6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <redacted>
[ Upstream commit 74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11 ]
The kcontrol LED state layer tries to track the all associated
kcontrol elements with naive assumptions that they are readable.
But one can create a write-only element that has no get callback (even
a user element can do it), and this may lead to a NULL dereference at
the call chain of snd_ctl_led_notify(), as found by syzkaller.
For avoiding the Oops, add a sanity check of the kcontrol's info and
get callbacks, and just skip the invalid kcontrols before assigning
the kctl to the LED layer.
Reported-by: <redacted>
Closes: https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com (local)
Fixes: 22d8de62f11b ("ALSA: control - add generic LED trigger module as the new control layer")
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Signed-off-by: Takashi Iwai <redacted>
Link: https://patch.msgid.link/20260827113951.893291-1-tiwai@suse.de (local)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/control_led.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index dd6ad4735fc4b..43d32f188e357 100644
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -253,6 +253,8 @@ static int snd_ctl_led_set_id(int card_number, struct snd_ctl_elem_id *id,
kctl = snd_ctl_find_id_locked(card, id);
if (!kctl)
return -ENOENT;
+ if (!kctl->info || !kctl->get)
+ return -EINVAL;
ioff = snd_ctl_get_ioff(kctl, id);
vd = &kctl->vd[ioff];
access = vd->access & SNDRV_CTL_ELEM_ACCESS_LED_MASK;
--
2.53.0