Merge android-4.4.160 (a94efb1) into msm-4.4

* refs/heads/tmp-a94efb1
  Linux 4.4.160
  dm thin metadata: fix __udivdi3 undefined on 32-bit
  ocfs2: fix locking for res->tracking and dlm->tracking_list
  proc: restrict kernel stack dumps to root
  crypto: mxs-dcp - Fix wait logic on chan threads
  ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760
  smb2: fix missing files in root share directory listing
  xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage
  xen: avoid crash in disable_hotplug_cpu
  xen/manage: don't complain about an empty value in control/sysrq node
  cifs: read overflow in is_valid_oplock_break()
  s390/qeth: don't dump past end of unknown HW header
  r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
  arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto"
  hexagon: modify ffs() and fls() to return int
  arch/hexagon: fix kernel/dma.c build warning
  dm thin metadata: try to avoid ever aborting transactions
  fs/cifs: suppress a string overflow warning
  drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
  USB: yurex: Check for truncation in yurex_read()
  RDMA/ucma: check fd type in ucma_migrate_id()
  perf probe powerpc: Ignore SyS symbols irrespective of endianness
  usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
  mm: madvise(MADV_DODUMP): allow hugetlbfs pages
  tools/vm/page-types.c: fix "defined but not used" warning
  tools/vm/slabinfo.c: fix sign-compare warning
  mac80211: shorten the IBSS debug messages
  mac80211: Fix station bandwidth setting after channel switch
  mac80211: fix a race between restart and CSA flows
  cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
  fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
  net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
  i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP
  i2c: uniphier: issue STOP only for last message or I2C_M_STOP
  RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
  cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
  mac80211: mesh: fix HWMP sequence numbering to follow standard
  gpio: adp5588: Fix sleep-in-atomic-context bug
  mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function
  media: v4l: event: Prevent freeing event subscriptions while accessed
  arm64: KVM: Sanitize PSTATE.M when being set from userspace
  arm64: cpufeature: Track 32bit EL0 support
  i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus
  hwmon: (adt7475) Make adt7475_read_word() return errors
  hwmon: (ina2xx) fix sysfs shunt resistor read access
  e1000: ensure to free old tx/rx rings in set_ringparam()
  e1000: check on netif_running() before calling e1000_up()
  net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES
  thermal: of-thermal: disable passive polling when thermal zone is disabled
  ext4: never move the system.data xattr out of the inode body
  arm64: KVM: Tighten guest core register access from userspace
  serial: imx: restore handshaking irq for imx1
  scsi: target: iscsi: Use bin2hex instead of a re-implementation
  IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop
  Input: elantech - enable middle button of touchpad on ThinkPad P72
  USB: remove LPM management from usb_driver_claim_interface()
  Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()"
  USB: usbdevfs: restore warning for nonsensical flags
  USB: usbdevfs: sanitize flags more
  media: uvcvideo: Support realtek's UVC 1.5 device
  slub: make ->cpu_partial unsigned int
  USB: handle NULL config in usb_find_alt_setting()
  USB: fix error handling in usb_driver_claim_interface()
  spi: rspi: Fix interrupted DMA transfers
  spi: rspi: Fix invalid SPI use during system suspend
  spi: sh-msiof: Fix handling of write value for SISTR register
  spi: sh-msiof: Fix invalid SPI use during system suspend
  spi: tegra20-slink: explicitly enable/disable clock
  serial: cpm_uart: return immediately from console poll
  floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
  ARM: dts: dra7: fix DCAN node addresses
  nfsd: fix corrupted reply to badly ordered compound
  module: exclude SHN_UNDEF symbols from kallsyms api
  ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs
  EDAC, i7core: Fix memleaks and use-after-free on probe and remove
  scsi: bnx2i: add error handling for ioremap_nocache
  HID: hid-ntrig: add error handling for sysfs_create_group
  ARM: mvebu: declare asm symbols as character arrays in pmsu.c
  wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()
  rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()
  ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
  ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
  media: tm6000: add error handling for dvb_register_adapter
  drivers/tty: add error handling for pcmcia_loop_config
  staging: android: ashmem: Fix mmap size validation
  media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data
  media: soc_camera: ov772x: correct setting of banding filter
  media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power
  ALSA: snd-aoa: add of_node_put() in error path
  s390/extmem: fix gcc 8 stringop-overflow warning
  alarmtimer: Prevent overflow for relative nanosleep
  powerpc/powernv/ioda2: Reduce upper limit for DMA window size
  usb: wusbcore: security: cast sizeof to int for comparison
  scsi: ibmvscsi: Improve strings handling
  scsi: klist: Make it safe to use klists in atomic context
  scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size
  x86/entry/64: Add two more instruction suffixes
  x86/tsc: Add missing header to tsc_msr.c
  media: fsl-viu: fix error handling in viu_of_probe()
  powerpc/kdump: Handle crashkernel memory reservation failure
  media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()
  md-cluster: clear another node's suspend_area after the copy is finished
  6lowpan: iphc: reset mac_header after decompress to fix panic
  USB: serial: kobil_sct: fix modem-status error handling
  Bluetooth: Add a new Realtek 8723DE ID 0bda:b009
  power: vexpress: fix corruption in notifier registration
  uwb: hwa-rc: fix memory leak at probe
  staging: rts5208: fix missing error check on call to rtsx_write_register
  x86/numa_emulation: Fix emulated-to-physical node mapping
  vmci: type promotion bug in qp_host_get_user_memory()
  tsl2550: fix lux1_input error in low light
  crypto: skcipher - Fix -Wstringop-truncation warnings
  ANDROID: sdcardfs: Change current->fs under lock
  ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro
  Revert "f2fs: use timespec64 for inode timestamps"

Conflicts:
	arch/arm64/include/asm/cpufeature.h

Change-Id: I661204f2419f634173846d03ed4078b93aa006a1
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

8 files changed, 26 insertions, 14 deletions

diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 8d54e7b41bbf..8c698d464716 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -523,7 +523,7 @@ static int macb_halt_tx(struct macb *bp)
 		if (!(status & MACB_BIT(TGO)))
 			return 0;
 
-		usleep_range(10, 250);
+		udelay(250);
 	} while (time_before(halt_time, timeout));
 
 	return -ETIMEDOUT;
diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
index cec95ac8687d..fe37fc7ec76e 100644
--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
@@ -171,10 +171,10 @@ struct hnae_desc_cb {
 
 	/* priv data for the desc, e.g. skb when use with ip stack*/
 	void *priv;
-	u16 page_offset;
-	u16 reuse_flag;
+	u32 page_offset;
+	u32 length;     /* length of the buffer */
 
-	u16 length;     /* length of the buffer */
+	u16 reuse_flag;
 
        /* desc type, used by the ring user to mark the type of the priv data */
 	u16 type;
diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
index 83e557c7f279..5ae8874bbf72 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
@@ -645,14 +645,14 @@ static int e1000_set_ringparam(struct net_device *netdev,
 		adapter->tx_ring = tx_old;
 		e1000_free_all_rx_resources(adapter);
 		e1000_free_all_tx_resources(adapter);
-		kfree(tx_old);
-		kfree(rx_old);
 		adapter->rx_ring = rxdr;
 		adapter->tx_ring = txdr;
 		err = e1000_up(adapter);
 		if (err)
 			goto err_setup;
 	}
+	kfree(tx_old);
+	kfree(rx_old);
 
 	clear_bit(__E1000_RESETTING, &adapter->flags);
 	return 0;
@@ -665,7 +665,8 @@ err_setup_rx:
 err_alloc_rx:
 	kfree(txdr);
 err_alloc_tx:
-	e1000_up(adapter);
+	if (netif_running(adapter->netdev))
+		e1000_up(adapter);
 err_setup:
 	clear_bit(__E1000_RESETTING, &adapter->flags);
 	return err;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 8b4069ea52ce..c6782ebd35e1 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -759,7 +759,7 @@ struct rtl8169_tc_offsets {
 };
 
 enum rtl_flag {
-	RTL_FLAG_TASK_ENABLED,
+	RTL_FLAG_TASK_ENABLED = 0,
 	RTL_FLAG_TASK_SLOW_PENDING,
 	RTL_FLAG_TASK_RESET_PENDING,
 	RTL_FLAG_TASK_PHY_PENDING,
@@ -7618,7 +7618,8 @@ static int rtl8169_close(struct net_device *dev)
 	rtl8169_update_counters(dev);
 
 	rtl_lock_work(tp);
-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+	/* Clear all task flags */
+	bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
 
 	rtl8169_down(dev);
 	rtl_unlock_work(tp);
@@ -7795,7 +7796,9 @@ static void rtl8169_net_suspend(struct net_device *dev)
 
 	rtl_lock_work(tp);
 	napi_disable(&tp->napi);
-	clear_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags);
+	/* Clear all task flags */
+	bitmap_zero(tp->wk.flags, RTL_FLAG_MAX);
+
 	rtl_unlock_work(tp);
 
 	rtl_pll_power_down(tp);
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 184da610f9da..f569826385ec 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -218,11 +218,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar)
 	spin_lock_bh(&htt->rx_ring.lock);
 	ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
 					      htt->rx_ring.fill_cnt));
-	spin_unlock_bh(&htt->rx_ring.lock);
 
 	if (ret)
 		ath10k_htt_rx_ring_free(htt);
 
+	spin_unlock_bh(&htt->rx_ring.lock);
+
 	return ret;
 }
 
@@ -234,7 +235,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
 	skb_queue_purge(&htt->rx_in_ord_compl_q);
 	skb_queue_purge(&htt->tx_fetch_ind_q);
 
+	spin_lock_bh(&htt->rx_ring.lock);
 	ath10k_htt_rx_ring_free(htt);
+	spin_unlock_bh(&htt->rx_ring.lock);
 
 	dma_free_coherent(htt->ar->dev,
 			  (htt->rx_ring.size *
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index e8b770a95f7a..c98cb962b454 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2453,9 +2453,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
 				IEEE80211_VHT_CAP_SHORT_GI_80 |
 				IEEE80211_VHT_CAP_SHORT_GI_160 |
 				IEEE80211_VHT_CAP_TXSTBC |
-				IEEE80211_VHT_CAP_RXSTBC_1 |
-				IEEE80211_VHT_CAP_RXSTBC_2 |
-				IEEE80211_VHT_CAP_RXSTBC_3 |
 				IEEE80211_VHT_CAP_RXSTBC_4 |
 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
 			sband->vht_cap.vht_mcs.rx_mcs_map =
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 259590013382..c76e0cfbb8b4 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2919,6 +2919,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev,
 
 	while (buflen >= sizeof(*auth_req)) {
 		auth_req = (void *)buf;
+		if (buflen < le32_to_cpu(auth_req->length))
+			return;
 		type = "unknown";
 		flags = le32_to_cpu(auth_req->flags);
 		pairwise_error = false;
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index f01d24baff7c..15dc7a398b90 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -35,6 +35,7 @@
 #include "wl12xx_80211.h"
 #include "cmd.h"
 #include "event.h"
+#include "ps.h"
 #include "tx.h"
 #include "hw_ops.h"
 
@@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
 
 	timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
 
+	ret = wl1271_ps_elp_wakeup(wl);
+	if (ret < 0)
+		return ret;
+
 	do {
 		if (time_after(jiffies, timeout_time)) {
 			wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
@@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
 	} while (!event);
 
 out:
+	wl1271_ps_elp_sleep(wl);
 	kfree(events_vector);
 	return ret;
 }