Merge 4.4.167 into android-4.4-p

Changes in 4.4.167
	media: em28xx: Fix use-after-free when disconnecting
	Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()"
	rapidio/rionet: do not free skb before reading its length
	s390/qeth: fix length check in SNMP processing
	usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
	kvm: mmu: Fix race in emulated page table writes
	xtensa: enable coprocessors that are being flushed
	xtensa: fix coprocessor context offset definitions
	Btrfs: ensure path name is null terminated at btrfs_control_ioctl
	ALSA: wss: Fix invalid snd_free_pages() at error path
	ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
	ALSA: control: Fix race between adding and removing a user element
	ALSA: sparc: Fix invalid snd_free_pages() at error path
	ext2: fix potential use after free
	dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
	dmaengine: at_hdmac: fix module unloading
	btrfs: release metadata before running delayed refs
	USB: usb-storage: Add new IDs to ums-realtek
	usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
	misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
	Kbuild: suppress packed-not-aligned warning for default setting only
	exec: avoid gcc-8 warning for get_task_comm
	disable stringop truncation warnings for now
	kobject: Replace strncpy with memcpy
	unifdef: use memcpy instead of strncpy
	kernfs: Replace strncpy with memcpy
	ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
	drm: gma500: fix logic error
	scsi: bfa: convert to strlcpy/strlcat
	staging: rts5208: fix gcc-8 logic error warning
	kdb: use memmove instead of overlapping memcpy
	iser: set sector for ambiguous mr status errors
	uprobes: Fix handle_swbp() vs. unregister() + register() race once more
	MIPS: ralink: Fix mt7620 nd_sd pinmux
	mips: fix mips_get_syscall_arg o32 check
	drm/ast: Fix incorrect free on ioregs
	scsi: scsi_devinfo: cleanly zero-pad devinfo strings
	ALSA: trident: Suppress gcc string warning
	scsi: csiostor: Avoid content leaks and casts
	kgdboc: Fix restrict error
	kgdboc: Fix warning with module build
	leds: call led_pwm_set() in leds-pwm to enforce default LED_OFF
	leds: turn off the LED and wait for completion on unregistering LED class device
	leds: leds-gpio: Fix return value check in create_gpio_led()
	Input: xpad - quirk all PDP Xbox One gamepads
	Input: matrix_keypad - check for errors from of_get_named_gpio()
	Input: elan_i2c - add ELAN0620 to the ACPI table
	Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
	Input: elan_i2c - add support for ELAN0621 touchpad
	btrfs: Always try all copies when reading extent buffers
	Btrfs: fix use-after-free when dumping free space
	ARC: change defconfig defaults to ARCv2
	arc: [devboards] Add support of NFSv3 ACL
	mm: cleancache: fix corruption on missed inode invalidation
	mm: mlock: avoid increase mm->locked_vm on mlock() when already mlock2(,MLOCK_ONFAULT)
	usb: gadget: dummy: fix nonsensical comparisons
	iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()
	iommu/ipmmu-vmsa: Fix crash on early domain free
	can: rcar_can: Fix erroneous registration
	batman-adv: Expand merged fragment buffer for full packet
	bnx2x: Assign unique DMAE channel number for FW DMAE transactions.
	qed: Fix PTT leak in qed_drain()
	qed: Fix reading wrong value in loop condition
	net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
	net/mlx4_core: Fix uninitialized variable compilation warning
	net/mlx4: Fix UBSAN warning of signed integer overflow
	net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts
	iommu/vt-d: Use memunmap to free memremap
	net: amd: add missing of_node_put()
	usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
	usb: appledisplay: Add 27" Apple Cinema Display
	USB: check usb_get_extra_descriptor for proper size
	ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
	ALSA: hda: Add support for AMD Stoney Ridge
	ALSA: pcm: Fix starvation on down_write_nonblock()
	ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
	ALSA: pcm: Fix interval evaluation with openmin/max
	virtio/s390: avoid race on vcdev->config
	virtio/s390: fix race in ccw_io_helper()
	SUNRPC: Fix leak of krb5p encode pages
	xhci: Prevent U1/U2 link pm states if exit latency is too long
	Staging: lustre: remove two build warnings
	cifs: Fix separator when building path from dentry
	tty: serial: 8250_mtk: always resume the device in probe.
	kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()
	mac80211_hwsim: Timer should be initialized before device registered
	mac80211: Clear beacon_int in ieee80211_do_stop
	mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext
	mac80211: fix reordering of buffered broadcast packets
	mac80211: ignore NullFunc frames in the duplicate detection
	Linux 4.4.167

Change-Id: I67673edf3244cb17523bfb13f256d5b3ddd1bcba
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

2 files changed, 12 insertions, 9 deletions

diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c
index b123ace3b67c..cbefed1800c1 100644
--- a/arch/xtensa/kernel/asm-offsets.c
+++ b/arch/xtensa/kernel/asm-offsets.c
@@ -90,14 +90,14 @@ int main(void)
 	DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp));
 	DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable));
 #if XTENSA_HAVE_COPROCESSORS
-	DEFINE(THREAD_XTREGS_CP0, offsetof (struct thread_info, xtregs_cp));
-	DEFINE(THREAD_XTREGS_CP1, offsetof (struct thread_info, xtregs_cp));
-	DEFINE(THREAD_XTREGS_CP2, offsetof (struct thread_info, xtregs_cp));
-	DEFINE(THREAD_XTREGS_CP3, offsetof (struct thread_info, xtregs_cp));
-	DEFINE(THREAD_XTREGS_CP4, offsetof (struct thread_info, xtregs_cp));
-	DEFINE(THREAD_XTREGS_CP5, offsetof (struct thread_info, xtregs_cp));
-	DEFINE(THREAD_XTREGS_CP6, offsetof (struct thread_info, xtregs_cp));
-	DEFINE(THREAD_XTREGS_CP7, offsetof (struct thread_info, xtregs_cp));
+	DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0));
+	DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1));
+	DEFINE(THREAD_XTREGS_CP2, offsetof(struct thread_info, xtregs_cp.cp2));
+	DEFINE(THREAD_XTREGS_CP3, offsetof(struct thread_info, xtregs_cp.cp3));
+	DEFINE(THREAD_XTREGS_CP4, offsetof(struct thread_info, xtregs_cp.cp4));
+	DEFINE(THREAD_XTREGS_CP5, offsetof(struct thread_info, xtregs_cp.cp5));
+	DEFINE(THREAD_XTREGS_CP6, offsetof(struct thread_info, xtregs_cp.cp6));
+	DEFINE(THREAD_XTREGS_CP7, offsetof(struct thread_info, xtregs_cp.cp7));
 #endif
 	DEFINE(THREAD_XTREGS_USER, offsetof (struct thread_info, xtregs_user));
 	DEFINE(XTREGS_USER_SIZE, sizeof(xtregs_user_t));
diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c
index 17a378c15a15..26516094dbd4 100644
--- a/arch/xtensa/kernel/process.c
+++ b/arch/xtensa/kernel/process.c
@@ -83,18 +83,21 @@ void coprocessor_release_all(struct thread_info *ti)
 
 void coprocessor_flush_all(struct thread_info *ti)
 {
-	unsigned long cpenable;
+	unsigned long cpenable, old_cpenable;
 	int i;
 
 	preempt_disable();
 
+	RSR_CPENABLE(old_cpenable);
 	cpenable = ti->cpenable;
+	WSR_CPENABLE(cpenable);
 
 	for (i = 0; i < XCHAL_CP_MAX; i++) {
 		if ((cpenable & 1) != 0 && coprocessor_owner[i] == ti)
 			coprocessor_flush(ti, i);
 		cpenable >>= 1;
 	}
+	WSR_CPENABLE(old_cpenable);
 
 	preempt_enable();
 }