Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Takashi Iwai <tiwai@suse.de>]

On Tue, 10 Nov 2026 17:05:10 +0100,
Sreeraj S Kurup wrote:
> 
> Hi Takashi,
> 
> The validation in snd_ctl_elem_write() happens too late. Before calling 
> snd_ctl_elem_write(), the compat handler calls copy_ctl_value_from_user(), which 
> uses the type and count returned by get_ctl_type() to determine how many values to copy.
> 
> If the control's info callback returns an invalid count, the integer and boolean paths 
> can access beyond the fixed-size integer value array. Other paths can also calculate a 
> copy size larger than the available kernel buffer.
> 
> The read path has a similar issue. It uses the same type and count when copying the values 
> back to userspace, which can result in an out-of-bounds read from the kernel buffer.
> 
> So, validation in snd_ctl_elem_write() cannot prevent these problems because the unsafe 
> accesses can happen before it is called.
> 
> Using __snd_ctl_elem_info() in get_ctl_type() ensures that the type and count are validated 
> before they are used by the compat handlers. It also reuses the existing element ID handling 
> and access checks.
> 
> Therefore, I think this validation is necessary.

OK, it makes sense.  Now applied to for-next branch.


thanks,

Takashi