Merge tag 'tegra-l4t-r21.7' into toradex_tk1_l4t_r21.7-next

Merge NVIDIA's latest Linux for Tegra aka L4T R21.7 Linux kernel changes
from git://nv-tegra.nvidia.com/linux-3.10.git commit:

e78bb38b883c42edf81766a1d557aed74458e08f

Conflicts involved missing 24-bit LVDS support and a single whitespace
aka tab difference in drivers/video/tegra/dc/sor.c.

Signed-off-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>

3 files changed, 20 insertions, 10 deletions

diff --git a/sound/soc/tegra/tegra30_avp.c b/sound/soc/tegra/tegra30_avp.c
index 44d954561f96..a074e25614d1 100644
--- a/sound/soc/tegra/tegra30_avp.c
+++ b/sound/soc/tegra/tegra30_avp.c
@@ -256,7 +256,7 @@ static int tegra30_avp_load_ucode(void)
 	struct audio_engine_data *audio_engine;
 	const struct firmware *ucode_fw;
 	const struct tegra30_avp_ucode_desc *ucode_desc;
-	int ucode_size = 0, ucode_offset = 0, total_ucode_size = 0;
+	ssize_t ucode_size = 0, ucode_offset = 0, total_ucode_size = 0;
 	int i, ret = 0;
 
 	dev_vdbg(audio_avp->dev, "%s", __func__);
@@ -296,13 +296,14 @@ static int tegra30_avp_load_ucode(void)
 		}
 
 		ucode_size = ucode_fw->size;
-		if (ucode_size <= 0) {
+		if (ucode_size <= 0 ||
+			ucode_size > avp_ucode_desc[i].max_mem_size) {
 			dev_err(audio_avp->dev, "Invalid ucode size.");
 			ret = -EINVAL;
 			release_firmware(ucode_fw);
 			goto err_param_mem_free;
 		}
-		dev_vdbg(audio_avp->dev, "%s ucode size = %d bytes",
+		dev_vdbg(audio_avp->dev, "%s ucode size = %zd bytes",
 			ucode_desc->bin_name, ucode_size);
 
 		/* Read ucode */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 3879eae7e874..a72bfeee6de2 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -136,6 +136,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
 		snd_printk(KERN_ERR "cannot memdup\n");
 		return -ENOMEM;
 	}
+	INIT_LIST_HEAD(&fp->list);
 	if (fp->nr_rates > MAX_NR_RATES) {
 		kfree(fp);
 		return -EINVAL;
@@ -154,15 +155,12 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
 		? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
 	err = snd_usb_add_audio_stream(chip, stream, fp);
 	if (err < 0) {
-		kfree(fp);
-		kfree(rate_table);
-		return err;
+		goto error;
 	}
 	if (fp->iface != get_iface_desc(&iface->altsetting[0])->bInterfaceNumber ||
 	    fp->altset_idx >= iface->num_altsetting) {
-		kfree(fp);
-		kfree(rate_table);
-		return -EINVAL;
+		err = -EINVAL;
+		goto error;
 	}
 	alts = &iface->altsetting[fp->altset_idx];
 	if (fp->datainterval == 0)
@@ -173,6 +171,11 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
 	snd_usb_init_pitch(chip, fp->iface, alts, fp);
 	snd_usb_init_sample_rate(chip, fp->iface, alts, fp, fp->rate_max);
 	return 0;
+error:
+	list_del(&fp->list); /* unlink for avoiding double-free */
+	kfree(fp);
+	kfree(rate_table);
+	return err;
 }
 
 /*
@@ -239,6 +242,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
 	fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
 	fp->datainterval = 0;
 	fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
+	INIT_LIST_HEAD(&fp->list);
 
 	switch (fp->maxpacksize) {
 	case 0x120:
@@ -262,6 +266,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
 		? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
 	err = snd_usb_add_audio_stream(chip, stream, fp);
 	if (err < 0) {
+		list_del(&fp->list); /* unlink for avoiding double-free */
 		kfree(fp);
 		return err;
 	}
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 5b6f7a027c6a..7ddf4a437e4a 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -307,7 +307,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
 /*
  * add this endpoint to the chip instance.
  * if a stream with the same endpoint already exists, append to it.
- * if not, create a new pcm stream.
+ * if not, create a new pcm stream. note, fp is added to the substream
+ * fmt_list and will be freed on the chip instance release. do not free
+ * fp or do remove it from the substream fmt_list to avoid double-free.
  */
 int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
 			     int stream,
@@ -755,6 +757,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
 		fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
 		fp->clock = clock;
 		fp->chmap = convert_chmap(num_channels, chconfig, protocol);
+		INIT_LIST_HEAD(&fp->list);
 
 		/* some quirks for attributes here */
 
@@ -799,6 +802,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
 		snd_printdd(KERN_INFO "%d:%u:%d: add audio endpoint %#x\n", dev->devnum, iface_no, altno, fp->endpoint);
 		err = snd_usb_add_audio_stream(chip, stream, fp);
 		if (err < 0) {
+			list_del(&fp->list); /* unlink for avoiding double-free */
 			kfree(fp->rate_table);
 			kfree(fp->chmap);
 			kfree(fp);