Re: [PATCH] ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()

[Takashi Iwai]

On Tue, 14 Apr 2026 11:05:42 +0200,
Ziqing Chen wrote:
> 
> snd_ctl_elem_init_enum_names() advances pointer p through the names
> buffer while decrementing buf_len. If buf_len reaches zero but items
> remain, the next iteration calls strnlen(p, 0).
> 
> While strnlen(p, 0) returns 0 and would hit the existing name_len == 0
> error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks
> maxlen against __builtin_dynamic_object_size(). When Clang loses track
> of p's object size inside the loop, this triggers a BRK exception panic
> before the return value is examined.
> 
> Add a buf_len == 0 guard at the loop entry to prevent calling fortified
> strnlen() on an exhausted buffer.
> 
> Found by kernel fuzz testing through Xiaomi Smartphone.
> 
> Fixes: 8d448162bda5 ("ALSA: control: add support for ENUMERATED user space controls")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Ziqing Chen <chenziqing@xxxxxxxxxx>
> ---
>  sound/core/control.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/sound/core/control.c b/sound/core/control.c
> index 0ddade871b52..6ceb5f977fcd 100644
> --- a/sound/core/control.c
> +++ b/sound/core/control.c
> @@ -1574,6 +1574,10 @@ static int snd_ctl_elem_init_enum_names(struct user_element *ue)
>         /* check that there are enough valid names */
>         p = names;
>         for (i = 0; i < ue->info.value.enumerated.items; ++i) {
> +               if (buf_len == 0) {
> +                       kvfree(names);
> +                       return -EINVAL;
> +               }
>                 name_len = strnlen(p, buf_len);
>                 if (name_len == 0 || name_len >= 64 || name_len == buf_len) {
>                         kvfree(names);

Having a zero buf_len check is good, per se, but it doesn't have to be
at this late place.  It can be checked at the very beginning even
before the allocation (where we have already an upper bound check),
instead.

Could you test it and resubmit if that works?


thanks,

Takashi