diff options
| author | Ziqing Chen <chenziqing@xiaomi.com> | 2026-04-14 21:24:37 +0800 |
|---|---|---|
| committer | Takashi Iwai <tiwai@suse.de> | 2026-04-14 15:31:10 +0200 |
| commit | e0da8a8cac74f4b9f577979d131f0d2b88a84487 (patch) | |
| tree | 6752f88f5ea917a24a51100f615045d3d5ad7add | |
| parent | a1ed2ec1c5458b4a99765439cb595dd0e026a352 (diff) | |
ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
snd_ctl_elem_init_enum_names() advances pointer p through the names
buffer while decrementing buf_len. If buf_len reaches zero but items
remain, the next iteration calls strnlen(p, 0).
While strnlen(p, 0) returns 0 and would hit the existing name_len == 0
error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks
maxlen against __builtin_dynamic_object_size(). When Clang loses track
of p's object size inside the loop, this triggers a BRK exception panic
before the return value is examined.
Add a buf_len == 0 guard at the loop entry to prevent calling fortified
strnlen() on an exhausted buffer.
Found by kernel fuzz testing through Xiaomi Smartphone.
Fixes: 8d448162bda5 ("ALSA: control: add support for ENUMERATED user space controls")
Cc: stable@vger.kernel.org
Signed-off-by: Ziqing Chen <chenziqing@xiaomi.com>
Link: https://patch.msgid.link/20260414132437.261304-1-chenziqing@xiaomi.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
| -rw-r--r-- | sound/core/control.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sound/core/control.c b/sound/core/control.c index 374e703d15a9..5e51857635e6 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1648,6 +1648,10 @@ static int snd_ctl_elem_init_enum_names(struct user_element *ue) /* check that there are enough valid names */ p = names; for (i = 0; i < ue->info.value.enumerated.items; ++i) { + if (buf_len == 0) { + kvfree(names); + return -EINVAL; + } name_len = strnlen(p, buf_len); if (name_len == 0 || name_len >= 64 || name_len == buf_len) { kvfree(names); |