Takashi Iwai a91d66129f ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal ... The commit 99b5c5bb9a ("ALSA: hda - Remove the use of set_fs()") converted the get_kctl_0dB_offset() call for killing set_fs() usage in HD-audio codec code. The conversion assumed that the TLV callback used in HD-audio code is only snd_hda_mixer_amp() and applies the TLV calculation locally. Although this assumption is correct, and all slave kctls are actually with that callback, the current code is still utterly buggy; it doesn't hit this condition and falls back to the next check. It's because the function gets called after adding slave kctls to vmaster. By assigning a slave kctl, the slave kctl object is faked inside vmaster code, and the whole kctl ops are overridden. Thus the callback op points to a different value from what we've assumed. More badly, as reported by the KERNEXEC and UDEREF features of PaX, the code flow turns into the unexpected pitfall. The next fallback check is SNDRV_CTL_ELEM_ACCESS_TLV_READ access bit, and this always hits for each kctl with TLV. Then it evaluates the callback function pointer wrongly as if it were a TLV array. Although currently its side-effect is fairly limited, this incorrect reference may lead to an unpleasant result. For addressing the regression, this patch introduces a new helper to vmaster code, snd_ctl_apply_vmaster_slaves(). This works similarly like the existing map_slaves() in hda_codec.c: it loops over the slave list of the given master, and applies the given function to each slave. Then the initializer function receives the right kctl object and we can compare the correct pointer instead of the faked one. Also, for catching the similar breakage in future, give an error message when the unexpected TLV callback is found and bail out immediately. Fixes: 99b5c5bb9a ("ALSA: hda - Remove the use of set_fs()") Reported-by: PaX Team <pageexec@freemail.hu> Cc: <stable@vger.kernel.org> # v4.13 Signed-off-by: Takashi Iwai <tiwai@suse.de>		2017-10-18 12:27:00 +02:00
..
acpi	ACPI / bus: Make ACPI_HANDLE() work for non-GPL code again	2017-09-19 22:42:31 +02:00
asm-generic	percpu: make this_cpu_generic_read() atomic w.r.t. interrupts	2017-09-26 07:37:33 -07:00
clocksource
crypto
drm	lib/interval_tree: fast overlap detection	2017-09-08 18:26:49 -07:00
dt-bindings	ARC: reset: remove the misleading v1 suffix all over	2017-09-18 13:02:03 +02:00
keys
kvm
linux	MMC core:	2017-10-07 10:03:03 -07:00
math-emu
media	media updates for v4.14-rc1	2017-09-07 12:53:14 -07:00
memory
misc
net	udp: perform source validation for mcast early demux	2017-10-01 03:55:47 +01:00
pcmcia
ras
rdma	IB: Correct MR length field to be 64-bit	2017-09-25 11:47:23 -04:00
scsi	scsi: libiscsi: Remove iscsi_destroy_session	2017-10-02 22:23:21 -04:00
soc	ARM: SoC driver updates for v4.14	2017-09-10 20:40:00 -07:00
sound	ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal	2017-10-18 12:27:00 +02:00
target
trace	sched/debug: Add explicit TASK_PARKED printing	2017-09-29 11:02:57 +02:00
uapi	- A stable fix for the alignment of the event number reported at the	2017-10-05 15:17:40 -07:00
video
xen	xen, arm64: drop dummy lookup_address()	2017-09-19 09:25:05 -04:00