Merge tag 'sound-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound updates from Takashi Iwai:
 "This time was again a relatively calm development cycle; most of
  updates are about drivers, and no radical changes are seen in any core
  code.  Here are some highlights:

  ALSA core:
   - Continued hardening of ALSA hrtimer
   - A few leak fixes in timer interface
   - Fix poll error handling in PCM and compress
   - Add error propagation in compress API
   - Removal of dead rtctimer driver

  HD-audio:
   - Native ELD notify support for i915 HDMI
   - Realtek ALC234 & co support
   - Code refactoring to standardize chmap support
   - Continued development for SKL HDMI core support

  Firewire:
   - Apply delayed card registration to all drivers
   - Improved / stabilized the handling of PCM stream start / stop
   - Add tracepoints to dump a part of isochronous packet data
   - Fixed incoming/outgoing packet parameter usages
   - Add support for M-Audio profire series

  USB-audio:
   - Fixes for UAC2 clock source
   - SS+ support
   - Workaround for oft-seen repeated sample rate read errors

  ASoC:
   - Further slow progress on the topology code
   - Substantial updates and improvements for the da7219, es8328,
     fsl-ssi, Intel and rcar drivers.
   - Compress error handling in WM ADSP driver"

* tag 'sound-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (177 commits)
  ALSA: firewire-lib: change a member of event structure to suppress sparse wanings to bool type
  sound: oss: Use setup_timer and mod_timer.
  ASoC: hdac_hdmi: Remove the unused 'timeout' variable
  ASoC: fsl_ssi: Fix channel slipping on capture (or playback) restart in full duplex.
  ASoC: fsl_ssi: Fix channel slipping in Playback at startup
  ASoC: fsl_ssi: Fix samples being dropped at Playback startup
  ASoC: fsl_ssi: Save a dev reference for dev_err() purpose.
  ASoC: fsl_ssi: The IPG/5 limitation concerns the bitclk, not the sysclk.
  ASoC: fsl_ssi: Real hardware channels max number is 32
  ASoC: pcm5102a: Add support for PCM5102A codec
  ASoC: hdac_hdmi: add link management
  ASoC: Intel: Skylake: add link management
  ALSA: hdac: add link pm and ref counting
  ALSA: au88x0: Fix zero clear of stream->resources
  ASoC: rt298: Add DMI match for Broxton-P reference platform
  ASoC: rt298: fix null deref on acpi driver data
  ASoC: dapm: deprecate MICBIAS widget type
  ALSA: firewire-lib: drop skip argument from helper functions to queue a packet
  ALSA: firewire-lib: add context information to tracepoints
  ALSA: firewire-lib: permit to flush queued packets only in process context for better PCM period granularity
  ...

1 files changed, 9 insertions, 0 deletions

diff --git a/sound/isa/wavefront/wavefront_synth.c b/sound/isa/wavefront/wavefront_synth.c
index 69f76ff5693d..718d5e3b7806 100644
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -785,6 +785,9 @@ wavefront_send_patch (snd_wavefront_t *dev, wavefront_patch_info *header)
 	DPRINT (WF_DEBUG_LOAD_PATCH, "downloading patch %d\n",
 				      header->number);
 
+	if (header->number >= ARRAY_SIZE(dev->patch_status))
+		return -EINVAL;
+
 	dev->patch_status[header->number] |= WF_SLOT_FILLED;
 
 	bptr = buf;
@@ -809,6 +812,9 @@ wavefront_send_program (snd_wavefront_t *dev, wavefront_patch_info *header)
 	DPRINT (WF_DEBUG_LOAD_PATCH, "downloading program %d\n",
 		header->number);
 
+	if (header->number >= ARRAY_SIZE(dev->prog_status))
+		return -EINVAL;
+
 	dev->prog_status[header->number] = WF_SLOT_USED;
 
 	/* XXX need to zero existing SLOT_USED bit for program_status[i]
@@ -898,6 +904,9 @@ wavefront_send_sample (snd_wavefront_t *dev,
 		header->number = x;
 	}
 
+	if (header->number >= WF_MAX_SAMPLE)
+		return -EINVAL;
+
 	if (header->size) {
 
 		/* XXX it's a debatable point whether or not RDONLY semantics