Commit e0da8a8c authored by Ziqing Chen's avatar Ziqing Chen Committed by Takashi Iwai
Browse files

ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() 



snd_ctl_elem_init_enum_names() advances pointer p through the names
buffer while decrementing buf_len. If buf_len reaches zero but items
remain, the next iteration calls strnlen(p, 0).

While strnlen(p, 0) returns 0 and would hit the existing name_len == 0
error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks
maxlen against __builtin_dynamic_object_size(). When Clang loses track
of p's object size inside the loop, this triggers a BRK exception panic
before the return value is examined.

Add a buf_len == 0 guard at the loop entry to prevent calling fortified
strnlen() on an exhausted buffer.

Found by kernel fuzz testing through Xiaomi Smartphone.

Fixes: 8d448162 ("ALSA: control: add support for ENUMERATED user space controls")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarZiqing Chen <chenziqing@xiaomi.com>
Link: https://patch.msgid.link/20260414132437.261304-1-chenziqing@xiaomi.com


Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent a1ed2ec1

sound/core/control.c

+4 −0
Original line number Diff line number Diff line
@@ -1648,6 +1648,10 @@ static int snd_ctl_elem_init_enum_names(struct user_element *ue) 
	/* check that there are enough valid names */

	p = names;

	for (i = 0; i < ue->info.value.enumerated.items; ++i) {

		if (buf_len == 0) {

			kvfree(names);

			return -EINVAL;

		}

		name_len = strnlen(p, buf_len);

		if (name_len == 0 || name_len >= 64 || name_len == buf_len) {

			kvfree(names);