Merge android-4.4.194 (a749771) into msm-4.4

* refs/heads/tmp-a749771
  Linux 4.4.194
  net_sched: let qdisc_put() accept NULL pointer
  ARC: export "abort" for modules
  media: technisat-usb2: break out of loop at end of buffer
  floppy: fix usercopy direction
  keys: Fix missing null pointer check in request_key_auth_describe()
  dmaengine: ti: omap-dma: Add cleanup in omap_dma_probe()
  net: seeq: Fix the function used to release some memory in an error handling path
  tools/power turbostat: fix buffer overrun
  sky2: Disable MSI on yet another ASUS boards (P6Xxxx)
  cifs: Use kzfree() to zero out the password
  cifs: set domainName when a domain-key is used in multiuser
  NFSv2: Fix write regression
  NFSv2: Fix eof handling
  netfilter: nf_conntrack_ftp: Fix debug output
  x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines
  r8152: Set memory to all 0xFFs on failed reg reads
  ARM: 8874/1: mm: only adjust sections of valid mm structures
  Kconfig: Fix the reference to the IDT77105 Phy driver in the description of ATM_NICSTAR_USE_IDT77105
  NFS: Fix initialisation of I/O result struct in nfs_pgio_rpcsetup
  NFSv4: Fix return values for nfs4_file_open()
  s390/bpf: use 32-bit index for tail calls
  ARM: OMAP2+: Fix omap4 errata warning on other SoCs
  s390/bpf: fix lcgr instruction encoding
  mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings
  tty/serial: atmel: reschedule TX after RX was started
  serial: sprd: correct the wrong sequence of arguments
  KVM: coalesced_mmio: add bounds checking
  xen-netfront: do not assume sk_buff_head list is empty in error handling
  x86/boot: Add missing bootparam that breaks boot on some platforms
  media: tm6000: double free if usb disconnect while streaming
  USB: usbcore: Fix slab-out-of-bounds bug during device reset
  ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs
  MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send()
  x86/build: Add -Wnoaddress-of-packed-member to REALMODE_CFLAGS, to silence GCC9 build warning
  crypto: talitos - check data blocksize in ablkcipher.
  crypto: talitos - check AES key size
  driver core: Fix use-after-free and double free on glue directory
  clk: rockchip: Don't yell about bad mmc phases when getting
  MIPS: VDSO: Use same -m%-float cflag as the kernel proper
  MIPS: VDSO: Prevent use of smp_processor_id()
  KVM: nVMX: handle page fault in vmread
  KVM: x86: work around leak of uninitialized stack contents
  KVM: s390: Do not leak kernel stack data in the KVM_S390_INTERRUPT ioctl
  genirq: Prevent NULL pointer dereference in resend_irqs()
  Btrfs: fix assertion failure during fsync and use of stale transaction
  Revert "MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur"
  tun: fix use-after-free when register netdev failed
  tipc: add NULL pointer check before calling kfree_rcu
  tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
  sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
  sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
  sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
  net: Fix null de-reference of device refcount
  isdn/capi: check message length in capi_write()
  ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
  cdc_ether: fix rndis support for Mediatek based smartphones
  bridge/mdb: remove wrong use of NLM_F_MULTI

Change-Id: I950778c771159febb721a4ebc2656c57ef40ad83
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

1 files changed, 8 insertions, 4 deletions

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 421f1d3fbdb8..126987c9da75 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -894,7 +894,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 	struct usb_bos_descriptor *bos;
 	struct usb_dev_cap_header *cap;
 	struct usb_ssp_cap_descriptor *ssp_cap;
-	unsigned char *buffer;
+	unsigned char *buffer, *buffer0;
 	int length, total_len, num, i, ssac;
 	__u8 cap_type;
 	int ret;
@@ -939,10 +939,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 			ret = -ENOMSG;
 		goto err;
 	}
+
+	buffer0 = buffer;
 	total_len -= length;
+	buffer += length;
 
 	for (i = 0; i < num; i++) {
-		buffer += length;
 		cap = (struct usb_dev_cap_header *)buffer;
 
 		if (total_len < sizeof(*cap) || total_len < cap->bLength) {
@@ -956,8 +958,6 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 			break;
 		}
 
-		total_len -= length;
-
 		if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
 			dev_warn(ddev, "descriptor type invalid, skip\n");
 			continue;
@@ -1001,7 +1001,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
 		default:
 			break;
 		}
+
+		total_len -= length;
+		buffer += length;
 	}
+	dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0);
 
 	return 0;