The increment of config->jack_out in append_midi1_out_jack() lacked
bounds checking, triggering issue [1] when the value approached the
limit MAX_CABLES.

A similar out-of-bounds issue exists in append_midi1_in_jack(), so it
is being fixed as well.

Before incrementing jack_out/in, the code now checks if the value has
reached the upper limit MAX_CABLES; if so, it exits and returns -EINVAL.

Additionally, the jack_id assignment is moved to occur after the jack_out
bounds check to prevent wasting IDs on invalid increments.

[1]
BUG: KASAN: stack-out-of-bounds in append_midi1_out_jack.isra.0+0x38c/0x470 drivers/usb/gadget/function/f_midi2.c:1713
Write of size 1 at addr ffffc90003277880 by task syz-executor119/6000
Call Trace:
 append_midi1_out_jack.isra.0+0x38c/0x470 drivers/usb/gadget/function/f_midi2.c:1713
 f_midi2_create_usb_configs+0x748/0xdf0 drivers/usb/gadget/function/f_midi2.c:1815
 f_midi2_bind+0x1d12/0x2770 drivers/usb/gadget/function/f_midi2.c:2013
 usb_add_function+0x219/0x890 drivers/usb/gadget/composite.c:333
 configfs_composite_bind+0xd83/0x1960 drivers/usb/gadget/configfs.c:1802
 gadget_bind_driver+0x28c/0xbf0 drivers/usb/gadget/udc/core.c:1662
 call_driver_probe drivers/base/dd.c:628 [inline]
 really_probe+0x241/0xa60 drivers/base/dd.c:706
 
Fixes: 856fa444b098 ("usb: gadget: midi2: Dynamically create MIDI 1.0 altset descriptors")
Reported-by: syzbot+c35f34092a4bc9855be6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c35f34092a4bc9855be6
Tested-by: syzbot+c35f34092a4bc9855be6@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
 drivers/usb/gadget/function/f_midi2.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/gadget/function/f_midi2.c b/drivers/usb/gadget/function/f_midi2.c
index 19fdac024343..06a3add05447 100644
--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -1675,11 +1675,15 @@ static int append_midi1_in_jack(struct f_midi2 *midi2,
 				struct midi1_cable_mapping *map,
 				unsigned int type)
 {
-	struct usb_midi_in_jack_descriptor *jack =
-		&config->jack_ins[config->jack_in++];
-	int id = ++config->jack_id;
+	struct usb_midi_in_jack_descriptor *jack;
+	int id;
 	int err;
 
+	if (config->jack_in >= MAX_CABLES)
+		return -EINVAL;
+
+	id = ++config->jack_id;
+	jack = &config->jack_ins[config->jack_in++];
 	jack->bLength = 0x06;
 	jack->bDescriptorType = USB_DT_CS_INTERFACE;
 	jack->bDescriptorSubtype = USB_MS_MIDI_IN_JACK;
@@ -1700,11 +1704,15 @@ static int append_midi1_out_jack(struct f_midi2 *midi2,
 				 struct midi1_cable_mapping *map,
 				 unsigned int type, unsigned int source)
 {
-	struct usb_midi_out_jack_descriptor_1 *jack =
-		&config->jack_outs[config->jack_out++];
-	int id = ++config->jack_id;
+	struct usb_midi_out_jack_descriptor_1 *jack;
+	int id;
 	int err;
 
+	if (config->jack_out >= MAX_CABLES)
+		return -EINVAL;
+
+	id = ++config->jack_id;
+	jack = &config->jack_outs[config->jack_out++];
 	jack->bLength = 0x09;
 	jack->bDescriptorType = USB_DT_CS_INTERFACE;
 	jack->bDescriptorSubtype = USB_MS_MIDI_OUT_JACK;
-- 
2.43.0

On Wed, 26 Aug 2026 15:46:06 +0200,
Edward Adam Davis wrote:
> 
> The increment of config->jack_out in append_midi1_out_jack() lacked
> bounds checking, triggering issue [1] when the value approached the
> limit MAX_CABLES.
> 
> A similar out-of-bounds issue exists in append_midi1_in_jack(), so it
> is being fixed as well.
> 
> Before incrementing jack_out/in, the code now checks if the value has
> reached the upper limit MAX_CABLES; if so, it exits and returns -EINVAL.
> 
> Additionally, the jack_id assignment is moved to occur after the jack_out
> bounds check to prevent wasting IDs on invalid increments.

I think the bug is rather the arrays are too small; they should have
been twice as the jacks can be added from both input and output.

Both append_midi1_out_jack() and append_midi1_in_jack() are called
from the loops of midi2->num_midi1_out and midi2->num_midi1_in
counts, and they are properly upper-bound to MAX_CABLES.

Could you check whether the fix below works instead?


thanks,

Takashi

--- a/drivers/usb/gadget/function/f_midi2.c
+++ b/drivers/usb/gadget/function/f_midi2.c
@@ -1634,8 +1634,8 @@ struct f_midi2_usb_config {
 
 	/* MIDI 1.0 jacks */
 	unsigned char jack_in, jack_out, jack_id;
-	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES];
-	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES];
+	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES * 2];
+	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES * 2];
 };
 
 static int append_config(struct f_midi2_usb_config *config, void *d)

From: Edward Aadm Davis <eadavis@sina.com>

On Fri, 28 Aug 2026 14:07:43 +0200, Takashi Iwai wrote:
> > The increment of config->jack_out in append_midi1_out_jack() lacked
> > bounds checking, triggering issue [1] when the value approached the
> > limit MAX_CABLES.
> >
> > A similar out-of-bounds issue exists in append_midi1_in_jack(), so it
> > is being fixed as well.
> >
> > Before incrementing jack_out/in, the code now checks if the value has
> > reached the upper limit MAX_CABLES; if so, it exits and returns -EINVAL.
> >
> > Additionally, the jack_id assignment is moved to occur after the jack_out
> > bounds check to prevent wasting IDs on invalid increments.
> 
> I think the bug is rather the arrays are too small; they should have
> been twice as the jacks can be added from both input and output.
> 
> Both append_midi1_out_jack() and append_midi1_in_jack() are called
> from the loops of midi2->num_midi1_out and midi2->num_midi1_in
> counts, and they are properly upper-bound to MAX_CABLES.
In reproducer, set num_groups and midi1_num_groups to 16, this will cause
num_midi1_in and num_midi1_out to both be 16 (total 32), overflowing the
MAX_CABLES (16) sized arrays on the stack during bind.
> 
> Could you check whether the fix below works instead?
Yes, the fix below works.

cheers,
Edward
> 
> 
> thanks,
> 
> Takashi
> 
> --- a/drivers/usb/gadget/function/f_midi2.c
> +++ b/drivers/usb/gadget/function/f_midi2.c
> @@ -1634,8 +1634,8 @@ struct f_midi2_usb_config {
> 
>  	/* MIDI 1.0 jacks */
>  	unsigned char jack_in, jack_out, jack_id;
> -	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES];
> -	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES];
> +	struct usb_midi_in_jack_descriptor jack_ins[MAX_CABLES * 2];
> +	struct usb_midi_out_jack_descriptor_1 jack_outs[MAX_CABLES * 2];
>  };
> 
>  static int append_config(struct f_midi2_usb_config *config, void *d)