[PATCH] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes.

An invalid type or an element count larger than the supported
limit can cause these handlers to access memory outside the
expected buffer boundaries.

Call snd_ctl_check_elem_info() after the info callback to
validate the returned type and count before using them.

This keeps the compat ioctl path from using invalid control
metadata when accessing its value buffers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@xxxxxxxxx>
---
 sound/core/control_compat.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..cad00d4aa204 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -183,6 +183,10 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		err = snd_ctl_check_elem_info(card, info);
+		if (err < 0)
+			return err;
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0