Merge tag 'sound-4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai...

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes:

   - a fix in ALSA timer core to avoid possible BUG() trigger
   - a fix in ALSA timer core 32bit compat layer
   - a few HD-audio quirks for ASUS and HP machines
   - AMD HD-audio HDMI controller quirks
   - fixes of USB-audio double-free at some error paths
   - a fix for memory leak in DICE driver at hotunplug"

* tag 'sound-4.6-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: timer: Use mod_timer() for rearming the system timer
  ALSA: hda - fix front mic problem for a HP desktop
  ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call
  ALSA: hda: add AMD Polaris-10/11 AZ PCI IDs with proper driver caps
  ALSA: dice: fix memory leak when unplugging
  ALSA: hda - Apply fix for white noise on Asus N550JV, too
  ALSA: hda - Fix white noise on Asus N750JV headphone
  ALSA: hda - Asus N750JV external subwoofer fixup
  ALSA: timer: fix gparams ioctl compatibility for different architectures

diff --combined sound/usb/stream.c
index 51258a1,8e9548b..6fe7f21
--- 1/sound/usb/stream.c
--- 2/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@@ -36,7 -36,6 +36,7 @@@
  #include "format.h"
  #include "clock.h"
  #include "stream.h"
 +#include "media.h"
  
  /*
   * free a substream
@@@ -53,7 -52,6 +53,7 @@@ static void free_substream(struct snd_u
                kfree(fp);
        }
        kfree(subs->rate_list.list);
 +      media_snd_stream_delete(subs);
  }
  
  
@@@ -316,7 -314,9 +316,9 @@@ static struct snd_pcm_chmap_elem *conve
  /*
   * add this endpoint to the chip instance.
   * if a stream with the same endpoint already exists, append to it.
-  * if not, create a new pcm stream.
+  * if not, create a new pcm stream. note, fp is added to the substream
+  * fmt_list and will be freed on the chip instance release. do not free
+  * fp or do remove it from the substream fmt_list to avoid double-free.
   */
  int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
                             int stream,
@@@ -677,6 -677,7 +679,7 @@@ int snd_usb_parse_audio_interface(struc
                                        * (fp->maxpacksize & 0x7ff);
                fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
                fp->clock = clock;
+               INIT_LIST_HEAD(&fp->list);
  
                /* some quirks for attributes here */
  
@@@ -725,6 -726,7 +728,7 @@@
                dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
                err = snd_usb_add_audio_stream(chip, stream, fp);
                if (err < 0) {
+                       list_del(&fp->list); /* unlink for avoiding double-free */
                        kfree(fp->rate_table);
                        kfree(fp->chmap);
                        kfree(fp);