Patch "ALSA: pcm: Free chmap at PCM free callback, too" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

    ALSA: pcm: Free chmap at PCM free callback, too

to the 4.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     alsa-pcm-free-chmap-at-pcm-free-callback-too.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let [off-list ref] know about it.

From a8ff48cb70835f48de5703052760312019afea55 Mon Sep 17 00:00:00 2001

From: Takashi Iwai <redacted>
Date: Fri, 8 Jul 2016 08:23:43 +0200
Subject: ALSA: pcm: Free chmap at PCM free callback, too

From: Takashi Iwai <redacted>

commit a8ff48cb70835f48de5703052760312019afea55 upstream.

The chmap ctls assigned to PCM streams are freed in the PCM disconnect
callback.  However, since the disconnect callback isn't called when
the card gets freed before registering, the chmap ctls may still be
left assigned.  They are eventually freed together with other ctls,
but it may cause an Oops at pcm_chmap_ctl_private_free(), as the
function refers to the assigned PCM stream, while the PCM objects have
been already freed beforehand.

The fix is to free the chmap ctls also at PCM free callback, not only
at PCM disconnect.

Reported-by: Laxminath Kasam <redacted>
Signed-off-by: Takashi Iwai <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/pcm.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c

@@ -849,6 +849,14 @@ int snd_pcm_new_internal(struct snd_card
 }
 EXPORT_SYMBOL(snd_pcm_new_internal);
 
+static void free_chmap(struct snd_pcm_str *pstr)
+{
+	if (pstr->chmap_kctl) {
+		snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl);
+		pstr->chmap_kctl = NULL;
+	}
+}
+
 static void snd_pcm_free_stream(struct snd_pcm_str * pstr)
 {
 	struct snd_pcm_substream *substream, *substream_next;

@@ -871,6 +879,7 @@ static void snd_pcm_free_stream(struct s
 		kfree(setup);
 	}
 #endif
+	free_chmap(pstr);
 	if (pstr->substream_count)
 		put_device(&pstr->dev);
 }

@@ -1135,10 +1144,7 @@ static int snd_pcm_dev_disconnect(struct
 	for (cidx = 0; cidx < 2; cidx++) {
 		if (!pcm->internal)
 			snd_unregister_device(&pcm->streams[cidx].dev);
-		if (pcm->streams[cidx].chmap_kctl) {
-			snd_ctl_remove(pcm->card, pcm->streams[cidx].chmap_kctl);
-			pcm->streams[cidx].chmap_kctl = NULL;
-		}
+		free_chmap(&pcm->streams[cidx]);
 	}
 	mutex_unlock(&pcm->open_mutex);
 	mutex_unlock(&register_mutex);

Patches currently in stable-queue which might be from tiwai@suse.de are

queue-4.6/alsa-hda-fix-the-headset-mic-jack-detection-on-dell-machine.patch
queue-4.6/alsa-ctl-stop-notification-after-disconnection.patch
queue-4.6/alsa-dummy-fix-a-use-after-free-at-closing.patch
queue-4.6/alsa-timer-fix-negative-queue-usage-by-racy-accesses.patch
queue-4.6/alsa-hda-fix-use-after-free-after-module-unload.patch
queue-4.6/alsa-hda-realtek-add-new-pin-definition-in-alc225-pin-quirk-table.patch
queue-4.6/alsa-hdac_regmap-fix-the-register-access-for-runtime-pm.patch
queue-4.6/alsa-hda-add-pci-id-for-kabylake-h.patch
queue-4.6/alsa-usb-audio-fix-quirks-code-is-not-called.patch
queue-4.6/alsa-pcm-free-chmap-at-pcm-free-callback-too.patch
queue-4.6/alsa-au88x0-fix-calculation-in-vortex_wtdma_bufshift.patch
queue-4.6/alsa-hda-realtek-add-lenovo-l460-to-docking-unit-fixup.patch
queue-4.6/alsa-echoaudio-fix-memory-allocation.patch
queue-4.6/alsa-hda-realtek-add-two-more-thinkpad-ids-5050-5053-for-tpt460-fixup.patch
queue-4.6/alsa-hda-fix-read-before-array-start.patch
queue-4.6/alsa-hda-add-amd-stoney-pci-id-with-proper-driver-caps.patch