Merge android-4.4.167 (ad9ce19) into msm-4.4

* refs/heads/tmp-ad9ce19
  Linux 4.4.167
  mac80211: ignore NullFunc frames in the duplicate detection
  mac80211: fix reordering of buffered broadcast packets
  mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext
  mac80211: Clear beacon_int in ieee80211_do_stop
  mac80211_hwsim: Timer should be initialized before device registered
  kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()
  tty: serial: 8250_mtk: always resume the device in probe.
  cifs: Fix separator when building path from dentry
  Staging: lustre: remove two build warnings
  xhci: Prevent U1/U2 link pm states if exit latency is too long
  SUNRPC: Fix leak of krb5p encode pages
  virtio/s390: fix race in ccw_io_helper()
  virtio/s390: avoid race on vcdev->config
  ALSA: pcm: Fix interval evaluation with openmin/max
  ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
  ALSA: pcm: Fix starvation on down_write_nonblock()
  ALSA: hda: Add support for AMD Stoney Ridge
  ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
  USB: check usb_get_extra_descriptor for proper size
  usb: appledisplay: Add 27" Apple Cinema Display
  usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
  net: amd: add missing of_node_put()
  iommu/vt-d: Use memunmap to free memremap
  net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts
  net/mlx4: Fix UBSAN warning of signed integer overflow
  net/mlx4_core: Fix uninitialized variable compilation warning
  net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
  qed: Fix reading wrong value in loop condition
  qed: Fix PTT leak in qed_drain()
  bnx2x: Assign unique DMAE channel number for FW DMAE transactions.
  batman-adv: Expand merged fragment buffer for full packet
  can: rcar_can: Fix erroneous registration
  iommu/ipmmu-vmsa: Fix crash on early domain free
  iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()
  usb: gadget: dummy: fix nonsensical comparisons
  mm: mlock: avoid increase mm->locked_vm on mlock() when already mlock2(,MLOCK_ONFAULT)
  mm: cleancache: fix corruption on missed inode invalidation
  arc: [devboards] Add support of NFSv3 ACL
  ARC: change defconfig defaults to ARCv2
  Btrfs: fix use-after-free when dumping free space
  btrfs: Always try all copies when reading extent buffers
  Input: elan_i2c - add support for ELAN0621 touchpad
  Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
  Input: elan_i2c - add ELAN0620 to the ACPI table
  Input: matrix_keypad - check for errors from of_get_named_gpio()
  Input: xpad - quirk all PDP Xbox One gamepads
  leds: leds-gpio: Fix return value check in create_gpio_led()
  leds: turn off the LED and wait for completion on unregistering LED class device
  leds: call led_pwm_set() in leds-pwm to enforce default LED_OFF
  kgdboc: Fix warning with module build
  kgdboc: Fix restrict error
  scsi: csiostor: Avoid content leaks and casts
  ALSA: trident: Suppress gcc string warning
  scsi: scsi_devinfo: cleanly zero-pad devinfo strings
  drm/ast: Fix incorrect free on ioregs
  mips: fix mips_get_syscall_arg o32 check
  MIPS: ralink: Fix mt7620 nd_sd pinmux
  uprobes: Fix handle_swbp() vs. unregister() + register() race once more
  iser: set sector for ambiguous mr status errors
  kdb: use memmove instead of overlapping memcpy
  staging: rts5208: fix gcc-8 logic error warning
  scsi: bfa: convert to strlcpy/strlcat
  drm: gma500: fix logic error
  ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
  kernfs: Replace strncpy with memcpy
  unifdef: use memcpy instead of strncpy
  kobject: Replace strncpy with memcpy
  disable stringop truncation warnings for now
  exec: avoid gcc-8 warning for get_task_comm
  Kbuild: suppress packed-not-aligned warning for default setting only
  misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
  usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
  USB: usb-storage: Add new IDs to ums-realtek
  btrfs: release metadata before running delayed refs
  dmaengine: at_hdmac: fix module unloading
  dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
  ext2: fix potential use after free
  ALSA: sparc: Fix invalid snd_free_pages() at error path
  ALSA: control: Fix race between adding and removing a user element
  ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
  ALSA: wss: Fix invalid snd_free_pages() at error path
  Btrfs: ensure path name is null terminated at btrfs_control_ioctl
  xtensa: fix coprocessor context offset definitions
  xtensa: enable coprocessors that are being flushed
  kvm: mmu: Fix race in emulated page table writes
  usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
  s390/qeth: fix length check in SNMP processing
  rapidio/rionet: do not free skb before reading its length
  Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()"
  media: em28xx: Fix use-after-free when disconnecting
  ANDROID: cuttlefish_defconfig: Enable VIRT_WIFI
  FROMGIT, BACKPORT: mac80211-next: rtnetlink wifi simulation device
  ANDROID: Move from clang r328903 to r346389b.
  UPSTREAM: binder: fix race that allows malicious free of live buffer

Change-Id: If4e5a3a45f6f0b7de31f203c09fce5bae1466e49
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

3 files changed, 11 insertions, 4 deletions

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 8f6894c6e83c..ded334b5cf8d 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -3082,7 +3082,12 @@ static inline void set_task_comm(struct task_struct *tsk, const char *from)
 {
 	__set_task_comm(tsk, from, false);
 }
-extern char *get_task_comm(char *to, struct task_struct *tsk);
+
+extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk);
+#define get_task_comm(buf, tsk) ({			\
+	BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN);	\
+	__get_task_comm(buf, sizeof(buf), tsk);		\
+})
 
 #ifdef CONFIG_SMP
 void scheduler_ipi(void);
diff --git a/include/linux/usb.h b/include/linux/usb.h
index d88c31c8e6a4..e27df29a298e 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -336,11 +336,11 @@ struct usb_host_bos {
 };
 
 int __usb_get_extra_descriptor(char *buffer, unsigned size,
-	unsigned char type, void **ptr);
+	unsigned char type, void **ptr, size_t min);
 #define usb_get_extra_descriptor(ifpoint, type, ptr) \
 				__usb_get_extra_descriptor((ifpoint)->extra, \
 				(ifpoint)->extralen, \
-				type, (void **)ptr)
+				type, (void **)ptr, sizeof(**(ptr)))
 
 /* ----------------------------------------------------------------------- */
 
diff --git a/include/sound/pcm_params.h b/include/sound/pcm_params.h
index 747c94a9a3d6..91f6abfb2ce0 100644
--- a/include/sound/pcm_params.h
+++ b/include/sound/pcm_params.h
@@ -251,11 +251,13 @@ static inline int snd_interval_empty(const struct snd_interval *i)
 static inline int snd_interval_single(const struct snd_interval *i)
 {
 	return (i->min == i->max || 
-		(i->min + 1 == i->max && i->openmax));
+		(i->min + 1 == i->max && (i->openmin || i->openmax)));
 }
 
 static inline int snd_interval_value(const struct snd_interval *i)
 {
+	if (i->openmin && !i->openmax)
+		return i->max;
 	return i->min;
 }