9 files changed, 17 insertions, 16 deletions

diff --git a/sound/soc/codecs/ac97.c b/sound/soc/codecs/ac97.c
index fb53e6511af2..89d41277616d 100644
--- a/sound/soc/codecs/ac97.c
+++ b/sound/soc/codecs/ac97.c
@@ -123,7 +123,6 @@ bus_err:
         snd_soc_free_pcms(socdev);
 
 err:
-        kfree(socdev->codec->reg_cache);
         kfree(socdev->codec);
         socdev->codec = NULL;
         return ret;
@@ -138,7 +137,6 @@ static int ac97_soc_remove(struct platform_device *pdev)
                 return 0;
 
         snd_soc_free_pcms(socdev);
-        kfree(socdev->codec->reg_cache);
         kfree(socdev->codec);
 
         return 0;
diff --git a/sound/soc/codecs/ad1980.c b/sound/soc/codecs/ad1980.c
index c3c5d0eee37a..faf358758e13 100644
--- a/sound/soc/codecs/ad1980.c
+++ b/sound/soc/codecs/ad1980.c
@@ -109,7 +109,7 @@ static unsigned int ac97_read(struct snd_soc_codec *codec,
         default:
                 reg = reg >> 1;
 
-                if (reg >= (ARRAY_SIZE(ad1980_reg)))
+                if (reg >= ARRAY_SIZE(ad1980_reg))
                         return -EINVAL;
 
                 return cache[reg];
@@ -123,7 +123,7 @@ static int ac97_write(struct snd_soc_codec *codec, unsigned int reg,
 
         soc_ac97_ops.write(codec->ac97, reg, val);
         reg = reg >> 1;
-        if (reg < (ARRAY_SIZE(ad1980_reg)))
+        if (reg < ARRAY_SIZE(ad1980_reg))
                 cache[reg] = val;
 
         return 0;
diff --git a/sound/soc/codecs/twl4030.c b/sound/soc/codecs/twl4030.c
index ddc9f37d863f..f530c1e6d9e8 100644
--- a/sound/soc/codecs/twl4030.c
+++ b/sound/soc/codecs/twl4030.c
@@ -125,6 +125,9 @@ static inline unsigned int twl4030_read_reg_cache(struct snd_soc_codec *codec,
 {
         u8 *cache = codec->reg_cache;
 
+        if (reg >= TWL4030_CACHEREGNUM)
+                return -EIO;
+
         return cache[reg];
 }
 
diff --git a/sound/soc/codecs/wm8580.c b/sound/soc/codecs/wm8580.c
index 9b75a377453e..3faf0e70ce10 100644
--- a/sound/soc/codecs/wm8580.c
+++ b/sound/soc/codecs/wm8580.c
@@ -200,7 +200,7 @@ static inline unsigned int wm8580_read_reg_cache(struct snd_soc_codec *codec,
         unsigned int reg)
 {
         u16 *cache = codec->reg_cache;
-        BUG_ON(reg > ARRAY_SIZE(wm8580_reg));
+        BUG_ON(reg >= ARRAY_SIZE(wm8580_reg));
         return cache[reg];
 }
 
@@ -223,7 +223,7 @@ static int wm8580_write(struct snd_soc_codec *codec, unsigned int reg,
 {
         u8 data[2];
 
-        BUG_ON(reg > ARRAY_SIZE(wm8580_reg));
+        BUG_ON(reg >= ARRAY_SIZE(wm8580_reg));
 
         /* Registers are 9 bits wide */
         value &= 0x1ff;
diff --git a/sound/soc/codecs/wm8728.c b/sound/soc/codecs/wm8728.c
index defa310bc7d9..f90dc52e975d 100644
--- a/sound/soc/codecs/wm8728.c
+++ b/sound/soc/codecs/wm8728.c
@@ -47,7 +47,7 @@ static inline unsigned int wm8728_read_reg_cache(struct snd_soc_codec *codec,
         unsigned int reg)
 {
         u16 *cache = codec->reg_cache;
-        BUG_ON(reg > ARRAY_SIZE(wm8728_reg_defaults));
+        BUG_ON(reg >= ARRAY_SIZE(wm8728_reg_defaults));
         return cache[reg];
 }
 
@@ -55,7 +55,7 @@ static inline void wm8728_write_reg_cache(struct snd_soc_codec *codec,
         u16 reg, unsigned int value)
 {
         u16 *cache = codec->reg_cache;
-        BUG_ON(reg > ARRAY_SIZE(wm8728_reg_defaults));
+        BUG_ON(reg >= ARRAY_SIZE(wm8728_reg_defaults));
         cache[reg] = value;
 }
 
diff --git a/sound/soc/codecs/wm8753.c b/sound/soc/codecs/wm8753.c
index 7283178e0eb5..5a1c1fca120f 100644
--- a/sound/soc/codecs/wm8753.c
+++ b/sound/soc/codecs/wm8753.c
@@ -97,7 +97,7 @@ static inline unsigned int wm8753_read_reg_cache(struct snd_soc_codec *codec,
         unsigned int reg)
 {
         u16 *cache = codec->reg_cache;
-        if (reg < 1 || reg > (ARRAY_SIZE(wm8753_reg) + 1))
+        if (reg < 1 || reg >= (ARRAY_SIZE(wm8753_reg) + 1))
                 return -1;
         return cache[reg - 1];
 }
@@ -109,7 +109,7 @@ static inline void wm8753_write_reg_cache(struct snd_soc_codec *codec,
         unsigned int reg, unsigned int value)
 {
         u16 *cache = codec->reg_cache;
-        if (reg < 1 || reg > 0x3f)
+        if (reg < 1 || reg >= (ARRAY_SIZE(wm8753_reg) + 1))
                 return;
         cache[reg - 1] = value;
 }
diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
index 6b2778632d5e..f93c0955ed9d 100644
--- a/sound/soc/codecs/wm8990.c
+++ b/sound/soc/codecs/wm8990.c
@@ -116,7 +116,7 @@ static inline unsigned int wm8990_read_reg_cache(struct snd_soc_codec *codec,
         unsigned int reg)
 {
         u16 *cache = codec->reg_cache;
-        BUG_ON(reg > (ARRAY_SIZE(wm8990_reg)) - 1);
+        BUG_ON(reg >= ARRAY_SIZE(wm8990_reg));
         return cache[reg];
 }
 
@@ -129,7 +129,7 @@ static inline void wm8990_write_reg_cache(struct snd_soc_codec *codec,
         u16 *cache = codec->reg_cache;
 
         /* Reset register and reserved registers are uncached */
-        if (reg == 0 || reg > ARRAY_SIZE(wm8990_reg) - 1)
+        if (reg == 0 || reg >= ARRAY_SIZE(wm8990_reg))
                 return;
 
         cache[reg] = value;
diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index 1b0ace0f4dca..4dc90d67530e 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -452,7 +452,7 @@ static unsigned int ac97_read(struct snd_soc_codec *codec,
         else {
                 reg = reg >> 1;
 
-                if (reg > (ARRAY_SIZE(wm9712_reg)))
+                if (reg >= (ARRAY_SIZE(wm9712_reg)))
                         return -EIO;
 
                 return cache[reg];
@@ -466,7 +466,7 @@ static int ac97_write(struct snd_soc_codec *codec, unsigned int reg,
 
         soc_ac97_ops.write(codec->ac97, reg, val);
         reg = reg >> 1;
-        if (reg <= (ARRAY_SIZE(wm9712_reg)))
+        if (reg < (ARRAY_SIZE(wm9712_reg)))
                 cache[reg] = val;
 
         return 0;
diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
index e636d8a18ed6..0e60e16973d4 100644
--- a/sound/soc/codecs/wm9713.c
+++ b/sound/soc/codecs/wm9713.c
@@ -620,7 +620,7 @@ static unsigned int ac97_read(struct snd_soc_codec *codec,
         else {
                 reg = reg >> 1;
 
-                if (reg > (ARRAY_SIZE(wm9713_reg)))
+                if (reg >= (ARRAY_SIZE(wm9713_reg)))
                         return -EIO;
 
                 return cache[reg];
@@ -634,7 +634,7 @@ static int ac97_write(struct snd_soc_codec *codec, unsigned int reg,
         if (reg < 0x7c)
                 soc_ac97_ops.write(codec->ac97, reg, val);
         reg = reg >> 1;
-        if (reg <= (ARRAY_SIZE(wm9713_reg)))
+        if (reg < (ARRAY_SIZE(wm9713_reg)))
                 cache[reg] = val;
 
         return 0;