Merge android-4.4.179 (aab9adb) into msm-4.4

* refs/heads/tmp-aab9adb
  Linux 4.4.179
  kernel/sysctl.c: fix out-of-bounds access when setting file-max
  Revert "locking/lockdep: Add debug_locks check in __lock_downgrade()"
  ALSA: info: Fix racy addition/deletion of nodes
  mm/vmstat.c: fix /proc/vmstat format for CONFIG_DEBUG_TLBFLUSH=y CONFIG_SMP=n
  device_cgroup: fix RCU imbalance in error case
  sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup
  Revert "kbuild: use -Oz instead of -Os when using clang"
  mac80211: do not call driver wake_tx_queue op during reconfig
  kprobes: Fix error check when reusing optimized probes
  kprobes: Mark ftrace mcount handler functions nokprobe
  x86/kprobes: Verify stack frame on kretprobe
  arm64: futex: Restore oldval initialization to work around buggy compilers
  crypto: x86/poly1305 - fix overflow during partial reduction
  ALSA: core: Fix card races between register and disconnect
  staging: comedi: ni_usb6501: Fix possible double-free of ->usb_rx_buf
  staging: comedi: ni_usb6501: Fix use of uninitialized mutex
  staging: comedi: vmk80xx: Fix possible double-free of ->usb_rx_buf
  staging: comedi: vmk80xx: Fix use of uninitialized semaphore
  io: accel: kxcjk1013: restore the range after resume.
  iio: adc: at91: disable adc channel interrupt in timeout case
  iio: ad_sigma_delta: select channel when reading register
  iio/gyro/bmg160: Use millidegrees for temperature scale
  KVM: x86: Don't clear EFER during SMM transitions for 32-bit vCPU
  tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is incomplete
  modpost: file2alias: check prototype of handler
  modpost: file2alias: go back to simple devtable lookup
  crypto: crypto4xx - properly set IV after de- and encrypt
  ipv4: ensure rcu_read_lock() in ipv4_link_failure()
  ipv4: recompile ip options in ipv4_link_failure
  tcp: tcp_grow_window() needs to respect tcp_space()
  net: fou: do not use guehdr after iptunnel_pull_offloads in gue_udp_recv
  net: bridge: multicast: use rcu to access port list from br_multicast_start_querier
  net: atm: Fix potential Spectre v1 vulnerabilities
  bonding: fix event handling for stacked bonds
  appletalk: Fix compile regression
  ovl: fix uid/gid when creating over whiteout
  tpm/tpm_crb: Avoid unaligned reads in crb_recv()
  include/linux/swap.h: use offsetof() instead of custom __swapoffset macro
  lib/div64.c: off by one in shift
  appletalk: Fix use-after-free in atalk_proc_exit
  ARM: 8839/1: kprobe: make patch_lock a raw_spinlock_t
  iommu/dmar: Fix buffer overflow during PCI bus notification
  crypto: sha512/arm - fix crash bug in Thumb2 build
  crypto: sha256/arm - fix crash bug in Thumb2 build
  cifs: fallback to older infolevels on findfirst queryinfo retry
  ACPI / SBS: Fix GPE storm on recent MacBookPro's
  ARM: samsung: Limit SAMSUNG_PM_CHECK config option to non-Exynos platforms
  serial: uartps: console_setup() can't be placed to init section
  f2fs: fix to do sanity check with current segment number
  9p locks: add mount option for lock retry interval
  9p: do not trust pdu content for stat item size
  rsi: improve kernel thread handling to fix kernel panic
  ext4: prohibit fstrim in norecovery mode
  fix incorrect error code mapping for OBJECTID_NOT_FOUND
  x86/hw_breakpoints: Make default case in hw_breakpoint_arch_parse() return an error
  iommu/vt-d: Check capability before disabling protected memory
  x86/cpu/cyrix: Use correct macros for Cyrix calls on Geode processors
  x86/hpet: Prevent potential NULL pointer dereference
  perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test()
  perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test
  perf evsel: Free evsel->counts in perf_evsel__exit()
  perf top: Fix error handling in cmd_top()
  tools/power turbostat: return the exit status of a command
  thermal/int340x_thermal: fix mode setting
  thermal/int340x_thermal: Add additional UUIDs
  ALSA: opl3: fix mismatch between snd_opl3_drum_switch definition and declaration
  mmc: davinci: remove extraneous __init annotation
  IB/mlx4: Fix race condition between catas error reset and aliasguid flows
  ALSA: sb8: add a check for request_region
  ALSA: echoaudio: add a check for ioremap_nocache
  ext4: report real fs size after failed resize
  ext4: add missing brelse() in add_new_gdb_meta_bg()
  perf/core: Restore mmap record type correctly
  PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
  xtensa: fix return_address
  sched/fair: Do not re-read ->h_load_next during hierarchical load calculation
  xen: Prevent buffer overflow in privcmd ioctl
  arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
  ARM: dts: at91: Fix typo in ISC_D0 on PC9
  genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent()
  block: do not leak memory in bio_copy_user_iov()
  ASoC: fsl_esai: fix channel swap issue when stream starts
  include/linux/bitrev.h: fix constant bitrev
  ALSA: seq: Fix OOB-reads from strlcpy
  ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type
  net: ethtool: not call vzalloc for zero sized memory request
  netns: provide pure entropy for net_hash_mix()
  tcp: Ensure DCTCP reacts to losses
  sctp: initialize _pad of sockaddr_in before copying to user memory
  qmi_wwan: add Olicard 600
  openvswitch: fix flow actions reallocation
  net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().
  ipv6: sit: reset ip header pointer in ipip6_rcv
  ipv6: Fix dangling pointer when ipv6 fragment
  tty: ldisc: add sysctl to prevent autoloading of ldiscs
  tty: mark Siemens R3964 line discipline as BROKEN
  lib/string.c: implement a basic bcmp
  x86/vdso: Drop implicit common-page-size linker flag
  x86: vdso: Use $LD instead of $CC to link
  x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
  kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD
  binfmt_elf: switch to new creds when switching to new mm
  drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
  dmaengine: tegra: avoid overflow of byte tracking
  x86/build: Mark per-CPU symbols as absolute explicitly for LLD
  wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
  regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
  media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
  netfilter: physdev: relax br_netfilter dependency
  dmaengine: imx-dma: fix warning comparison of distinct pointer types
  hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
  soc/tegra: fuse: Fix illegal free of IO base address
  hwrng: virtio - Avoid repeated init of completion
  media: mt9m111: set initial frame size other than 0x0
  tty: increase the default flip buffer limit to 2*640K
  ARM: avoid Cortex-A9 livelock on tight dmb loops
  mt7601u: bump supported EEPROM version
  soc: qcom: gsbi: Fix error handling in gsbi_probe()
  ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
  cdrom: Fix race condition in cdrom_sysctl_register
  fbdev: fbmem: fix memory access if logo is bigger than the screen
  bcache: improve sysfs_strtoul_clamp()
  bcache: fix input overflow to sequential_cutoff
  bcache: fix input overflow to cache set sysfs file io_error_halflife
  ALSA: PCM: check if ops are defined before suspending PCM
  ARM: 8833/1: Ensure that NEON code always compiles with Clang
  kprobes: Prohibit probing on bsearch()
  leds: lp55xx: fix null deref on firmware load failure
  media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
  media: s5p-g2d: Correct return type for mem2mem buffer helpers
  media: s5p-jpeg: Correct return type for mem2mem buffer helpers
  media: sh_veu: Correct return type for mem2mem buffer helpers
  SoC: imx-sgtl5000: add missing put_device()
  perf test: Fix failure of 'evsel-tp-sched' test on s390
  scsi: megaraid_sas: return error when create DMA pool failed
  IB/mlx4: Increase the timeout for CM cache
  e1000e: Fix -Wformat-truncation warnings
  mmc: omap: fix the maximum timeout setting
  ARM: 8840/1: use a raw_spinlock_t in unwind
  coresight: etm4x: Add support to enable ETMv4.2
  scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
  usb: chipidea: Grab the (legacy) USB PHY by phandle first
  tools lib traceevent: Fix buffer overflow in arg_eval
  fs: fix guard_bio_eod to check for real EOD errors
  cifs: Fix NULL pointer dereference of devname
  dm thin: add sanity checks to thin-pool and external snapshot creation
  cifs: use correct format characters
  fs/file.c: initialize init_files.resize_wait
  f2fs: do not use mutex lock in atomic context
  ocfs2: fix a panic problem caused by o2cb_ctl
  mm/slab.c: kmemleak no scan alien caches
  mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
  mm/page_ext.c: fix an imbalance with kmemleak
  mm/cma.c: cma_declare_contiguous: correct err handling
  enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
  sysctl: handle overflow for file-max
  gpio: gpio-omap: fix level interrupt idling
  tracing: kdb: Fix ftdump to not sleep
  h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
  CIFS: fix POSIX lock leak and invalid ptr deref
  tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
  Bluetooth: Fix decrementing reference count twice in releasing socket
  i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
  mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
  tty/serial: atmel: Add is_half_duplex helper
  lib/int_sqrt: optimize initial value compute
  ext4: cleanup bh release code in ext4_ind_remove_space()
  arm64: debug: Ensure debug handlers check triggering exception level
  arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
  Make arm64 serial port config compatible with crosvm
  Fix merge issue with 4.4.178
  Fix merge issue with 4.4.177
  ANDROID: cuttlefish_defconfig: Enable CONFIG_OVERLAY_FS

Change-Id: I0d6e7b00f0198867803d5fe305ce13e205cc7518
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

5 files changed, 28 insertions, 10 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index db8eb7ccd744..c5c403866816 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -391,7 +391,7 @@ config XILINX_HWICAP
 
 config R3964
 	tristate "Siemens R3964 line discipline"
-	depends on TTY
+	depends on TTY && BROKEN
 	---help---
 	  This driver allows synchronous communication with devices using the
 	  Siemens R3964 packet protocol. Unless you are dealing with special
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 240b6cf1d97c..72e073895ed9 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -376,7 +376,7 @@ static __init int hpet_mmap_enable(char *str)
 	pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled");
 	return 1;
 }
-__setup("hpet_mmap", hpet_mmap_enable);
+__setup("hpet_mmap=", hpet_mmap_enable);
 
 static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
 {
diff --git a/drivers/char/hw_random/virtio-rng.c b/drivers/char/hw_random/virtio-rng.c
index 3fa2f8a009b3..1c5c4314c6b5 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t size, bool wait)
 
 	if (!vi->busy) {
 		vi->busy = true;
-		init_completion(&vi->have_data);
+		reinit_completion(&vi->have_data);
 		register_buffer(vi, buf, size);
 	}
 
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index 35308dfff754..8226e3b6dc1f 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -109,19 +109,29 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 	struct crb_priv *priv = chip->vendor.priv;
 	unsigned int expected;
 
-	/* sanity check */
-	if (count < 6)
+	/* A sanity check that the upper layer wants to get at least the header
+	 * as that is the minimum size for any TPM response.
+	 */
+	if (count < TPM_HEADER_SIZE)
 		return -EIO;
 
+	/* If this bit is set, according to the spec, the TPM is in
+	 * unrecoverable condition.
+	 */
 	if (le32_to_cpu(ioread32(&priv->cca->sts)) & CRB_CA_STS_ERROR)
 		return -EIO;
 
-	memcpy_fromio(buf, priv->rsp, 6);
-	expected = be32_to_cpup((__be32 *) &buf[2]);
-	if (expected > count || expected < 6)
+	/* Read the first 8 bytes in order to get the length of the response.
+	 * We read exactly a quad word in order to make sure that the remaining
+	 * reads will be aligned.
+	 */
+	memcpy_fromio(buf, priv->rsp, 8);
+
+	expected = be32_to_cpup((__be32 *)&buf[2]);
+	if (expected > count || expected < TPM_HEADER_SIZE)
 		return -EIO;
 
-	memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6);
+	memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8);
 
 	return expected;
 }
diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
index dd8f0eb3170a..73f7e0f7e34a 100644
--- a/drivers/char/tpm/tpm_i2c_atmel.c
+++ b/drivers/char/tpm/tpm_i2c_atmel.c
@@ -65,7 +65,15 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len)
 	dev_dbg(&chip->dev,
 		"%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__,
 		(int)min_t(size_t, 64, len), buf, len, status);
-	return status;
+
+	if (status < 0)
+		return status;
+
+	/* The upper layer does not support incomplete sends. */
+	if (status != len)
+		return -E2BIG;
+
+	return 0;
 }
 
 static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count)