[PATCH] ALSA: control: Validate element info in compat ioctl

[PATCH] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes.

An invalid type or an element count larger than the supported
limit can cause these handlers to access memory outside the
expected buffer boundaries.

Call snd_ctl_check_elem_info() after the info callback to
validate the returned type and count before using them.

This keeps the compat ioctl path from using invalid control
metadata when accessing its value buffers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 sound/core/control_compat.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..cad00d4aa204 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -183,6 +183,10 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		err = snd_ctl_check_elem_info(card, info);
+		if (err < 0)
+			return err;
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0

[PATCH v2] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to obtain the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid metadata could cause these handlers to access
memory outside the expected buffer boundaries.

Rebuild the element ID and obtain the control's access flags
before validating the returned information. Respect the
skip-validation flag to preserve the existing behaviour for
controls that request it.

Call snd_ctl_check_elem_info() when validation is enabled to
ensure that invalid element metadata is not used by the compat
ioctl handlers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
v2:
 - Rebuild the element ID before validation.
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK.

 sound/core/control_compat.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..0c1b80c856f2 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -169,6 +169,8 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 			int *countp)
 {
 	struct snd_kcontrol *kctl;
+	struct snd_kcontrol_volatile *vd;
+	unsigned int index_offset;
 	int err;
 
 	guard(rwsem_read)(&card->controls_rwsem);
@@ -183,6 +185,17 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		index_offset = snd_ctl_get_ioff(kctl, &info->id);
+		vd = &kctl->vd[index_offset];
+		snd_ctl_build_ioff(&info->id, kctl, index_offset);
+		info->access = vd->access;
+
+		if (!snd_ctl_skip_validation(info)) {
+			err = snd_ctl_check_elem_info(card, info);
+			if (err < 0)
+				return err;
+		}
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0

[PATCH v3] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, it does not validate the
information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid values could cause these handlers to access
memory outside the expected buffer boundaries.

Use __snd_ctl_elem_info() to get and validate the control
information before using the type and count. This also applies
the same element ID handling and access checks as the normal
control info path.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
v3:
 - Use __snd_ctl_elem_info() instead of duplicating the
   element ID handling, access checks, and validation.
v2:
 - Rebuild the element ID before validation
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK

 sound/core/control_compat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..a9ee5ef30c51 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -181,7 +181,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	if (info == NULL)
 		return -ENOMEM;
 	info->id = *id;
-	err = kctl->info(kctl, info);
+	err = __snd_ctl_elem_info(card, kctl, info, NULL);
 	if (err >= 0) {
 		err = info->type;
 		*countp = info->count;
-- 
2.55.0