ALSA: usb-audio: Fix incorrect size check for processing/extension units

BugLink: https://bugs.launchpad.net/bugs/1853475
commit 976a68f06b2ea49e2ab67a5f84919a8b105db8be upstream.

The recently introduced unit descriptor validation had some bug for
processing and extension units, it counts a bControlSize byte twice so
it expected a bigger size than it should have been.  This seems
resulting in a probe error on a few devices.

Fix the calculation for proper checks of PU and EU.

Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units")
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20191114165613.7422-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/sound/usb/validate.c b/sound/usb/validate.c
index a5e584b60dcd83efd9b6732980e72e074e160c31..389e8657434ac40e8521e6b2858af1da7b5af9a6 100644 (file)
--- a/sound/usb/validate.c
+++ b/sound/usb/validate.c
@@ -81,9 +81,9 @@ static bool validate_processing_unit(const void *p,
        switch (v->protocol) {
        case UAC_VERSION_1:
        default:
-               /* bNrChannels, wChannelConfig, iChannelNames, bControlSize */
-               len += 1 + 2 + 1 + 1;
-               if (d->bLength < len) /* bControlSize */
+               /* bNrChannels, wChannelConfig, iChannelNames */
+               len += 1 + 2 + 1;
+               if (d->bLength < len + 1) /* bControlSize */
                        return false;
                m = hdr[len];
                len += 1 + m + 1; /* bControlSize, bmControls, iProcessing */