Merge android-4.4.191 (6da3fbc) into msm-4.4

* refs/heads/tmp-6da3fbc
  Linux 4.4.191
  x86/ptrace: fix up botched merge of spectrev1 fix
  mac80211: fix possible sta leak
  Revert "cfg80211: fix processing world regdomain when non modular"
  VMCI: Release resource if the work is already queued
  stm class: Fix a double free of stm_source_device
  mmc: core: Fix init of SD cards reporting an invalid VDD range
  mmc: sdhci-of-at91: add quirk for broken HS200
  uprobes/x86: Fix detection of 32-bit user mode
  ptrace,x86: Make user_64bit_mode() available to 32-bit builds
  USB: storage: ums-realtek: Whitelist auto-delink support
  USB: storage: ums-realtek: Update module parameter description for auto_delink_en
  usb: host: ohci: fix a race condition between shutdown and irq
  USB: cdc-wdm: fix race between write and disconnect due to flag abuse
  usb-storage: Add new JMS567 revision to unusual_devs
  x86/apic: Include the LDR when clearing out APIC registers
  x86/apic: Do not initialize LDR and DFR for bigsmp
  KVM: x86: Don't update RIP or do single-step on faulting emulation
  ALSA: seq: Fix potential concurrent access to the deleted pool
  tcp: make sure EPOLLOUT wont be missed
  ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
  ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
  tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
  watchdog: bcm2835_wdt: Fix module autoload
  tools: hv: fix KVP and VSS daemons exit code
  usb: host: fotg2: restart hcd after port reset
  usb: gadget: composite: Clear "suspended" on reset/disconnect
  dmaengine: ste_dma40: fix unneeded variable warning
  scsi: ufs: Fix NULL pointer dereference in ufshcd_config_vreg_hpm()
  x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
  x86/pm: Introduce quirk framework to save/restore extra MSR registers around suspend/resume
  Revert "perf test 6: Fix missing kvm module load for s390"
  netfilter: conntrack: Use consistent ct id hash calculation
  netfilter: ctnetlink: don't use conntrack/expect object addresses as id
  inet: switch IP ID generator to siphash
  siphash: implement HalfSipHash1-3 for hash tables
  siphash: add cryptographically secure PRF
  vhost: scsi: add weight support
  vhost_net: fix possible infinite loop
  vhost: introduce vhost_exceeds_weight()
  vhost_net: introduce vhost_exceeds_weight()
  vhost_net: use packet weight for rx handler, too
  vhost-net: set packet weight of tx polling to 2 * vq size
  net: arc_emac: fix koops caused by sk_buff free
  GFS2: don't set rgrp gl_object until it's inserted into rgrp tree
  cgroup: Disable IRQs while holding css_set_lock
  dm table: fix invalid memory accesses with too high sector number
  dm space map metadata: fix missing store of apply_bops() return value
  dm btree: fix order of block initialization in btree_split_beneath
  x86/boot: Fix boot regression caused by bootparam sanitizing
  x86/boot: Save fields explicitly, zero out everything else
  x86/apic: Handle missing global clockevent gracefully
  x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
  userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
  Revert "dm bufio: fix deadlock with loop device"
  HID: wacom: correct misreported EKR ring values
  selftests: kvm: Adding config fragments
  libata: add SG safety checks in SFF pio transfers
  net: hisilicon: Fix dma_map_single failed on arm64
  net: hisilicon: fix hip04-xmit never return TX_BUSY
  net: hisilicon: make hip04_tx_reclaim non-reentrant
  net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
  NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
  can: peak_usb: force the string buffer NULL-terminated
  can: sja1000: force the string buffer NULL-terminated
  perf bench numa: Fix cpu0 binding
  isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
  isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
  net: usb: qmi_wwan: Add the BroadMobi BM818 card
  ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
  st_nci_hci_connectivity_event_received: null check the allocation
  st21nfca_connectivity_event_received: null check the allocation
  can: dev: call netif_carrier_off() in register_candev()
  bonding: Force slave speed check after link state recovery for 802.3ad
  netfilter: ebtables: fix a memory leak bug in compat
  MIPS: kernel: only use i8253 clocksource with periodic clockevent
  HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
  ANDROID: sched: Disallow WALT with CFS bandwidth control
  ANDROID: fiq_debugger: remove
  ANDROID: Add a tracepoint for mapping inode to full path

Conflicts:
	drivers/scsi/ufs/ufshcd.c
	drivers/staging/android/fiq_debugger/fiq_debugger.c
	sound/usb/mixer.c

Change-Id: I95d42e2ce37dd5d32e1737f701976079c43b7501
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

1 files changed, 29 insertions, 9 deletions

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index de8fe209b772..ddf66204f8de 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -82,6 +82,7 @@ struct mixer_build {
 	unsigned char *buffer;
 	unsigned int buflen;
 	DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
+	DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
 	struct usb_audio_term oterm;
 	const struct usbmix_name_map *map;
 	const struct usbmix_selector_map *selector_map;
@@ -721,15 +722,24 @@ static int get_term_name(struct mixer_build *state, struct usb_audio_term *iterm
  * parse the source unit recursively until it reaches to a terminal
  * or a branched unit.
  */
-static int check_input_term(struct mixer_build *state, int id,
+static int __check_input_term(struct mixer_build *state, int id,
 			    struct usb_audio_term *term)
 {
 	int err;
 	void *p1;
+	unsigned char *hdr;
 
 	memset(term, 0, sizeof(*term));
-	while ((p1 = find_audio_control_unit(state, id)) != NULL) {
-		unsigned char *hdr = p1;
+	for (;;) {
+		/* a loop in the terminal chain? */
+		if (test_and_set_bit(id, state->termbitmap))
+			return -EINVAL;
+
+		p1 = find_audio_control_unit(state, id);
+		if (!p1)
+			break;
+
+		hdr = p1;
 		term->id = id;
 		switch (hdr[2]) {
 		case UAC_INPUT_TERMINAL:
@@ -744,7 +754,7 @@ static int check_input_term(struct mixer_build *state, int id,
 
 				/* call recursively to verify that the
 				 * referenced clock entity is valid */
-				err = check_input_term(state, d->bCSourceID, term);
+				err = __check_input_term(state, d->bCSourceID, term);
 				if (err < 0)
 					return err;
 
@@ -759,8 +769,8 @@ static int check_input_term(struct mixer_build *state, int id,
 			} else { /* UAC_VERSION_3 */
 				struct uac3_input_terminal_descriptor *d = p1;
 
-				err = check_input_term(state,
-							d->bCSourceID, term);
+				err = __check_input_term(state,
+							 d->bCSourceID, term);
 				if (err < 0)
 					return err;
 
@@ -817,8 +827,8 @@ static int check_input_term(struct mixer_build *state, int id,
 			} else {
 				struct uac_selector_unit_descriptor *d = p1;
 				/* call recursively to retrieve channel info */
-				err = check_input_term(state,
-							d->baSourceID[0], term);
+				err = __check_input_term(state,
+							 d->baSourceID[0], term);
 				if (err < 0)
 					return err;
 				/* virtual type */
@@ -881,6 +891,15 @@ static int check_input_term(struct mixer_build *state, int id,
 	return -ENODEV;
 }
 
+
+static int check_input_term(struct mixer_build *state, int id,
+			    struct usb_audio_term *term)
+{
+	memset(term, 0, sizeof(*term));
+	memset(state->termbitmap, 0, sizeof(state->termbitmap));
+	return __check_input_term(state, id, term);
+}
+
 /*
  * Feature Unit
  */
@@ -1886,7 +1905,8 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid,
 		    NUM_CHANNELS_MONO : NUM_CHANNELS_STEREO;
 	} else {
 		if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) ||
-		!(num_outs = uac_mixer_unit_bNrChannels(desc))) {
+		    desc->bLength < sizeof(*desc) + desc->bNrInPins ||
+		    !(num_outs = uac_mixer_unit_bNrChannels(desc))) {
 			usb_audio_err(state->chip,
 				      "invalid MIXER UNIT descriptor %d\n",
 				      unitid);