb_midi_in_jack_descriptor *jack =
> -		&config->jack_ins[config->jack_in++];
> -	int id = ++config->jack_id;
> +	struct usb_midi_in_jack_descriptor *jack;
> +	int id;
>  	int err;
>  
> +	if (config->jack_in >= MAX_CABLES)
> +		return -EINVAL;
> +
> +	id = ++config->jack_id;
> +	jack = &config->jack_ins[config->jack_in++];
>  	jack->bLength = 0x06;
>  	jack->bDescriptorType = USB_DT_CS_INTERFACE;
>  	jack->bDescriptorSubtype = USB_MS_MIDI_IN_JACK;
> @@ -1700,11 +1704,15 @@ static int append_midi1_out_jack(struct f_midi2 *midi2,
>  				 struct midi1_cable_mapping *map,
>  				 unsigned int type, unsigned int source)
>  {
> -	struct usb_midi_out_jack_descriptor_1 *jack =
> -		&config->jack_outs[config->jack_out++];
> -	int id = ++config->jack_id;
> +	struct usb_midi_out_jack_descriptor_1 *jack;
> +	int id;
>  	int err;
>  
> +	if (config->jack_out >= MAX_CABLES)
> +		return -EINVAL;
> +
> +	id = ++config->jack_id;
> +	jack = &config->jack_outs[config->jack_out++];
>  	jack->bLength = 0x09;
>  	jack->bDescriptorType = USB_DT_CS_INTERFACE;
>  	jack->bDescriptorSubtype = USB_MS_MIDI_OUT_JACK;