[PATCH] ALSA: control: Validate element info in compat ioctl

[PATCH] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes.

An invalid type or an element count larger than the supported
limit can cause these handlers to access memory outside the
expected buffer boundaries.

Call snd_ctl_check_elem_info() after the info callback to
validate the returned type and count before using them.

This keeps the compat ioctl path from using invalid control
metadata when accessing its value buffers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 sound/core/control_compat.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..cad00d4aa204 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -183,6 +183,10 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		err = snd_ctl_check_elem_info(card, info);
+		if (err < 0)
+			return err;
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0

Re: [PATCH] ALSA: control: Validate element info in compat ioctl

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [Medium] ALSA: control: uncanonicalized info->id passed to
  snd_ctl_check_elem_info()
- [Low] ALSA: control: get_ctl_type() logs error and returns -EINVAL
  before access check
--

commit 9a7d77a704b4390365c1a1e35e66790644d2b85a
Author: Sreeraj S Kurup <sreekuttan2156239@gmail.com>

ALSA: control: Validate element info in compat ioctl

This commit adds a call to snd_ctl_check_elem_info() in get_ctl_type() to
validate the element type and count returned by a control's info callback
in the compat ioctl path.

> diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
> index 87f7ad5ab7391..cad00d4aa2048 100644
> --- a/sound/core/control_compat.c
> +++ b/sound/core/control_compat.c
> @@ -183,6 +183,10 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
>  	info->id = *id;
>  	err = kctl->info(kctl, info);
>  	if (err >= 0) {
> +		err = snd_ctl_check_elem_info(card, info);
> +		if (err < 0)
> +			return err;
> +
>  		err = info->type;
>  		*countp = info->count;
>  	}

[Severity: Medium]
Can snd_ctl_check_elem_info() read past the end of info->id.name when
logging an error?

copy_ctl_value_from_user() copies id directly from userspace, and when
id->numid is non-zero, snd_ctl_find_id() resolves the control by numid
without checking id->name.  Unlike __snd_ctl_elem_info(), which rebuilds
info->id from kctl->id via snd_ctl_build_ioff() before validating,
get_ctl_type() passes the raw user-supplied info->id to
snd_ctl_check_elem_info().  If validation fails and the 44-byte
info->id.name buffer is not NUL-terminated, the dev_err() %s format reads
out of bounds into adjacent fields of struct snd_ctl_elem_info.

Rebuilding info->id with snd_ctl_build_ioff() before calling
snd_ctl_check_elem_info() would match the native path.

[Severity: Low]
Does calling snd_ctl_check_elem_info() here cause compat read and write
ioctls on large TLV bytes_ext controls to log a spurious error and return
-EINVAL instead of -EPERM?

Legitimate TLV-only controls such as ASoC bytes_ext controls can have
info->count > 512 and set SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK.  In the native
path, snd_ctl_elem_read() and snd_ctl_elem_write() check vd->access first
and return -EPERM for TLV-only controls, and __snd_ctl_elem_info() skips
snd_ctl_check_elem_info() when snd_ctl_skip_validation() is true.  Because
copy_ctl_value_from_user() calls get_ctl_type() before the read/write
access check and without checking snd_ctl_skip_validation(), a 32-bit
compat ELEM_READ32 or ELEM_WRITE32 on such a control hits dev_err("invalid
count") and fails with -EINVAL.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108141219.7655-1-sreekuttan2156239@gmail.com?part=1

[PATCH v2] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to obtain the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid metadata could cause these handlers to access
memory outside the expected buffer boundaries.

Rebuild the element ID and obtain the control's access flags
before validating the returned information. Respect the
skip-validation flag to preserve the existing behaviour for
controls that request it.

Call snd_ctl_check_elem_info() when validation is enabled to
ensure that invalid element metadata is not used by the compat
ioctl handlers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
v2:
 - Rebuild the element ID before validation.
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK.

 sound/core/control_compat.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..0c1b80c856f2 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -169,6 +169,8 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 			int *countp)
 {
 	struct snd_kcontrol *kctl;
+	struct snd_kcontrol_volatile *vd;
+	unsigned int index_offset;
 	int err;
 
 	guard(rwsem_read)(&card->controls_rwsem);
@@ -183,6 +185,17 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		index_offset = snd_ctl_get_ioff(kctl, &info->id);
+		vd = &kctl->vd[index_offset];
+		snd_ctl_build_ioff(&info->id, kctl, index_offset);
+		info->access = vd->access;
+
+		if (!snd_ctl_skip_validation(info)) {
+			err = snd_ctl_check_elem_info(card, info);
+			if (err < 0)
+				return err;
+		}
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0

Re: [PATCH v2] ALSA: control: Validate element info in compat ioctl

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] ALSA: control: get_ctl_type() duplicates __snd_ctl_elem_info()
--

commit e7c5b72d570147881e5fc3076a50929183e5bf55
Author: Sreeraj S Kurup <sreekuttan2156239@gmail.com>

ALSA: control: Validate element info in compat ioctl

This commit validates control element info in get_ctl_type() for compat
ioctls by rebuilding the element ID, setting the control access flags,
and calling snd_ctl_check_elem_info() when validation is not skipped.

> diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
> index 87f7ad5ab7391..0c1b80c856f26 100644
> --- a/sound/core/control_compat.c
> +++ b/sound/core/control_compat.c
> @@ -169,6 +169,8 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
>  			int *countp)
>  {
>  	struct snd_kcontrol *kctl;
> +	struct snd_kcontrol_volatile *vd;
> +	unsigned int index_offset;
>  	int err;
>  
>  	guard(rwsem_read)(&card->controls_rwsem);
> @@ -183,6 +185,17 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
>  	info->id = *id;
>  	err = kctl->info(kctl, info);
>  	if (err >= 0) {
> +		index_offset = snd_ctl_get_ioff(kctl, &info->id);
> +		vd = &kctl->vd[index_offset];
> +		snd_ctl_build_ioff(&info->id, kctl, index_offset);
> +		info->access = vd->access;
> +
> +		if (!snd_ctl_skip_validation(info)) {
> +			err = snd_ctl_check_elem_info(card, info);
> +			if (err < 0)
> +				return err;
> +		}
> +
>  		err = info->type;
>  		*countp = info->count;
>  	}

[Severity: Low]
Could get_ctl_type() call __snd_ctl_elem_info(card, kctl, info, NULL)
instead of open-coding this sequence?

sound/core/control_compat.c is included directly by sound/core/control.c,
where __snd_ctl_elem_info() already invokes kctl->info(), rebuilds
info->id, sets info->access, and runs snd_ctl_check_elem_info(), just as
snd_ctl_elem_read() and snd_ctl_elem_write() do when passing a NULL
snd_ctl_file pointer.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108160925.8774-1-sreekuttan2156239@gmail.com?part=1

[PATCH v3] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, it does not validate the
information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid values could cause these handlers to access
memory outside the expected buffer boundaries.

Use __snd_ctl_elem_info() to get and validate the control
information before using the type and count. This also applies
the same element ID handling and access checks as the normal
control info path.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
v3:
 - Use __snd_ctl_elem_info() instead of duplicating the
   element ID handling, access checks, and validation.
v2:
 - Rebuild the element ID before validation
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK

 sound/core/control_compat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..a9ee5ef30c51 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -181,7 +181,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	if (info == NULL)
 		return -ENOMEM;
 	info->id = *id;
-	err = kctl->info(kctl, info);
+	err = __snd_ctl_elem_info(card, kctl, info, NULL);
 	if (err >= 0) {
 		err = info->type;
 		*countp = info->count;
-- 
2.55.0

Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Takashi Iwai]

On Sun, 08 Nov 2026 18:25:01 +0100,
Sreeraj S Kurup wrote:
> 
> The compat ioctl code calls the control's info callback directly
> in get_ctl_type() to get the element type and count.
> 
> Unlike the normal control info path, it does not validate the
> information returned by the callback.
> 
> The compat read and write handlers use the returned type and
> count to access fixed-size value buffers and calculate copy
> sizes. Invalid values could cause these handlers to access
> memory outside the expected buffer boundaries.
> 
> Use __snd_ctl_elem_info() to get and validate the control
> information before using the type and count. This also applies
> the same element ID handling and access checks as the normal
> control info path.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
> ---
> v3:
>  - Use __snd_ctl_elem_info() instead of duplicating the
>    element ID handling, access checks, and validation.
> v2:
>  - Rebuild the element ID before validation
>  - Set the control access flags and respect
>    SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK
> 
>  sound/core/control_compat.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
> index 87f7ad5ab739..a9ee5ef30c51 100644
> --- a/sound/core/control_compat.c
> +++ b/sound/core/control_compat.c
> @@ -181,7 +181,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
>  	if (info == NULL)
>  		return -ENOMEM;
>  	info->id = *id;
> -	err = kctl->info(kctl, info);
> +	err = __snd_ctl_elem_info(card, kctl, info, NULL);
>  	if (err >= 0) {
>  		err = info->type;
>  		*countp = info->count;

Isn't such a sanity check done in anyway at snd_ctl_elem_write() call?
The OOB copy from/to user-space would be just -EFAULT as expected.

It's not too bad to call __snd_ctl_elem_info(), but I'd like to be
sure whether it's really needed.


thanks,

Takashi

Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

Hi Takashi,

The validation in snd_ctl_elem_write() happens too late. Before calling 
snd_ctl_elem_write(), the compat handler calls copy_ctl_value_from_user(), which 
uses the type and count returned by get_ctl_type() to determine how many values to copy.

If the control's info callback returns an invalid count, the integer and boolean paths 
can access beyond the fixed-size integer value array. Other paths can also calculate a 
copy size larger than the available kernel buffer.

The read path has a similar issue. It uses the same type and count when copying the values 
back to userspace, which can result in an out-of-bounds read from the kernel buffer.

So, validation in snd_ctl_elem_write() cannot prevent these problems because the unsafe 
accesses can happen before it is called.

Using __snd_ctl_elem_info() in get_ctl_type() ensures that the type and count are validated 
before they are used by the compat handlers. It also reuses the existing element ID handling 
and access checks.

Therefore, I think this validation is necessary.

Best regards,

Sreeraj

Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Takashi Iwai]

On Tue, 10 Nov 2026 17:05:10 +0100,
Sreeraj S Kurup wrote:
> 
> Hi Takashi,
> 
> The validation in snd_ctl_elem_write() happens too late. Before calling 
> snd_ctl_elem_write(), the compat handler calls copy_ctl_value_from_user(), which 
> uses the type and count returned by get_ctl_type() to determine how many values to copy.
> 
> If the control's info callback returns an invalid count, the integer and boolean paths 
> can access beyond the fixed-size integer value array. Other paths can also calculate a 
> copy size larger than the available kernel buffer.
> 
> The read path has a similar issue. It uses the same type and count when copying the values 
> back to userspace, which can result in an out-of-bounds read from the kernel buffer.
> 
> So, validation in snd_ctl_elem_write() cannot prevent these problems because the unsafe 
> accesses can happen before it is called.
> 
> Using __snd_ctl_elem_info() in get_ctl_type() ensures that the type and count are validated 
> before they are used by the compat handlers. It also reuses the existing element ID handling 
> and access checks.
> 
> Therefore, I think this validation is necessary.

OK, it makes sense.  Now applied to for-next branch.


thanks,

Takashi

Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

Hi,

Thanks for applying the patch!

Best regards,
Sreeraj