Merge android-4.4.117 (4ec3656) into msm-4.4

* refs/heads/tmp-4ec3656
  Linux 4.4.117
  media: r820t: fix r820t_write_reg for KASAN
  ARM: dts: s5pv210: add interrupt-parent for ohci
  ARM: pxa/tosa-bt: add MODULE_LICENSE tag
  vfs: don't do RCU lookup of empty pathnames
  x86: fix build warnign with 32-bit PAE
  dm: correctly handle chained bios in dec_pending()
  mvpp2: fix multicast address filter
  ALSA: seq: Fix racy pool initializations
  ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204
  ALSA: hda/realtek: PCI quirk for Fujitsu U7x7
  ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute
  ALSA: hda - Fix headset mic detection problem for two Dell machines
  Btrfs: fix unexpected -EEXIST when creating new inode
  Btrfs: fix crash due to not cleaning up tree log block's dirty bits
  Btrfs: fix deadlock in run_delalloc_nocow
  rtlwifi: rtl8821ae: Fix connection lost problem correctly
  console/dummy: leave .con_font_get set to NULL
  video: fbdev: atmel_lcdfb: fix display-timings lookup
  mm: hide a #warning for COMPILE_TEST
  ext4: correct documentation for grpid mount option
  ext4: save error to disk in __ext4_grp_locked_error()
  rtc-opal: Fix handling of firmware error codes, prevent busy loops
  drm/radeon: adjust tested variable
  x86/cpu: Change type of x86_cache_size variable to unsigned int
  KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(), by always inlining iterator helper methods
  ALSA: seq: Fix regression by incorrect ioctl_mutex usages
  arm: spear13xx: Fix spics gpio controller's warning
  arm: spear13xx: Fix dmas cells
  arm: spear600: Add missing interrupt-parent of rtc
  ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property
  s390: fix handling of -1 in set{,fs}[gu]id16 syscalls
  PM / devfreq: Propagate error from devfreq_add_device()
  IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports
  BACKPORT: tee: shm: Potential NULL dereference calling tee_shm_register()
  BACKPORT: tee: shm: don't put_page on null shm->pages
  BACKPORT: tee: shm: make function __tee_shm_alloc static
  BACKPORT: tee: optee: check type of registered shared memory
  BACKPORT: tee: add start argument to shm_register callback
  BACKPORT: tee: optee: fix header dependencies
  BACKPORT: tee: shm: inline tee_shm_get_id()
  BACKPORT: tee: use reference counting for tee_context
  BACKPORT: tee: optee: enable dynamic SHM support
  BACKPORT: tee: optee: add optee-specific shared pool implementation
  BACKPORT: tee: optee: store OP-TEE capabilities in private data
  BACKPORT: tee: optee: add registered buffers handling into RPC calls
  BACKPORT: tee: optee: add registered shared parameters handling
  BACKPORT: tee: optee: add shared buffer registration functions
  BACKPORT: tee: optee: add page list manipulation functions
  BACKPORT: tee: optee: Update protocol definitions
  BACKPORT: tee: shm: add page accessor functions
  BACKPORT: tee: shm: add accessors for buffer size and page offset
  BACKPORT: tee: add register user memory
  BACKPORT: tee: flexible shared memory pool creation
  BACKPORT: optee: support asynchronous supplicant requests
  BACKPORT: tee: add TEE_IOCTL_PARAM_ATTR_META
  BACKPORT: tee: add tee_param_is_memref() for driver use
  f2fs: fix build error with multiply defined inode_nohighmem()

Change-Id: I6b4b025e4b03fe9433de0bf2ff292a8f24e3c3cb
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

1 files changed, 11 insertions, 7 deletions

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index deb6baf4f2ca..ab230514680b 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -355,17 +355,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request,
 			    int validx, int *value_ret)
 {
 	struct snd_usb_audio *chip = cval->head.mixer->chip;
-	unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */
+	/* enough space for one range */
+	unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)];
 	unsigned char *val;
-	int idx = 0, ret, size;
+	int idx = 0, ret, val_size, size;
 	__u8 bRequest;
 
+	val_size = uac2_ctl_value_size(cval->val_type);
+
 	if (request == UAC_GET_CUR) {
 		bRequest = UAC2_CS_CUR;
-		size = uac2_ctl_value_size(cval->val_type);
+		size = val_size;
 	} else {
 		bRequest = UAC2_CS_RANGE;
-		size = sizeof(buf);
+		size = sizeof(__u16) + 3 * val_size;
 	}
 
 	memset(buf, 0, sizeof(buf));
@@ -398,16 +401,17 @@ error:
 		val = buf + sizeof(__u16);
 		break;
 	case UAC_GET_MAX:
-		val = buf + sizeof(__u16) * 2;
+		val = buf + sizeof(__u16) + val_size;
 		break;
 	case UAC_GET_RES:
-		val = buf + sizeof(__u16) * 3;
+		val = buf + sizeof(__u16) + val_size * 2;
 		break;
 	default:
 		return -EINVAL;
 	}
 
-	*value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16)));
+	*value_ret = convert_signed_value(cval,
+					  snd_usb_combine_bytes(val, val_size));
 
 	return 0;
 }