[PATCH] ALSA: control: Validate element info in compat ioctl

[PATCH] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes.

An invalid type or an element count larger than the supported
limit can cause these handlers to access memory outside the
expected buffer boundaries.

Call snd_ctl_check_elem_info() after the info callback to
validate the returned type and count before using them.

This keeps the compat ioctl path from using invalid control
metadata when accessing its value buffers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 sound/core/control_compat.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..cad00d4aa204 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -183,6 +183,10 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		err = snd_ctl_check_elem_info(card, info);
+		if (err < 0)
+			return err;
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0

[PATCH v2] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to obtain the element type and count.

Unlike the normal control info path, this code does not validate
the information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid metadata could cause these handlers to access
memory outside the expected buffer boundaries.

Rebuild the element ID and obtain the control's access flags
before validating the returned information. Respect the
skip-validation flag to preserve the existing behaviour for
controls that request it.

Call snd_ctl_check_elem_info() when validation is enabled to
ensure that invalid element metadata is not used by the compat
ioctl handlers.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
v2:
 - Rebuild the element ID before validation.
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK.

 sound/core/control_compat.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..0c1b80c856f2 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -169,6 +169,8 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 			int *countp)
 {
 	struct snd_kcontrol *kctl;
+	struct snd_kcontrol_volatile *vd;
+	unsigned int index_offset;
 	int err;
 
 	guard(rwsem_read)(&card->controls_rwsem);
@@ -183,6 +185,17 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	info->id = *id;
 	err = kctl->info(kctl, info);
 	if (err >= 0) {
+		index_offset = snd_ctl_get_ioff(kctl, &info->id);
+		vd = &kctl->vd[index_offset];
+		snd_ctl_build_ioff(&info->id, kctl, index_offset);
+		info->access = vd->access;
+
+		if (!snd_ctl_skip_validation(info)) {
+			err = snd_ctl_check_elem_info(card, info);
+			if (err < 0)
+				return err;
+		}
+
 		err = info->type;
 		*countp = info->count;
 	}
-- 
2.55.0

[PATCH v3] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

The compat ioctl code calls the control's info callback directly
in get_ctl_type() to get the element type and count.

Unlike the normal control info path, it does not validate the
information returned by the callback.

The compat read and write handlers use the returned type and
count to access fixed-size value buffers and calculate copy
sizes. Invalid values could cause these handlers to access
memory outside the expected buffer boundaries.

Use __snd_ctl_elem_info() to get and validate the control
information before using the type and count. This also applies
the same element ID handling and access checks as the normal
control info path.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
v3:
 - Use __snd_ctl_elem_info() instead of duplicating the
   element ID handling, access checks, and validation.
v2:
 - Rebuild the element ID before validation
 - Set the control access flags and respect
   SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK

 sound/core/control_compat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 87f7ad5ab739..a9ee5ef30c51 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -181,7 +181,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
 	if (info == NULL)
 		return -ENOMEM;
 	info->id = *id;
-	err = kctl->info(kctl, info);
+	err = __snd_ctl_elem_info(card, kctl, info, NULL);
 	if (err >= 0) {
 		err = info->type;
 		*countp = info->count;
-- 
2.55.0

Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Takashi Iwai]

On Sun, 08 Nov 2026 18:25:01 +0100,
Sreeraj S Kurup wrote:
> 
> The compat ioctl code calls the control's info callback directly
> in get_ctl_type() to get the element type and count.
> 
> Unlike the normal control info path, it does not validate the
> information returned by the callback.
> 
> The compat read and write handlers use the returned type and
> count to access fixed-size value buffers and calculate copy
> sizes. Invalid values could cause these handlers to access
> memory outside the expected buffer boundaries.
> 
> Use __snd_ctl_elem_info() to get and validate the control
> information before using the type and count. This also applies
> the same element ID handling and access checks as the normal
> control info path.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
> ---
> v3:
>  - Use __snd_ctl_elem_info() instead of duplicating the
>    element ID handling, access checks, and validation.
> v2:
>  - Rebuild the element ID before validation
>  - Set the control access flags and respect
>    SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK
> 
>  sound/core/control_compat.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
> index 87f7ad5ab739..a9ee5ef30c51 100644
> --- a/sound/core/control_compat.c
> +++ b/sound/core/control_compat.c
> @@ -181,7 +181,7 @@ static int get_ctl_type(struct snd_card *card, struct snd_ctl_elem_id *id,
>  	if (info == NULL)
>  		return -ENOMEM;
>  	info->id = *id;
> -	err = kctl->info(kctl, info);
> +	err = __snd_ctl_elem_info(card, kctl, info, NULL);
>  	if (err >= 0) {
>  		err = info->type;
>  		*countp = info->count;

Isn't such a sanity check done in anyway at snd_ctl_elem_write() call?
The OOB copy from/to user-space would be just -EFAULT as expected.

It's not too bad to call __snd_ctl_elem_info(), but I'd like to be
sure whether it's really needed.


thanks,

Takashi

Re: [PATCH v3] ALSA: control: Validate element info in compat ioctl

[Sreeraj S Kurup]

Hi Takashi,

The validation in snd_ctl_elem_write() happens too late. Before calling 
snd_ctl_elem_write(), the compat handler calls copy_ctl_value_from_user(), which 
uses the type and count returned by get_ctl_type() to determine how many values to copy.

If the control's info callback returns an invalid count, the integer and boolean paths 
can access beyond the fixed-size integer value array. Other paths can also calculate a 
copy size larger than the available kernel buffer.

The read path has a similar issue. It uses the same type and count when copying the values 
back to userspace, which can result in an out-of-bounds read from the kernel buffer.

So, validation in snd_ctl_elem_write() cannot prevent these problems because the unsafe 
accesses can happen before it is called.

Using __snd_ctl_elem_info() in get_ctl_type() ensures that the type and count are validated 
before they are used by the compat handlers. It also reuses the existing element ID handling 
and access checks.

Therefore, I think this validation is necessary.

Best regards,

Sreeraj