commit 
ca9380fd68514c7bc952282c1b4fc70607e9fe43 upstream.
Convert array index from the loop bound to the loop index.
A simplified version of the semantic patch that fixes this problem is as
follows: (http://coccinelle.lip6.fr/)
// <smpl>
@@
expression e1,e2,ar;
@@
for(e1 = 0; e1 < e2; e1++) { <...
  ar[
- e2
+ e1
  ]
  ...> }
// </smpl>
Signed-off-by: Julia Lawall <julia@diku.dk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
 
                        kfree(bufs);
                        return -EFAULT;
                }
-               bufs[ch] = compat_ptr(ptr);
+               bufs[i] = compat_ptr(ptr);
                bufptr++;
        }
        if (dir == SNDRV_PCM_STREAM_PLAYBACK)