Merge android-4.4.159 (624c095) into msm-4.4

* refs/heads/tmp-624c095
  Linux 4.4.159
  iw_cxgb4: only allow 1 flush on user qps
  HID: sony: Support DS4 dongle
  HID: sony: Update device ids
  arm64: Add trace_hardirqs_off annotation in ret_to_user
  ext4: don't mark mmp buffer head dirty
  ext4: fix online resizing for bigalloc file systems with a 1k block size
  ext4: fix online resize's handling of a too-small final block group
  ext4: recalucate superblock checksum after updating free blocks/inodes
  ext4: avoid divide by zero fault when deleting corrupted inline directories
  tty: vt_ioctl: fix potential Spectre v1
  drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
  ocfs2: fix ocfs2 read block panic
  scsi: target: iscsi: Use hex2bin instead of a re-implementation
  neighbour: confirm neigh entries when ARP packet is received
  net: hp100: fix always-true check for link up state
  net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
  ipv6: fix possible use-after-free in ip6_xmit()
  gso_segment: Reset skb->mac_len after modifying network header
  mm: shmem.c: Correctly annotate new inodes for lockdep
  ring-buffer: Allow for rescheduling when removing pages
  xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code
  xen/netfront: don't bug in case of too many frags
  platform/x86: alienware-wmi: Correct a memory leak
  ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
  ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
  ASoC: cs4265: fix MMTLR Data switch control
  NFC: Fix the number of pipes
  NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
  ANDROID: restrict store of prefer_idle as boolean
  f2fs: readahead encrypted block during GC
  f2fs: avoid fi->i_gc_rwsem[WRITE] lock in f2fs_gc
  f2fs: fix performance issue observed with multi-thread sequential read
  f2fs: fix to skip verifying block address for non-regular inode
  f2fs: rework fault injection handling to avoid a warning
  f2fs: support fault_type mount option
  f2fs: fix to return success when trimming meta area
  f2fs: fix use-after-free of dicard command entry
  f2fs: support discard submission error injection
  f2fs: split discard command in prior to block layer
  f2fs: wake up gc thread immediately when gc_urgent is set
  f2fs: fix incorrect range->len in f2fs_trim_fs()
  f2fs: refresh recent accessed nat entry in lru list
  f2fs: fix avoid race between truncate and background GC
  f2fs: avoid race between zero_range and background GC
  f2fs: fix to do sanity check with block address in main area v2
  f2fs: fix to do sanity check with inline flags
  f2fs: fix to reset i_gc_failures correctly
  f2fs: fix invalid memory access
  f2fs: fix to avoid broken of dnode block list
  f2fs: use true and false for boolean values
  f2fs: fix to do sanity check with cp_pack_start_sum
  f2fs: avoid f2fs_bug_on() in cp_error case
  f2fs: fix to clear PG_checked flag in set_page_dirty()
  f2fs: fix to active page in lru list for read path
  f2fs: don't keep meta pages used for block migration
  f2fs: fix to restrict mount condition when without CONFIG_QUOTA
  f2fs: quota: do not mount as RDWR without QUOTA if quota feature enabled
  f2fs: quota: fix incorrect comments
  f2fs: add proc entry to show victim_secmap bitmap
  f2fs: let checkpoint flush dnode page of regular
  f2fs: issue discard align to section in LFS mode
  f2fs: don't allow any writes on aborted atomic writes
  f2fs: restrict setting up inode.i_advise
  f2fs: fix wrong kernel message when recover fsync data on ro fs
  f2fs: clean up ioctl interface naming
  f2fs: clean up with f2fs_is_{atomic,volatile}_file()
  f2fs: clean up with f2fs_encrypted_inode()
  f2fs: clean up with get_current_nat_page
  f2fs: kill EXT_TREE_VEC_SIZE
  f2fs: avoid duplicated permission check for "trusted." xattrs
  f2fs: fix to propagate error from __get_meta_page()
  f2fs: fix to do sanity check with i_extra_isize
  f2fs: blk_finish_plug of submit_bio in lfs mode
  f2fs: do not set free of current section
  f2fs: Keep alloc_valid_block_count in sync
  f2fs: issue small discard by LBA order
  f2fs: stop issuing discard immediately if there is queued IO
  f2fs: clean up with IS_INODE()
  f2fs: detect bug_on in f2fs_wait_discard_bios
  f2fs: fix defined but not used build warnings
  f2fs: enable real-time discard by default
  f2fs: fix to detect looped node chain correctly
  f2fs: fix to do sanity check with block address in main area
  f2fs: fix to skip GC if type in SSA and SIT is inconsistent
  f2fs: try grabbing node page lock aggressively in sync scenario
  f2fs: show the fsync_mode=nobarrier mount option
  f2fs: check the right return value of memory alloc function
  f2fs: Replace strncpy with memcpy
  f2fs: avoid the global name 'fault_name'
  f2fs: fix to do sanity check with reserved blkaddr of inline inode
  f2fs: fix to do sanity check with node footer and iblocks
  f2fs: Allocate and stat mem used by free nid bitmap more accurately
  f2fs: fix to do sanity check with user_block_count
  f2fs: fix to do sanity check with extra_attr feature
  f2fs: fix to correct return value of f2fs_trim_fs
  f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
  f2fs: fix to do sanity check with secs_per_zone
  f2fs: disable f2fs_check_rb_tree_consistence
  f2fs: introduce and spread verify_blkaddr
  f2fs: use timespec64 for inode timestamps
  f2fs: fix to wait on page writeback before updating page
  f2fs: assign REQ_RAHEAD to bio for ->readpages
  f2fs: fix a hungtask problem caused by congestion_wait
  f2fs: Fix uninitialized return in f2fs_ioc_shutdown()
  f2fs: don't issue discard commands in online discard is on
  f2fs: fix to propagate return value of scan_nat_page()
  f2fs: support in-memory inode checksum when checking consistency
  f2fs: fix error path of fill_super
  f2fs: relocate readdir_ra configure initialization
  f2fs: move s_res{u,g}id initialization to default_options()
  f2fs: don't acquire orphan ino during recovery
  f2fs: avoid potential deadlock in f2fs_sbi_store
  f2fs: indicate shutdown f2fs to allow unmount successfully
  f2fs: keep meta pages in cp_error state
  f2fs: do checkpoint in kill_sb
  f2fs: allow wrong configured dio to buffered write
  f2fs: flush journal nat entries for nat_bits during unmount

Conflicts:
	drivers/hid/hid-core.c

Change-Id: Idc486f778059ca65307ab08678f3b1e23c4ec15f
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

3 files changed, 14 insertions, 4 deletions

diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
index 2e4649655181..4e98e5aff7c5 100644
--- a/drivers/net/appletalk/ipddp.c
+++ b/drivers/net/appletalk/ipddp.c
@@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 case SIOCFINDIPDDPRT:
 			spin_lock_bh(&ipddp_route_lock);
 			rp = __ipddp_find_route(&rcp);
-			if (rp)
-				memcpy(&rcp2, rp, sizeof(rcp2));
+			if (rp) {
+				memset(&rcp2, 0, sizeof(rcp2));
+				rcp2.ip    = rp->ip;
+				rcp2.at    = rp->at;
+				rcp2.flags = rp->flags;
+			}
 			spin_unlock_bh(&ipddp_route_lock);
 
 			if (rp) {
diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
index 3daf2d4a7ca0..884aa809baac 100644
--- a/drivers/net/ethernet/hp/hp100.c
+++ b/drivers/net/ethernet/hp/hp100.c
@@ -2636,7 +2636,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
 		/* Wait for link to drop */
 		time = jiffies + (HZ / 10);
 		do {
-			if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
+			if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
 				break;
 			if (!in_interrupt())
 				schedule_timeout_interruptible(1);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 3270b4333668..0a4bd73caae5 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -892,7 +892,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
 			BUG_ON(pull_to <= skb_headlen(skb));
 			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
 		}
-		BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
+		if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
+			queue->rx.rsp_cons = ++cons;
+			kfree_skb(nskb);
+			return ~0U;
+		}
 
 		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
 				skb_frag_page(nfrag),
@@ -1029,6 +1033,8 @@ err:
 		skb->len += rx->status;
 
 		i = xennet_fill_frags(queue, skb, &tmpq);
+		if (unlikely(i == ~0U))
+			goto err;
 
 		if (rx->flags & XEN_NETRXF_csum_blank)
 			skb->ip_summed = CHECKSUM_PARTIAL;