Merge remote-tracking branch 'common/android-4.4-p' into lineage-18.1-caf-msm8998

# By Sergey Shtylyov (9) and others
# Via Greg Kroah-Hartman
* common/android-4.4-p:
  Linux 4.4.288
  libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD.
  usb: testusb: Fix for showing the connection speed
  scsi: sd: Free scsi_disk device via put_device()
  ext2: fix sleeping in atomic bugs on error
  sparc64: fix pci_iounmap() when CONFIG_PCI is not set
  xen-netback: correct success/error reporting for the SKB-with-fraglist case
  af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
  Linux 4.4.287
  Revert "arm64: Mark __stack_chk_guard as __ro_after_init"
  Linux 4.4.286
  cred: allow get_cred() and put_cred() to be given NULL.
  HID: usbhid: free raw_report buffers in usbhid_stop
  netfilter: ipset: Fix oversized kvmalloc() calls
  HID: betop: fix slab-out-of-bounds Write in betop_probe
  arm64: Extend workaround for erratum 1024718 to all versions of Cortex-A55
  EDAC/synopsys: Fix wrong value type assignment for edac_mode
  ext4: fix potential infinite loop in ext4_dx_readdir()
  ipack: ipoctal: fix module reference leak
  ipack: ipoctal: fix missing allocation-failure check
  ipack: ipoctal: fix tty-registration error handling
  ipack: ipoctal: fix tty registration race
  ipack: ipoctal: fix stack information leak
  e100: fix buffer overrun in e100_get_regs
  e100: fix length calculation in e100_get_regs_len
  ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
  mac80211: fix use-after-free in CCMP/GCMP RX
  tty: Fix out-of-bound vmalloc access in imageblit
  qnx4: work around gcc false positive warning bug
  spi: Fix tegra20 build with CONFIG_PM=n
  net: 6pack: Fix tx timeout and slot time
  alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile
  arm64: Mark __stack_chk_guard as __ro_after_init
  parisc: Use absolute_pointer() to define PAGE0
  qnx4: avoid stringop-overread errors
  sparc: avoid stringop-overread errors
  net: i825xx: Use absolute_pointer for memcpy from fixed memory location
  compiler.h: Introduce absolute_pointer macro
  m68k: Double cast io functions to unsigned long
  blktrace: Fix uaf in blk_trace access after removing by sysfs
  scsi: iscsi: Adjust iface sysfs attr detection
  net/mlx4_en: Don't allow aRFS for encapsulated packets
  net: hso: fix muxed tty registration
  USB: serial: option: add device id for Foxconn T99W265
  USB: serial: option: remove duplicate USB device ID
  USB: serial: option: add Telit LN920 compositions
  USB: serial: mos7840: remove duplicated 0xac24 device ID
  USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter
  xen/x86: fix PV trap handling on secondary processors
  cifs: fix incorrect check for null pointer in header_assemble
  usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned()
  usb: gadget: r8a66597: fix a loop in set_feature()
  Linux 4.4.285
  sctp: validate from_addr_param return
  drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
  blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
  nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
  nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
  nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
  nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
  nilfs2: fix NULL pointer in nilfs_##name##_attr_release
  nilfs2: fix memory leak in nilfs_sysfs_create_device_group
  ceph: lockdep annotations for try_nonblocking_invalidate
  dmaengine: ioat: depends on !UML
  parisc: Move pci_dev_is_behind_card_dino to where it is used
  dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  dmaengine: acpi-dma: check for 64-bit MMIO address
  profiling: fix shift-out-of-bounds bugs
  prctl: allow to setup brk for et_dyn executables
  9p/trans_virtio: Remove sysfs file on probe failure
  thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
  sctp: validate chunk size in __rcv_asconf_lookup
  PM / wakeirq: Fix unbalanced IRQ enable for wakeirq
  s390/bpf: Fix optimizing out zero-extensions
  Linux 4.4.284
  s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant
  net: renesas: sh_eth: Fix freeing wrong tx descriptor
  qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
  ARC: export clear_user_page() for modules
  mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
  PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
  ethtool: Fix an error code in cxgb2.c
  dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
  x86/mm: Fix kern_addr_valid() to cope with existing but not present entries
  net/af_unix: fix a data-race in unix_dgram_poll
  tipc: increase timeout in tipc_sk_enqueue()
  r6040: Restore MDIO clock frequency after MAC reset
  net/l2tp: Fix reference count leak in l2tp_udp_recv_core
  dccp: don't duplicate ccid when cloning dccp sock
  ptp: dp83640: don't define PAGE0
  net-caif: avoid user-triggerable WARN_ON(1)
  bnx2x: Fix enabling network interfaces without VFs
  platform/chrome: cros_ec_proto: Send command again when timeout occurs
  parisc: fix crash with signals and alloca
  net: fix NULL pointer reference in cipso_v4_doi_free
  ath9k: fix OOB read ar9300_eeprom_restore_internal
  parport: remove non-zero check on count
  Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
  cifs: fix wrong release in sess_alloc_buffer() failed path
  mmc: rtsx_pci: Fix long reads when clock is prescaled
  gfs2: Don't call dlm after protocol is unmounted
  rpc: fix gss_svc_init cleanup on failure
  ARM: tegra: tamonten: Fix UART pad setting
  gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
  Bluetooth: skip invalid hci_sync_conn_complete_evt
  serial: 8250_pci: make setup_port() parameters explicitly unsigned
  hvsi: don't panic on tty_register_driver failure
  xtensa: ISS: don't panic in rs_init
  serial: 8250: Define RX trigger levels for OxSemi 950 devices
  s390/jump_label: print real address in a case of a jump label bug
  ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
  video: fbdev: riva: Error out if 'pixclock' equals zero
  video: fbdev: kyro: Error out if 'pixclock' equals zero
  video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
  bpf/tests: Do not PASS tests without actually testing the result
  bpf/tests: Fix copy-and-paste error in double word test
  tty: serial: jsm: hold port lock when reporting modem line changes
  usb: gadget: u_ether: fix a potential null pointer dereference
  usb: host: fotg210: fix the actual_length of an iso packet
  Smack: Fix wrong semantics in smk_access_entry()
  netlink: Deal with ESRCH error in nlmsg_notify()
  video: fbdev: kyro: fix a DoS bug by restricting user input
  iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
  PCI: Use pci_update_current_state() in pci_enable_device_flags()
  crypto: mxs-dcp - Use sg_mapping_iter to copy data
  pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
  openrisc: don't printk() unconditionally
  PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
  ARM: 9105/1: atags_to_fdt: don't warn about stack size
  libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
  media: rc-loopback: return number of emitters rather than error
  media: uvc: don't do DMA on stack
  VMCI: fix NULL pointer dereference when unmapping queue pair
  power: supply: max17042: handle fails of reading status register
  xen: fix setting of max_pfn in shared_info
  PCI/MSI: Skip masking MSI-X on Xen PV
  rtc: tps65910: Correct driver module alias
  fbmem: don't allow too huge resolutions
  clk: kirkwood: Fix a clocking boot regression
  KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
  tty: Fix data race between tiocsti() and flush_to_ldisc()
  ipv4: make exception cache less predictible
  bcma: Fix memory leak for internally-handled cores
  ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
  usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
  i2c: mt65xx: fix IRQ check
  CIFS: Fix a potencially linear read overflow
  mmc: moxart: Fix issue with uninitialized dma_slave_config
  mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
  i2c: s3c2410: fix IRQ check
  i2c: iop3xx: fix deferred probing
  Bluetooth: add timeout sanity check to hci_inquiry
  usb: gadget: mv_u3d: request_irq() after initializing UDC
  usb: phy: tahvo: add IRQ check
  usb: host: ohci-tmio: add IRQ check
  Bluetooth: Move shutdown callback before flushing tx and rx queue
  usb: phy: twl6030: add IRQ checks
  usb: phy: fsl-usb: add IRQ check
  usb: gadget: udc: at91: add IRQ check
  drm/msm/dsi: Fix some reference counted resource leaks
  Bluetooth: fix repeated calls to sco_sock_kill
  arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
  Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
  PCI: PM: Enable PME if it can be signaled from D3cold
  i2c: highlander: add IRQ check
  net: cipso: fix warnings in netlbl_cipsov4_add_std
  tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
  Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
  media: go7007: remove redundant initialization
  media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
  media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
  certs: Trigger creation of RSA module signing key if it's not an RSA key
  m68k: emu: Fix invalid free in nfeth_cleanup()
  udf_get_extendedattr() had no boundary checks.
  crypto: qat - fix reuse of completion variable
  crypto: qat - do not ignore errors from enable_vf2pf_comms()
  libata: fix ata_host_start()
  power: supply: max17042_battery: fix typo in MAx17042_TOFF
  crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
  crypto: mxs-dcp - Check for DMA mapping errors
  PCI: Call Max Payload Size-related fixup quirks early
  x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
  Revert "btrfs: compression: don't try to compress if we don't have enough pages"
  mm/page_alloc: speed up the iteration of max_order
  net: ll_temac: Remove left-over debug message
  powerpc/boot: Delete unneeded .globl _zimage_start
  powerpc/module64: Fix comment in R_PPC64_ENTRY handling
  mm/kmemleak.c: make cond_resched() rate-limiting more efficient
  s390/disassembler: correct disassembly lines alignment
  ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
  tc358743: fix register i2c_rd/wr function fix
  PM / wakeirq: Enable dedicated wakeirq for suspend
  USB: serial: mos7720: improve OOM-handling in read_mos_reg()
  usb: phy: isp1301: Fix build warning when CONFIG_OF is disabled
  igmp: Add ip_mc_list lock in ip_check_mc_rcu
  media: stkwebcam: fix memory leak in stk_camera_probe
  ath9k: Postpone key cache entry deletion for TXQ frames reference it
  ath: Modify ath_key_delete() to not need full key entry
  ath: Export ath_hw_keysetmac()
  ath9k: Clear key cache explicitly on disabling hardware
  ath: Use safer key clearing with key cache entries
  ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
  ARM: 8918/2: only build return_address() if needed
  cryptoloop: add a deprecation warning
  qede: Fix memset corruption
  ARC: fix allnoconfig build warning
  xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
  ext4: fix race writing to an inline_data file while its xattrs are changing

Change-Id: I0d3200388e095f977c784cba314b9cc061848c7a

9 files changed, 21 insertions, 10 deletions

diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 7cabe0cc8665..bc8077e5e688 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -208,6 +208,8 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
     (typeof(ptr)) (__ptr + (off)); })
 #endif
 
+#define absolute_pointer(val)	RELOC_HIDE((void *)(val), 0)
+
 #ifndef OPTIMIZER_HIDE_VAR
 #define OPTIMIZER_HIDE_VAR(var) barrier()
 #endif
diff --git a/include/linux/cred.h b/include/linux/cred.h
index d2db1da3036c..ee2b36cdb80d 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -243,7 +243,7 @@ static inline struct cred *get_new_cred(struct cred *cred)
  * @cred: The credentials to reference
  *
  * Get a reference on the specified set of credentials.  The caller must
- * release the reference.
+ * release the reference.  If %NULL is passed, it is returned with no action.
  *
  * This is used to deal with a committed set of credentials.  Although the
  * pointer is const, this will temporarily discard the const and increment the
@@ -254,6 +254,8 @@ static inline struct cred *get_new_cred(struct cred *cred)
 static inline const struct cred *get_cred(const struct cred *cred)
 {
 	struct cred *nonconst_cred = (struct cred *) cred;
+	if (!cred)
+		return cred;
 	validate_creds(cred);
 	nonconst_cred->non_rcu = 0;
 	return get_new_cred(nonconst_cred);
@@ -264,7 +266,7 @@ static inline const struct cred *get_cred(const struct cred *cred)
  * @cred: The credentials to release
  *
  * Release a reference to a set of credentials, deleting them when the last ref
- * is released.
+ * is released.  If %NULL is passed, nothing is done.
  *
  * This takes a const pointer to a set of credentials because the credentials
  * on task_struct are attached by const pointers to prevent accidental
@@ -274,9 +276,11 @@ static inline void put_cred(const struct cred *_cred)
 {
 	struct cred *cred = (struct cred *) _cred;
 
-	validate_creds(cred);
-	if (atomic_dec_and_test(&(cred)->usage))
-		__put_cred(cred);
+	if (cred) {
+		validate_creds(cred);
+		if (atomic_dec_and_test(&(cred)->usage))
+			__put_cred(cred);
+	}
 }
 
 /**
diff --git a/include/linux/libata.h b/include/linux/libata.h
index ec49344f7555..ae4a5a1ae381 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -437,6 +437,7 @@ enum {
 	ATA_HORKAGE_NO_NCQ_LOG	= (1 << 23),	/* don't use NCQ for log read */
 	ATA_HORKAGE_NOTRIM	= (1 << 24),	/* don't use TRIM */
 	ATA_HORKAGE_MAX_SEC_1024 = (1 << 25),	/* Limit max sects to 1024 */
+	ATA_HORKAGE_NO_NCQ_ON_ATI = (1 << 27),	/* Disable NCQ on ATI chipset */
 
 	 /* DMA mask for user DMA control: User visible values; DO NOT
 	    renumber */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 5f37614f2451..c871b19cc915 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1442,8 +1442,9 @@ static inline int pci_set_dma_seg_boundary(struct pci_dev *dev,
 { return -EIO; }
 static inline int pci_assign_resource(struct pci_dev *dev, int i)
 { return -EBUSY; }
-static inline int __pci_register_driver(struct pci_driver *drv,
-					struct module *owner)
+static inline int __must_check __pci_register_driver(struct pci_driver *drv,
+						     struct module *owner,
+						     const char *mod_name)
 { return 0; }
 static inline int pci_register_driver(struct pci_driver *drv)
 { return 0; }
diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h
index 522757ac9cd4..890f53881fad 100644
--- a/include/linux/power/max17042_battery.h
+++ b/include/linux/power/max17042_battery.h
@@ -75,7 +75,7 @@ enum max17042_register {
 	MAX17042_RelaxCFG	= 0x2A,
 	MAX17042_MiscCFG	= 0x2B,
 	MAX17042_TGAIN		= 0x2C,
-	MAx17042_TOFF		= 0x2D,
+	MAX17042_TOFF		= 0x2D,
 	MAX17042_CGAIN		= 0x2E,
 	MAX17042_COFF		= 0x2F,
 
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 334534474828..0c849313bc42 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1507,7 +1507,7 @@ static inline void __skb_insert(struct sk_buff *newsk,
 	newsk->next = next;
 	newsk->prev = prev;
 	next->prev  = prev->next = newsk;
-	list->qlen++;
+	WRITE_ONCE(list->qlen, list->qlen + 1);
 }
 
 static inline void __skb_queue_splice(const struct sk_buff_head *list,
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index eea9bdeecba2..1d24da658f43 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -469,7 +469,7 @@ struct sctp_af {
 					 int saddr);
 	void		(*from_sk)	(union sctp_addr *,
 					 struct sock *sk);
-	void		(*from_addr_param) (union sctp_addr *,
+	bool		(*from_addr_param) (union sctp_addr *,
 					    union sctp_addr_param *,
 					    __be16 port, int iif);
 	int		(*to_addr_param) (const union sctp_addr *,
diff --git a/include/net/sock.h b/include/net/sock.h
index ac74a2aaa0d6..693711fead9c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -429,8 +429,10 @@ struct sock {
 #if IS_ENABLED(CONFIG_CGROUP_NET_PRIO)
 	__u32			sk_cgrp_prioidx;
 #endif
+	spinlock_t		sk_peer_lock;
 	struct pid		*sk_peer_pid;
 	const struct cred	*sk_peer_cred;
+
 	long			sk_rcvtimeo;
 	long			sk_sndtimeo;
 	struct timer_list	sk_timer;
diff --git a/include/uapi/linux/serial_reg.h b/include/uapi/linux/serial_reg.h
index 1e5ac4e776da..5bcc637cee46 100644
--- a/include/uapi/linux/serial_reg.h
+++ b/include/uapi/linux/serial_reg.h
@@ -61,6 +61,7 @@
  * ST16C654:	 8  16  56  60		 8  16  32  56	PORT_16654
  * TI16C750:	 1  16  32  56		xx  xx  xx  xx	PORT_16750
  * TI16C752:	 8  16  56  60		 8  16  32  56
+ * OX16C950:	16  32 112 120		16  32  64 112	PORT_16C950
  * Tegra:	 1   4   8  14		16   8   4   1	PORT_TEGRA
  */
 #define UART_FCR_R_TRIG_00	0x00