[PATCH v3] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, it does not validate the
information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid values could cause these handlers to access
memory outside the expected buffer boundaries.

Use __snd_ctl_elem_info() to get and validate the control
information before using the type and count. This also applies
the same element ID handling and access checks as the normal
control info path.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@xxxxxxxxx>
---
v3:
 - Use __snd_ctl_elem_info() instead of duplicating the
   element ID handling, access checks, and validation.
v2:
 - Rebuild the element ID before validation
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK

 sound/core/control_compat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..a9ee5ef30c51 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -181,7 +181,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	if (info == NULL)
 		return -ENOMEM;
 	info->id = *id;
-	err = kctl->info(kctl, info);
+	err = __snd_ctl_elem_info(card, kctl, info, NULL);
 	if (err >= 0) {
 		err = info->type;
 		*countp = info->count;
-- 
2.55.0