[PATCH v2] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to obtain the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid metadata could cause these handlers to access
memory outside the expected buffer boundaries.

Rebuild the element ID and obtain the control's access flags
before validating the returned information. Respect the
skip-validation flag to preserve the existing behaviour for
controls that request it.

Call snd_ctl_check_elem_info() when validation is enabled to
ensure that invalid element metadata is not used by the compat
ioctl handlers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@xxxxxxxxx>
---
v2:
 - Rebuild the element ID before validation.
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK.

 sound/core/control_compat.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..0c1b80c856f2 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -169,6 +169,8 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 			int *countp)
 {
 	struct snd_kcontrol *kctl;
+	struct snd_kcontrol_volatile *vd;
+	unsigned int index_offset;
 	int err;
 
 	guard(rwsem_read)(&card->controls_rwsem);
@@ -183,6 +185,17 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		index_offset = snd_ctl_get_ioff(kctl, &info->id);
+		vd = &kctl->vd[index_offset];
+		snd_ctl_build_ioff(&info->id, kctl, index_offset);
+		info->access = vd->access;
+
+		if (!snd_ctl_skip_validation(info)) {
+			err = snd_ctl_check_elem_info(card, info);
+			if (err < 0)
+				return err;
+		}
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0