The kcontrol LED state layer tries to track the all associated
kcontrol elements with naive assumptions that they are readable.
But one can create a write-only element that has no get callback (even
a user element can do it), and this may lead to a NULL dereference at
the call chain of snd_ctl_led_notify(), as found by syzkaller.

For avoiding the Oops, add a sanity check of the kcontrol's info and
get callbacks, and just skip the invalid kcontrols before assigning
the kctl to the LED layer.

Reported-by: syzbot+b7fe2760ea6f1ee44b4d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com
Fixes: 22d8de62f11b ("ALSA: control - add generic LED trigger module as the new control layer")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/core/control_led.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/core/control_led.c b/sound/core/control_led.c
index 8cbacee57ce7..3d13bbec1c54 100644
--- a/sound/core/control_led.c
+++ b/sound/core/control_led.c
@@ -255,6 +255,8 @@ static int snd_ctl_led_set_id(int card_number, struct snd_ctl_elem_id *id,
 	kctl = snd_ctl_find_id(card, id);
 	if (!kctl)
 		return -ENOENT;
+	if (!kctl->info || !kctl->get)
+		return -EINVAL;
 	ioff = snd_ctl_get_ioff(kctl, id);
 	vd = &kctl->vd[ioff];
 	access = vd->access & SNDRV_CTL_ELEM_ACCESS_LED_MASK;
-- 
2.55.0

On 8/27/26 13:39, Takashi Iwai wrote:

>The kcontrol LED state layer tries to track the all associated
>kcontrol elements with naive assumptions that they are readable.
>But one can create a write-only element that has no get callback (even
>a user element can do it), and this may lead to a NULL dereference at
>the call chain of snd_ctl_led_notify(), as found by syzkaller.
>
>For avoiding the Oops, add a sanity check of the kcontrol's info and
>get callbacks, and just skip the invalid kcontrols before assigning
>the kctl to the LED layer.

I don't think a user can attach a device via sysfs without root permissions,
(correct me if I am wrong). I attempted it on my device and got Permission
Denied. But otherwise, seems to be okay.

Thanks,
Jeffin.

On Thu, 27 Aug 2026 15:12:11 +0200,
Jeffin Philip wrote:
> 
> On 8/27/26 13:39, Takashi Iwai wrote:
> 
> >The kcontrol LED state layer tries to track the all associated
> >kcontrol elements with naive assumptions that they are readable.
> >But one can create a write-only element that has no get callback (even
> >a user element can do it), and this may lead to a NULL dereference at
> >the call chain of snd_ctl_led_notify(), as found by syzkaller.
> >
> >For avoiding the Oops, add a sanity check of the kcontrol's info and
> >get callbacks, and just skip the invalid kcontrols before assigning
> >the kctl to the LED layer.
> 
> I don't think a user can attach a device via sysfs without root permissions,
> (correct me if I am wrong).

The kcontrol can be added without root privilege.  But the
reassignment of LED-control via sysfs is only for root, so the
specific trigger pattern by syzbot is only for root.

However, in theory, it could be without root if a driver has some
built-in patterns to bind LED controls and if one would add user
elements manually later to match with it.


thanks,

Takashi

On 8/27/26 13:39, Takashi Iwai wrote:
> The kcontrol LED state layer tries to track the all associated
> kcontrol elements with naive assumptions that they are readable.
> But one can create a write-only element that has no get callback (even
> a user element can do it), and this may lead to a NULL dereference at
> the call chain of snd_ctl_led_notify(), as found by syzkaller.
> 
> For avoiding the Oops, add a sanity check of the kcontrol's info and
> get callbacks, and just skip the invalid kcontrols before assigning
> the kctl to the LED layer.
> 
> Reported-by: syzbot+b7fe2760ea6f1ee44b4d@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/6a9007b3.1d9ded08.62e62.00cd.GAE@google.com
> Fixes: 22d8de62f11b ("ALSA: control - add generic LED trigger module as the new control layer")
> Signed-off-by: Takashi Iwai <tiwai@suse.de>

Reviewed-by: Jaroslav Kysela <perex@perex.cz>

-- 
Jaroslav Kysela <perex@perex.cz>
Linux Sound Maintainer; ALSA Project; Red Hat