Re: [PATCH 12/28] ASoC: ops: Introduce 'soc_set_enum_kctl'

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ALSA: uninitialized struct snd_ctl_elem_value exposes stack memory and triggers OOB access
--

commit 39b7a1686876eb2be8da2cbd7401a6040c476ac1
Author: Martin Povišer <povik+lin@cutebit.org>

ASoC: ops: Introduce 'soc_set_enum_kctl'

This commit introduces a new function to set enumerated controls to desired
values. It allows setting either a single control or many controls in bulk by
pattern, and is intended for use by machine drivers during fixup_controls.

> diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
> index d35e24df891b6..dc27d1c409abb 100644
> --- a/sound/soc/soc-ops.c
> +++ b/sound/soc/soc-ops.c

[ ... ]

> @@ -550,6 +550,76 @@ int snd_soc_deactivate_kctl(struct snd_soc_card *card,
>  }
>  EXPORT_SYMBOL_GPL(snd_soc_deactivate_kctl);
>  
> +static int soc_set_enum_kctl(struct snd_kcontrol *kctl, const char *strval)
> +{
> +	struct snd_ctl_elem_value value;
> +	struct snd_ctl_elem_info info;

[Severity: High]
Is it safe to allocate these structures on the stack without
zero-initialization?

The value and info structures are roughly 1.5KB in total. While info is
typically overwritten by the kctl->info() call below, fields like value.id
(which includes numid, index, and name) are left containing uninitialized
stack memory.

> +	int sel, i, ret;
> +
> +	ret = kctl->info(kctl, &info);

[ ... ]

> +	if (sel == info.value.enumerated.items)
> +		return -EINVAL;
> +
> +	for (i = 0; i < info.count; i++)
> +		value.value.enumerated.item[i] = sel;
> +
> +	return kctl->put(kctl, &value);

[Severity: High]
Could passing this uninitialized value structure to the put callback cause
out-of-bounds memory accesses?

When kctl->put() is invoked, drivers using ALSA helper macros like
snd_ctl_get_ioffidx() or reading id.name via strstr() will use this garbage
data as array indices or string matches.

This could directly lead to out-of-bounds memory accesses and kernel panics
when machine drivers use this exported API to set enumerated control values
during initialization.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920-macaudio-v1-0-741cc20a74e5@gmail.com?part=12