ALSA: scarlett2: Fix buffer overflow in config retrieval

[ Upstream commit 6f5c69f72e50d51be3a8c028ae7eda42c82902cb ]

The scarlett2_usb_get_config() function has a logic error in the
endianness conversion code that can cause buffer overflows when
count > 1.

The code checks `if (size == 2)` where `size` is the total buffer size in
bytes, then loops `count` times treating each element as u16 (2 bytes).
This causes the loop to access `count * 2` bytes when the buffer only
has `size` bytes allocated.

Fix by checking the element size (config_item->size) instead of the
total buffer size. This ensures the endianness conversion matches the
actual element type.

Fixes: ac34df733d2d ("ALSA: usb-audio: scarlett2: Update get_config to do endian conversion")
Cc: stable@vger.kernel.org
Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Link: https://patch.msgid.link/20260117012706.1715574-1-samasth.norway.ananda@oracle.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ add 32-bit handling block ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
index 316f1abefd51dbe255a0d745c59a1c145e4cfd3c..6112c3fb8ba68b823b9773dcf5d6e8c371f7e91e 100644 (file)
--- a/sound/usb/mixer_scarlett2.c
+++ b/sound/usb/mixer_scarlett2.c
@@ -1408,11 +1408,16 @@ static int scarlett2_usb_get_config(
                err = scarlett2_usb_get(mixer, config_item->offset, buf, size);
                if (err < 0)
                        return err;
-               if (size == 2) {
+               if (config_item->size == 16) {
                        u16 *buf_16 = buf;
 
                        for (i = 0; i < count; i++, buf_16++)
                                *buf_16 = le16_to_cpu(*(__le16 *)buf_16);
+               } else if (config_item->size == 32) {
+                       u32 *buf_32 = (u32 *)buf;
+
+                       for (i = 0; i < count; i++, buf_32++)
+                               *buf_32 = le32_to_cpu(*(__le32 *)buf_32);
                }
                return 0;
        }