[PATCH 6.6.y] ALSA: control: Don't add invalid kcontrols to LED layer

[Artem Dinaburg]

From: Takashi Iwai <tiwai@xxxxxxx>

[ Upstream commit 74e3b979ce8b78a690f8b94ccf2e2c965f7f5c11 ]

The kcontrol LED state layer tries to track the all associated
kcontrol elements with naive assumptions that they are readable.
But one can create a write-only element that has no get callback (even
a user element can do it), and this may lead to a NULL dereference at
the call chain of snd_ctl_led_notify(), as found by syzkaller.

For avoiding the Oops, add a sanity check of the kcontrol's info and
get callbacks, and just skip the invalid kcontrols before assigning
the kctl to the LED layer.

Reported-by: syzbot+b7fe2760ea6f1ee44b4d@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@xxxxxxxxxx
Fixes: 22d8de62f11b ("ALSA: control - add generic LED trigger module as the new control layer")
Reviewed-by: Jaroslav Kysela <perex@xxxxxxxx>
Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
Link: https://patch.msgid.link/20260827113951.893291-1-tiwai@xxxxxxx
Assisted-by: LLM
[ Backport to 6.6.y: After the target's locked control lookup, reject
  missing info/get callbacks via the existing unlock label so
  controls_rwsem and the card reference are released. ]
Signed-off-by: Artem Dinaburg <artem@xxxxxxxxxxxxxxx>
---
Hi,

Please consider this backport of the fix for CVE-2026-90060 to 6.6.y.

The code changes are identical to upstream, except missing-callback
failure uses the target unlock label; see the bracketed backport note
above.

The complete fix is already present in 6.12.y, 6.18.y and 7.2.y.

Build-tested only as part of a cumulative 6.6.y series: x86_64 objects
(allmodconfig, CONFIG_WERROR=y); no runtime testing.

Thanks,
Artem Dinaburg

 sound/core/control_led.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index 15acb07c651502d4dc22f72bcc9e3a47923caf5e..639d86e4dd1623df612ead223a11e049fbf39afb 100644
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -253,6 +253,10 @@ static int snd_ctl_led_set_id(int card_number, struct snd_ctl_elem_id *id,
 		down_write(&card->controls_rwsem);
 		kctl = snd_ctl_find_id_locked(card, id);
 		if (kctl) {
+			if (!kctl->info || !kctl->get) {
+				err = -EINVAL;
+				goto unlock;
+			}
 			ioff = snd_ctl_get_ioff(kctl, id);
 			vd = &kctl->vd[ioff];
 			access = vd->access & SNDRV_CTL_ELEM_ACCESS_LED_MASK;