Merge 4.4.88 into android-4.4

Changes in 4.4.88
	usb: quirks: add delay init quirk for Corsair Strafe RGB keyboard
	USB: serial: option: add support for D-Link DWM-157 C1
	usb: Add device quirk for Logitech HD Pro Webcam C920-C
	usb:xhci:Fix regression when ATI chipsets detected
	USB: core: Avoid race of async_completed() w/ usbdev_release()
	staging/rts5208: fix incorrect shift to extract upper nybble
	driver core: bus: Fix a potential double free
	intel_th: pci: Add Cannon Lake PCH-H support
	intel_th: pci: Add Cannon Lake PCH-LP support
	ath10k: fix memory leak in rx ring buffer allocation
	Input: trackpoint - assume 3 buttons when buttons detection fails
	rtlwifi: rtl_pci_probe: Fix fail path of _rtl_pci_find_adapter
	Bluetooth: Add support of 13d3:3494 RTL8723BE device
	dlm: avoid double-free on error path in dlm_device_{register,unregister}
	mwifiex: correct channel stat buffer overflows
	drm/nouveau/pci/msi: disable MSI on big-endian platforms by default
	workqueue: Fix flag collision
	cs5536: add support for IDE controller variant
	scsi: sg: protect against races between mmap() and SG_SET_RESERVED_SIZE
	scsi: sg: recheck MMAP_IO request length with lock held
	drm: adv7511: really enable interrupts for EDID detection
	drm/bridge: adv7511: Fix mutex deadlock when interrupts are disabled
	drm/bridge: adv7511: Use work_struct to defer hotplug handing to out of irq context
	drm/bridge: adv7511: Switch to using drm_kms_helper_hotplug_event()
	drm/bridge: adv7511: Re-write the i2c address before EDID probing
	btrfs: resume qgroup rescan on rw remount
	locktorture: Fix potential memory leak with rw lock test
	ALSA: msnd: Optimize / harden DSP and MIDI loops
	Bluetooth: Properly check L2CAP config option output buffer length
	ARM: 8692/1: mm: abort uaccess retries upon fatal signal
	NFS: Fix 2 use after free issues in the I/O code
	xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
	Linux 4.4.88

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

4 files changed, 15 insertions, 9 deletions

diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 531de256d58d..05de75360fa4 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -1607,6 +1607,12 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
 		goto err_wmi_detach;
 	}
 
+	/* If firmware indicates Full Rx Reorder support it must be used in a
+	 * slightly different manner. Let HTT code know.
+	 */
+	ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
+						ar->wmi.svc_map));
+
 	status = ath10k_htt_rx_alloc(&ar->htt);
 	if (status) {
 		ath10k_err(ar, "failed to alloc htt rx: %d\n", status);
@@ -1669,12 +1675,6 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode)
 		goto err_hif_stop;
 	}
 
-	/* If firmware indicates Full Rx Reorder support it must be used in a
-	 * slightly different manner. Let HTT code know.
-	 */
-	ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER,
-						ar->wmi.svc_map));
-
 	status = ath10k_htt_rx_ring_refill(ar);
 	if (status) {
 		ath10k_err(ar, "failed to refill htt rx ring: %d\n", status);
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index c3331d6201c3..9a8982f581c5 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -3740,7 +3740,7 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter)
 	if (adapter->config_bands & BAND_A)
 		n_channels_a = mwifiex_band_5ghz.n_channels;
 
-	adapter->num_in_chan_stats = max_t(u32, n_channels_bg, n_channels_a);
+	adapter->num_in_chan_stats = n_channels_bg + n_channels_a;
 	adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) *
 				      adapter->num_in_chan_stats);
 
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index c20017ced566..fb98f42cb5e7 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -2170,6 +2170,12 @@ mwifiex_update_chan_statistics(struct mwifiex_private *priv,
 					      sizeof(struct mwifiex_chan_stats);
 
 	for (i = 0 ; i < num_chan; i++) {
+		if (adapter->survey_idx >= adapter->num_in_chan_stats) {
+			mwifiex_dbg(adapter, WARN,
+				    "FW reported too many channel results (max %d)\n",
+				    adapter->num_in_chan_stats);
+			return;
+		}
 		chan_stats.chan_num = fw_chan_stats->chan_num;
 		chan_stats.bandcfg = fw_chan_stats->bandcfg;
 		chan_stats.flags = fw_chan_stats->flags;
diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
index a52230377e2c..c48b7e8ee0d6 100644
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -2269,7 +2269,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
 	/* find adapter */
 	if (!_rtl_pci_find_adapter(pdev, hw)) {
 		err = -ENODEV;
-		goto fail3;
+		goto fail2;
 	}
 
 	/* Init IO handler */
@@ -2339,10 +2339,10 @@ fail3:
 	pci_set_drvdata(pdev, NULL);
 	rtl_deinit_core(hw);
 
+fail2:
 	if (rtlpriv->io.pci_mem_start != 0)
 		pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
 
-fail2:
 	pci_release_regions(pdev);
 	complete(&rtlpriv->firmware_loading_complete);