usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmdgrafted

generic_set_cmd() and generic_get_cmd() use the low nibble of
ctrl->bRequest as an index into con->data[]:

    u8 cmd = (ctrl->bRequest & 0x0F);  /* 0 .. 15 */
    ...
    con->data[cmd] = value;            /* OOB when cmd >= 5 */

struct usb_audio_control (include/linux/usb/audio.h) declares data as
a 5-element array, so indices 5 through 15 write (or read) up to 44
bytes past the end of the array on the heap.

A malicious USB host can craft a class-specific SET_CUR / GET_CUR
request with an arbitrary bRequest value, triggering the out-of-bounds
access from an IRQ completion handler with no further preconditions.

Add an ARRAY_SIZE() guard to both functions.

Fixes: c47d7b09891a ("USB: audio: add USB audio class definitions")
Cc: stable <stable@kernel.org>
Reviewed-by: Weibin Liu <liuwb@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
Reviewed-by: Ivy Lopez <skunkolee@gmail.com>
Link: https://patch.msgid.link/20260921072551.3708191-1-liuc63@xiaopeng.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 113 insertions, 0 deletions

diff --git a/scripts/const_structs.checkpatch b/scripts/const_structs.checkpatch
new file mode 100644
index 000000000..6eb94fddc
--- /dev/null
+++ b/scripts/const_structs.checkpatch
@@ -0,0 +1,113 @@
+acpi_dock_ops
+address_space_operations
+backlight_ops
+bin_attribute
+block_device_operations
+bus_type
+clk_ops
+comedi_lrange
+component_ops
+ctl_table
+dentry_operations
+dev_pm_ops
+device_type
+dma_map_ops
+driver_info
+drm_connector_funcs
+drm_encoder_funcs
+drm_encoder_helper_funcs
+dvb_frontend_ops
+dvb_tuner_ops
+ethtool_ops
+extent_io_ops
+fb_ops
+file_lock_operations
+file_operations
+hv_ops
+hwmon_ops
+ib_device_ops
+ide_dma_ops
+ide_port_ops
+ieee80211_ops
+iio_buffer_setup_ops
+inode_operations
+intel_dvo_dev_ops
+irq_domain_ops
+item_operations
+iwl_cfg
+iwl_ops
+kernel_param_ops
+kgdb_arch
+kgdb_io
+kobj_type
+kset_uevent_ops
+lcd_ops
+lock_manager_operations
+machine_desc
+microcode_ops
+mlxsw_reg_info
+mtd_ooblayout_ops
+mtrr_ops
+nand_controller_ops
+neigh_ops
+net_device_ops
+nft_expr_ops
+nlmsvc_binding
+nvkm_device_chip
+of_device_id
+pci_raw_ops
+phy_ops
+pinconf_ops
+pinctrl_ops
+pinmux_ops
+pipe_buf_operations
+platform_hibernation_ops
+platform_suspend_ops
+proc_ops
+proto_ops
+pwm_ops
+reg_default
+reg_field
+reg_sequence
+regmap_access_table
+regmap_bus
+regmap_config
+regmap_irq
+regmap_irq_chip
+regmap_irq_sub_irq_map
+regmap_range
+regmap_range_cfg
+regulator_ops
+reset_control_ops
+rpc_pipe_ops
+rtc_class_ops
+sd_desc
+sdhci_ops
+seq_operations
+sirfsoc_padmux
+snd_ac97_build_ops
+snd_pcm_ops
+snd_rawmidi_ops
+snd_soc_component_driver
+snd_soc_dai_ops
+snd_soc_ops
+snd_soc_tplg_ops
+soc_pcmcia_socket_ops
+stacktrace_ops
+sysfs_ops
+tty_operations
+uart_ops
+usb_mon_operations
+v4l2_ctrl_ops
+v4l2_ioctl_ops
+v4l2_subdev_core_ops
+v4l2_subdev_internal_ops
+v4l2_subdev_ops
+v4l2_subdev_pad_ops
+v4l2_subdev_video_ops
+vb2_ops
+vm_operations_struct
+wacom_features
+watchdog_ops
+wd_ops
+xattr_handler