linux/sound
Takashi Iwai a91d66129f ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal
The commit 99b5c5bb9a ("ALSA: hda - Remove the use of set_fs()")
converted the get_kctl_0dB_offset() call for killing set_fs() usage in
HD-audio codec code.  The conversion assumed that the TLV callback
used in HD-audio code is only snd_hda_mixer_amp() and applies the TLV
calculation locally.

Although this assumption is correct, and all slave kctls are actually
with that callback, the current code is still utterly buggy; it
doesn't hit this condition and falls back to the next check.  It's
because the function gets called after adding slave kctls to vmaster.
By assigning a slave kctl, the slave kctl object is faked inside
vmaster code, and the whole kctl ops are overridden.  Thus the
callback op points to a different value from what we've assumed.

More badly, as reported by the KERNEXEC and UDEREF features of PaX,
the code flow turns into the unexpected pitfall.  The next fallback
check is SNDRV_CTL_ELEM_ACCESS_TLV_READ access bit, and this always
hits for each kctl with TLV.  Then it evaluates the callback function
pointer wrongly as if it were a TLV array.  Although currently its
side-effect is fairly limited, this incorrect reference may lead to an
unpleasant result.

For addressing the regression, this patch introduces a new helper to
vmaster code, snd_ctl_apply_vmaster_slaves().  This works similarly
like the existing map_slaves() in hda_codec.c: it loops over the slave
list of the given master, and applies the given function to each
slave.  Then the initializer function receives the right kctl object
and we can compare the correct pointer instead of the faked one.

Also, for catching the similar breakage in future, give an error
message when the unexpected TLV callback is found and bail out
immediately.

Fixes: 99b5c5bb9a ("ALSA: hda - Remove the use of set_fs()")
Reported-by: PaX Team <pageexec@freemail.hu>
Cc: <stable@vger.kernel.org> # v4.13
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-10-18 12:27:00 +02:00
..
aoa ALSA: aoa: Convert to using %pOF instead of full_name 2017-08-29 14:52:17 +02:00
arm ALSA: aaci: constify ac97_pcm structures 2017-08-23 15:53:37 +02:00
atmel ASoC: Updates for v4.14 2017-09-04 14:50:49 +02:00
core ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal 2017-10-18 12:27:00 +02:00
drivers ALSA: vx: Put missing KERN_CONT prefix 2017-08-31 11:01:17 +02:00
firewire ALSA: firewire: Use common error handling code in snd_motu_stream_start_duplex() 2017-09-12 09:23:26 +02:00
hda ALSA: hda: Abort capability probe at invalid register read 2017-10-18 12:26:44 +02:00
i2c
isa ALSA: isa: make snd_pcm_hardware const 2017-08-17 12:44:11 +02:00
mips ALSA: mips: constify snd_pcm_ops structures 2017-08-19 11:02:18 +02:00
oss vfs: constify path argument to kernel_read_file_from_path 2017-09-14 20:18:45 -07:00
parisc sound updates for 4.14-rc1 2017-09-07 12:44:53 -07:00
pci ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal 2017-10-18 12:27:00 +02:00
pcmcia ALSA: pcmcia: constify snd_pcm_ops structures 2017-08-19 11:02:21 +02:00
ppc ALSA: ppc: constify snd_pcm_ops structures 2017-08-19 11:02:22 +02:00
sh ALSA: sh: Put missing KERN_* prefix 2017-08-31 11:02:15 +02:00
soc dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
sparc ALSA: sparc: constify snd_pcm_ops structures 2017-08-19 11:02:24 +02:00
spi ALSA: spi: constify snd_pcm_ops structures 2017-08-19 11:02:26 +02:00
synth ALSA: emux: Delete two error messages for a failed memory allocation in snd_emux_create_port() 2017-08-10 17:55:13 +02:00
usb ALSA: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital 2017-10-16 13:34:55 +02:00
x86 main drm pull for v4.13 2017-07-09 18:48:37 -07:00
Kconfig
Makefile
ac97_bus.c
last.c
sound_core.c