[PATCH] ALSA: mixer: oss: Fix uninitialized index in recsrc ioctls

[PATCH] ALSA: mixer: oss: Fix uninitialized index in recsrc ioctls

[songxiebing]

From: Bob Song <songxiebing@kylinos.cn>

snd_mixer_oss_get_recsrc2() returns success without setting active_index
when the current Capture Source does not match any OSS mixer slot.
snd_mixer_oss_get_recsrc() then uses that uninitialized index for
"1 << index", and snd_mixer_oss_set_recsrc() does the same while ignoring
the callback's return value.

Make get_recsrc2() return -ENOENT if no slot matches, only use the
returned index in set_recsrc() when the lookup succeeds, and initialize
the index variables as a defensive measure.

Signed-off-by: Bob Song <songxiebing@kylinos.cn>
---
 sound/core/oss/mixer_oss.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index c533d767c29a..6c8ca1d320ac 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -185,7 +185,7 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer)
 		return -EIO;
 	guard(mutex)(&mixer->reg_mutex);
 	if (mixer->put_recsrc && mixer->get_recsrc) {	/* exclusive */
-		unsigned int index;
+		unsigned int index = 0;
 		result = mixer->get_recsrc(fmixer, &index);
 		if (result < 0)
 			return result;
@@ -212,7 +212,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr
 	struct snd_mixer_oss *mixer = fmixer->mixer;
 	struct snd_mixer_oss_slot *pslot;
 	int chn, active;
-	unsigned int index;
+	unsigned int index = 0;
 	int result = 0;
 
 	if (mixer == NULL)
@@ -222,8 +222,8 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr
 		if (recsrc & ~mixer->oss_recsrc)
 			recsrc &= ~mixer->oss_recsrc;
 		mixer->put_recsrc(fmixer, ffz(~recsrc));
-		mixer->get_recsrc(fmixer, &index);
-		result = 1 << index;
+		if (mixer->get_recsrc(fmixer, &index) == 0)
+			result = 1 << index;
 	}
 	for (chn = 0; chn < 31; chn++) {
 		pslot = &mixer->slots[chn];
@@ -826,6 +826,8 @@ static int snd_mixer_oss_get_recsrc2(struct snd_mixer_oss_file *fmixer, unsigned
 			break;
 		}
 	}
+	if (idx == 32)
+		return -ENOENT;
 	return 0;
 }
 
-- 
2.25.1

Re: [PATCH] ALSA: mixer: oss: Fix uninitialized index in recsrc ioctls

[Takashi Iwai]

On Wed, 04 Nov 2026 08:56:42 +0100,
songxiebing wrote:
> 
> From: Bob Song <songxiebing@kylinos.cn>
> 
> snd_mixer_oss_get_recsrc2() returns success without setting active_index
> when the current Capture Source does not match any OSS mixer slot.
> snd_mixer_oss_get_recsrc() then uses that uninitialized index for
> "1 << index", and snd_mixer_oss_set_recsrc() does the same while ignoring
> the callback's return value.
> 
> Make get_recsrc2() return -ENOENT if no slot matches, only use the
> returned index in set_recsrc() when the lookup succeeds, and initialize
> the index variables as a defensive measure.
> 
> Signed-off-by: Bob Song <songxiebing@kylinos.cn>

I guess that the error is rather hypothetical and not triggered by the
current use case?

As it doesn't look like an urgent fix, I applied to for-next branch
now.  Thanks.


Takashi