Merge tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A couple of USB-audio fixes that should also go to stable kernels"

* tag 'sound-3.11' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: usb-audio: do not trust too-big wMaxPacketSize values
  ALSA: 6fire: fix DMA issues with URB transfer_buffer usage

3 files changed, 40 insertions, 13 deletions

diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c
index 9e6e3ffd86bb..23452ee617e1 100644
--- a/sound/usb/6fire/comm.c
+++ b/sound/usb/6fire/comm.c
@@ -110,19 +110,37 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev)
 static int usb6fire_comm_write8(struct comm_runtime *rt, u8 request,
                 u8 reg, u8 value)
 {
-        u8 buffer[13]; /* 13: maximum length of message */
+        u8 *buffer;
+        int ret;
+
+        /* 13: maximum length of message */
+        buffer = kmalloc(13, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
 
         usb6fire_comm_init_buffer(buffer, 0x00, request, reg, value, 0x00);
-        return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+        ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+
+        kfree(buffer);
+        return ret;
 }
 
 static int usb6fire_comm_write16(struct comm_runtime *rt, u8 request,
                 u8 reg, u8 vl, u8 vh)
 {
-        u8 buffer[13]; /* 13: maximum length of message */
+        u8 *buffer;
+        int ret;
+
+        /* 13: maximum length of message */
+        buffer = kmalloc(13, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
 
         usb6fire_comm_init_buffer(buffer, 0x00, request, reg, vl, vh);
-        return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+        ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
+
+        kfree(buffer);
+        return ret;
 }
 
 int usb6fire_comm_init(struct sfire_chip *chip)
@@ -135,6 +153,12 @@ int usb6fire_comm_init(struct sfire_chip *chip)
         if (!rt)
                 return -ENOMEM;
 
+        rt->receiver_buffer = kzalloc(COMM_RECEIVER_BUFSIZE, GFP_KERNEL);
+        if (!rt->receiver_buffer) {
+                kfree(rt);
+                return -ENOMEM;
+        }
+
         urb = &rt->receiver;
         rt->serial = 1;
         rt->chip = chip;
@@ -153,6 +177,7 @@ int usb6fire_comm_init(struct sfire_chip *chip)
         urb->interval = 1;
         ret = usb_submit_urb(urb, GFP_KERNEL);
         if (ret < 0) {
+                kfree(rt->receiver_buffer);
                 kfree(rt);
                 snd_printk(KERN_ERR PREFIX "cannot create comm data receiver.");
                 return ret;
@@ -171,6 +196,9 @@ void usb6fire_comm_abort(struct sfire_chip *chip)
 
 void usb6fire_comm_destroy(struct sfire_chip *chip)
 {
-        kfree(chip->comm);
+        struct comm_runtime *rt = chip->comm;
+
+        kfree(rt->receiver_buffer);
+        kfree(rt);
         chip->comm = NULL;
 }
diff --git a/sound/usb/6fire/comm.h b/sound/usb/6fire/comm.h
index 6a0840b0dcff..780d5ed8e5d8 100644
--- a/sound/usb/6fire/comm.h
+++ b/sound/usb/6fire/comm.h
@@ -24,7 +24,7 @@ struct comm_runtime {
         struct sfire_chip *chip;
 
         struct urb receiver;
-        u8 receiver_buffer[COMM_RECEIVER_BUFSIZE];
+        u8 *receiver_buffer;
 
         u8 serial; /* urb serial */
 
diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
index 7a444b5501d9..659950e5b94f 100644
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -591,17 +591,16 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep,
         ep->stride = frame_bits >> 3;
         ep->silence_value = pcm_format == SNDRV_PCM_FORMAT_U8 ? 0x80 : 0;
 
-        /* calculate max. frequency */
-        if (ep->maxpacksize) {
+        /* assume max. frequency is 25% higher than nominal */
+        ep->freqmax = ep->freqn + (ep->freqn >> 2);
+        maxsize = ((ep->freqmax + 0xffff) * (frame_bits >> 3))
+                                >> (16 - ep->datainterval);
+        /* but wMaxPacketSize might reduce this */
+        if (ep->maxpacksize && ep->maxpacksize < maxsize) {
                 /* whatever fits into a max. size packet */
                 maxsize = ep->maxpacksize;
                 ep->freqmax = (maxsize / (frame_bits >> 3))
                                 << (16 - ep->datainterval);
-        } else {
-                /* no max. packet size: just take 25% higher than nominal */
-                ep->freqmax = ep->freqn + (ep->freqn >> 2);
-                maxsize = ((ep->freqmax + 0xffff) * (frame_bits >> 3))
-                                >> (16 - ep->datainterval);
         }
 
         if (ep->fill_max)