Merge android-4.4.170 (241f76b1) into msm-4.4

* refs/heads/tmp-241f76b1
  Linux 4.4.170
  power: supply: olpc_battery: correct the temperature units
  intel_th: msu: Fix an off-by-one in attribute store
  genwqe: Fix size check
  ceph: don't update importing cap's mseq when handing cap export
  iommu/vt-d: Handle domain agaw being less than iommu agaw
  9p/net: put a lower bound on msize
  b43: Fix error in cordic routine
  gfs2: Fix loop in gfs2_rbm_find
  dlm: memory leaks on error path in dlm_user_request()
  dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
  dlm: possible memory leak on error path in create_lkb()
  dlm: fixed memory leaks after failed ls_remove_names allocation
  ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
  ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
  ALSA: cs46xx: Potential NULL dereference in probe
  crypto: x86/chacha20 - avoid sleeping with preemption disabled
  sunrpc: use SVC_NET() in svcauth_gss_* functions
  sunrpc: fix cache_head leak due to queued request
  mm, devm_memremap_pages: kill mapping "System RAM" support
  mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
  hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
  fork: record start_time late
  scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
  Input: omap-keypad - fix idle configuration to not block SoC idle states
  scsi: bnx2fc: Fix NULL dereference in error handling
  xfrm: Fix bucket count reported to userspace
  checkstack.pl: fix for aarch64
  Input: restore EV_ABS ABS_RESERVED
  ARM: imx: update the cpu power up timing setting on i.mx6sx
  powerpc: Fix COFF zImage booting on old powermacs
  spi: bcm2835: Unbreak the build of esoteric configs
  x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
  CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
  MIPS: Align kernel load address to 64KB
  MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
  media: vivid: free bitmap_cap when updating std/timings/etc.
  cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
  spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
  spi: bcm2835: Fix book-keeping of DMA termination
  spi: bcm2835: Fix race on DMA termination
  ext4: force inode writes when nfsd calls commit_metadata()
  ext4: fix EXT4_IOC_GROUP_ADD ioctl
  ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
  ext4: fix possible use after free in ext4_quota_enable
  perf pmu: Suppress potential format-truncation warning
  KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
  Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
  usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
  USB: serial: option: add Fibocom NL678 series
  USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
  ALSA: hda/tegra: clear pending irq handlers
  ALSA: hda: add mute LED support for HP EliteBook 840 G4
  ALSA: emux: Fix potential Spectre v1 vulnerabilities
  ALSA: pcm: Fix potential Spectre v1 vulnerability
  ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
  ALSA: rme9652: Fix potential Spectre v1 vulnerability
  sock: Make sock->sk_stamp thread-safe
  gro_cell: add napi_disable in gro_cells_destroy
  xen/netfront: tolerate frags with no data
  VSOCK: Send reset control packet when socket is partially bound
  vhost: make sure used idx is seen before log in vhost_add_used_n()
  sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
  packet: validate address length if non-zero
  packet: validate address length
  netrom: fix locking in nr_find_socket()
  isdn: fix kernel-infoleak in capi_unlocked_ioctl
  ipv6: explicitly initialize udp6_addr in udp_sock_create6()
  ieee802154: lowpan_header_create check must check daddr
  ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
  ax25: fix a use-after-free in ax25_fillin_cb()
  ipv4: Fix potential Spectre v1 vulnerability
  ip6mr: Fix potential Spectre v1 vulnerability
  drm/ioctl: Fix Spectre v1 vulnerabilities
  x86/mtrr: Don't copy uninitialized gentry fields back to userspace
  Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
  gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
  mmc: omap_hsmmc: fix DMA API warning
  mmc: core: Reset HPI enabled state during re-init and in case of errors
  USB: serial: option: add Telit LN940 series
  USB: serial: option: add Fibocom NL668 series
  USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
  USB: serial: option: add HP lt4132
  USB: serial: option: add GosunCn ZTE WeLink ME3630
  xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only
  USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
  f2fs: don't access node/meta inode mapping after iput
  f2fs: wait on atomic writes to count F2FS_CP_WB_DATA
  f2fs: sanity check of xattr entry size
  f2fs: fix use-after-free issue when accessing sbi->stat_info
  f2fs: check PageWriteback flag for ordered case
  f2fs: fix validation of the block count in sanity_check_raw_super
  f2fs: fix missing unlock(sbi->gc_mutex)
  f2fs: clean up structure extent_node
  f2fs: fix block address for __check_sit_bitmap
  f2fs: fix sbi->extent_list corruption issue
  f2fs: clean up checkpoint flow
  f2fs: flush stale issued discard candidates
  f2fs: correct wrong spelling, issing_*
  f2fs: use kvmalloc, if kmalloc is failed
  f2fs: remove redundant comment of unused wio_mutex
  f2fs: fix to reorder set_page_dirty and wait_on_page_writeback
  f2fs: clear PG_writeback if IPU failed
  f2fs: add an ioctl() to explicitly trigger fsck later
  f2fs: avoid frequent costly fsck triggers
  f2fs: fix m_may_create to make OPU DIO write correctly
  f2fs: fix to update new block address correctly for OPU
  f2fs: adjust trace print in f2fs_get_victim() to cover all paths
  f2fs: fix to allow node segment for GC by ioctl path
  f2fs: make "f2fs_fault_name[]" const char *
  f2fs: read page index before freeing
  f2fs: fix wrong return value of f2fs_acl_create
  f2fs: avoid build warn of fall_through
  f2fs: fix race between write_checkpoint and write_begin
  f2fs: check memory boundary by insane namelen
  f2fs: only flush the single temp bio cache which owns the target page
  f2fs: fix out-place-update DIO write
  f2fs: fix to be aware discard/preflush/dio command in is_idle()
  f2fs: add to account direct IO
  f2fs: move dir data flush to write checkpoint process
  f2fs: change segment to section in f2fs_ioc_gc_range
  f2fs: export migration_granularity sysfs entry
  f2fs: support subsectional garbage collection
  f2fs: introduce __is_large_section() for cleanup
  f2fs: clean up f2fs_sb_has_##feature_name
  f2fs: remove codes of unused wio_mutex
  f2fs: fix count of seg_freed to make sec_freed correct
  f2fs: fix to account preflush command for noflush_merge mode
  f2fs: avoid GC causing encrypted file corrupted
  ANDROID: cuttlefish_defconfig: Enable VIRTIO_INPUT

Conflicts:
	mm/memory_hotplug.c

Change-Id: I8dc4545b59eff285a0fdb22cd06e8d5dffbe1330
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

4 files changed, 23 insertions, 5 deletions

diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 2f9b12cf9ee5..61a9ab4fe047 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -1163,11 +1163,15 @@ out:
 
 map_failed_frags:
 	last = i+1;
-	for (i = 0; i < last; i++)
+	for (i = 1; i < last; i++)
 		dma_unmap_page(&adapter->vdev->dev, descs[i].fields.address,
 			       descs[i].fields.flags_len & IBMVETH_BUF_LEN_MASK,
 			       DMA_TO_DEVICE);
 
+	dma_unmap_single(&adapter->vdev->dev,
+			 descs[0].fields.address,
+			 descs[0].fields.flags_len & IBMVETH_BUF_LEN_MASK,
+			 DMA_TO_DEVICE);
 map_failed:
 	if (!firmware_has_feature(FW_FEATURE_CMO))
 		netdev_err(netdev, "tx: unable to map xmit buffer\n");
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 111d907e0c11..79cede19e0c4 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2825,6 +2825,12 @@ static int hso_get_config_data(struct usb_interface *interface)
 		return -EIO;
 	}
 
+	/* check if we have a valid interface */
+	if (if_num > 16) {
+		kfree(config_data);
+		return -EINVAL;
+	}
+
 	switch (config_data[if_num]) {
 	case 0x0:
 		result = 0;
@@ -2895,10 +2901,18 @@ static int hso_probe(struct usb_interface *interface,
 
 	/* Get the interface/port specification from either driver_info or from
 	 * the device itself */
-	if (id->driver_info)
+	if (id->driver_info) {
+		/* if_num is controlled by the device, driver_info is a 0 terminated
+		 * array. Make sure, the access is in bounds! */
+		for (i = 0; i <= if_num; ++i)
+			if (((u32 *)(id->driver_info))[i] == 0)
+				goto exit;
 		port_spec = ((u32 *)(id->driver_info))[if_num];
-	else
+	} else {
 		port_spec = hso_get_config_data(interface);
+		if (port_spec < 0)
+			goto exit;
+	}
 
 	/* Check if we need to switch to alt interfaces prior to port
 	 * configuration */
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index ec2b9c577b90..3644c9edaf81 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -616,7 +616,7 @@ struct b43_c32 b43_cordic(int theta)
 	u8 i;
 	s32 tmp;
 	s8 signx = 1;
-	u32 angle = 0;
+	s32 angle = 0;
 	struct b43_c32 ret = { .i = 39797, .q = 0, };
 
 	while (theta > (180 << 16))
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 0a4bd73caae5..6f55ab4f7959 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -889,7 +889,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
 		if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) {
 			unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to;
 
-			BUG_ON(pull_to <= skb_headlen(skb));
+			BUG_ON(pull_to < skb_headlen(skb));
 			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
 		}
 		if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {