Merge remote-tracking branch 'common/android-4.4-p' into lineage-18.1-caf-msm8998

# By Thomas Gleixner (11) and others
# Via Greg Kroah-Hartman
* google/common/android-4.4-p:
  Linux 4.4.283
  Revert "floppy: reintroduce O_NDELAY fix"
  fbmem: add margin check to fb_check_caps()
  vt_kdsetmode: extend console locking
  vringh: Use wiov->used to check for read/write desc order
  virtio: Improve vq->broken access to avoid any compiler optimization
  net: marvell: fix MVNETA_TX_IN_PRGRS bit number
  e1000e: Fix the max snoop/no-snoop latency for 10M
  USB: serial: option: add new VID/PID to support Fibocom FG150
  Revert "USB: serial: ch341: fix character loss at high transfer rates"
  can: usb: esd_usb2: esd_usb2_rx_event(): fix the interchange of the CAN RX and TX error counters
  Linux 4.4.282
  mmc: dw_mmc: Fix occasional hang after tuning on eMMC
  ASoC: intel: atom: Fix breakage for PCM buffer address setup
  ipack: tpci200: fix many double free issues in tpci200_pci_probe
  ALSA: hda - fix the 'Capture Switch' value change notifications
  mmc: dw_mmc: Fix hang on data CRC error
  mmc: dw_mmc: call the dw_mci_prep_stop_abort() by default
  mmc: dw_mmc: Wait for data transfer after response errors.
  net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32
  net: 6pack: fix slab-out-of-bounds in decode_data
  dccp: add do-while-0 stubs for dccp_pr_debug macros
  Bluetooth: hidp: use correct wait queue when removing ctrl_wait
  scsi: core: Avoid printing an error if target_alloc() returns -ENXIO
  scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry()
  dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available
  ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218
  dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe()
  KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653)
  vmlinux.lds.h: Handle clang's module.{c,d}tor sections
  PCI/MSI: Enforce MSI[X] entry updates to be visible
  PCI/MSI: Enforce that MSI-X table entry is masked for update
  PCI/MSI: Mask all unused MSI-X entries
  PCI/MSI: Protect msi_desc::masked for multi-MSI
  PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown()
  PCI/MSI: Correct misleading comments
  PCI/MSI: Do not set invalid bits in MSI mask
  PCI/MSI: Enable and mask MSI-X early
  x86/tools: Fix objdump version check again
  xen/events: Fix race in set_evtchn_to_irq
  net: Fix memory leak in ieee802154_raw_deliver
  i2c: dev: zero out array used for i2c reads from userspace
  ASoC: intel: atom: Fix reference to PCM buffer address
  ANDROID: xt_quota2: set usersize in xt_match registration object
  ANDROID: xt_quota2: clear quota2_log message before sending
  ANDROID: xt_quota2: remove trailing junk which might have a digit in it
  UPSTREAM: netfilter: x_tables: fix pointer leaks to userspace
  Linux 4.4.281
  ovl: prevent private clone if bind mount is not allowed
  net: xilinx_emaclite: Do not print real IOMEM pointer
  USB:ehci:fix Kunpeng920 ehci hardware problem
  pipe: increase minimum default pipe size to 2 pages
  net/qla3xxx: fix schedule while atomic in ql_wait_for_drvr_lock and ql_adapter_reset
  alpha: Send stop IPI to send to online CPUs
  reiserfs: check directory items on read from disk
  reiserfs: add check for root_inode in reiserfs_fill_super
  pcmcia: i82092: fix a null pointer dereference bug
  MIPS: Malta: Do not byte-swap accesses to the CBUS UART
  serial: 8250: Mask out floating 16/32-bit bus bits
  media: rtl28xxu: fix zero-length control request
  scripts/tracing: fix the bug that can't parse raw_trace_func
  USB: serial: ftdi_sio: add device ID for Auto-M3 OP-COM v2
  USB: serial: ch341: fix character loss at high transfer rates
  USB: serial: option: add Telit FD980 composition 0x1056
  Bluetooth: defer cleanup of resources in hci_unregister_dev()
  net: vxge: fix use-after-free in vxge_device_unregister
  net: pegasus: fix uninit-value in get_interrupt_interval
  bnx2x: fix an error code in bnx2x_nic_load()
  mips: Fix non-POSIX regexp
  net: natsemi: Fix missing pci_disable_device() in probe and remove
  media: videobuf2-core: dequeue if start_streaming fails
  scsi: sr: Return correct event when media event code is 3
  ALSA: seq: Fix racy deletion of subscriber
  Linux 4.4.280
  rcu: Update documentation of rcu_read_unlock()
  futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock()
  futex: Avoid freeing an active timer
  futex: Handle transient "ownerless" rtmutex state correctly
  rtmutex: Make wait_lock irq safe
  futex: Futex_unlock_pi() determinism
  futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()
  futex: Pull rt_mutex_futex_unlock() out from under hb->lock
  futex,rt_mutex: Introduce rt_mutex_init_waiter()
  futex: Cleanup refcounting
  futex: Rename free_pi_state() to put_pi_state()
  Linux 4.4.279
  can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled"
  net: Fix zero-copy head len calculation.
  r8152: Fix potential PM refcount imbalance
  regulator: rt5033: Fix n_voltages settings for BUCK and LDO
  btrfs: mark compressed range uptodate only if all bio succeed

 Conflicts:
	net/bluetooth/hci_core.c
	net/netfilter/xt_quota2.c

Change-Id: I66e2384c8cc40448a7bff34bb935c74e6103e924

2 files changed, 16 insertions, 7 deletions

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index fef1b9335f60..041bfe1d4191 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -274,7 +274,11 @@ configured less than Maximum supported fifo bytes */
 /* Uart divisor latch read */
 static int default_serial_dl_read(struct uart_8250_port *up)
 {
-	return serial_in(up, UART_DLL) | serial_in(up, UART_DLM) << 8;
+	/* Assign these in pieces to truncate any bits above 7.  */
+	unsigned char dll = serial_in(up, UART_DLL);
+	unsigned char dlm = serial_in(up, UART_DLM);
+
+	return dll | dlm << 8;
 }
 
 /* Uart divisor latch write */
@@ -1160,9 +1164,11 @@ static void autoconfig(struct uart_8250_port *up)
 	serial_out(up, UART_LCR, 0);
 
 	serial_out(up, UART_FCR, UART_FCR_ENABLE_FIFO);
-	scratch = serial_in(up, UART_IIR) >> 6;
 
-	switch (scratch) {
+	/* Assign this as it is to truncate any bits above 7.  */
+	scratch = serial_in(up, UART_IIR);
+
+	switch (scratch >> 6) {
 	case 0:
 		autoconfig_8250(up);
 		break;
diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
index e1a8f4121206..97475bb46f84 100644
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -487,16 +487,19 @@ int vt_ioctl(struct tty_struct *tty,
 			ret = -EINVAL;
 			goto out;
 		}
-		/* FIXME: this needs the console lock extending */
-		if (vc->vc_mode == (unsigned char) arg)
+		console_lock();
+		if (vc->vc_mode == (unsigned char) arg) {
+			console_unlock();
 			break;
+		}
 		vc->vc_mode = (unsigned char) arg;
-		if (console != fg_console)
+		if (console != fg_console) {
+			console_unlock();
 			break;
+		}
 		/*
 		 * explicitly blank/unblank the screen if switching modes
 		 */
-		console_lock();
 		if (arg == KD_TEXT)
 			do_unblank_screen(1);
 		else