Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Takashi Iwai]

On Sun, 08 Nov 2026 18:25:01 +0100,
Sreeraj S Kurup wrote:
> 
> The compat ioctl code calls the control's info callback directly
> in get_ctl_type() to get the element type and count.
> 
> Unlike the normal control info path, it does not validate the
> information returned by the callback.
> 
> The compat read and write handlers use the returned type and
> count to access fixed-size value buffers and calculate copy
> sizes. Invalid values could cause these handlers to access
> memory outside the expected buffer boundaries.
> 
> Use __snd_ctl_elem_info() to get and validate the control
> information before using the type and count. This also applies
> the same element ID handling and access checks as the normal
> control info path.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@xxxxxxxxx>
> ---
> v3:
>  - Use __snd_ctl_elem_info() instead of duplicating the
>    element ID handling, access checks, and validation.
> v2:
>  - Rebuild the element ID before validation
>  - Set the control access flags and respect
>    SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK
> 
>  sound/core/control_compat.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
> index 87f7ad5ab739..a9ee5ef30c51 100644
> --- a/sound/core/control_compat.c
> +++ b/sound/core/control_compat.c
> @@ -181,7 +181,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
>  	if (info == NULL)
>  		return -ENOMEM;
>  	info->id = *id;
> -	err = kctl->info(kctl, info);
> +	err = __snd_ctl_elem_info(card, kctl, info, NULL);
>  	if (err >= 0) {
>  		err = info->type;
>  		*countp = info->count;

Isn't such a sanity check done in anyway at snd_ctl_elem_write() call?
The OOB copy from/to user-space would be just -EFAULT as expected.

It's not too bad to call __snd_ctl_elem_info(), but I'd like to be
sure whether it's really needed.


thanks,

Takashi