Merge android-4.4.160 (a94efb1) into msm-4.4

* refs/heads/tmp-a94efb1
  Linux 4.4.160
  dm thin metadata: fix __udivdi3 undefined on 32-bit
  ocfs2: fix locking for res->tracking and dlm->tracking_list
  proc: restrict kernel stack dumps to root
  crypto: mxs-dcp - Fix wait logic on chan threads
  ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760
  smb2: fix missing files in root share directory listing
  xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage
  xen: avoid crash in disable_hotplug_cpu
  xen/manage: don't complain about an empty value in control/sysrq node
  cifs: read overflow in is_valid_oplock_break()
  s390/qeth: don't dump past end of unknown HW header
  r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
  arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto"
  hexagon: modify ffs() and fls() to return int
  arch/hexagon: fix kernel/dma.c build warning
  dm thin metadata: try to avoid ever aborting transactions
  fs/cifs: suppress a string overflow warning
  drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
  USB: yurex: Check for truncation in yurex_read()
  RDMA/ucma: check fd type in ucma_migrate_id()
  perf probe powerpc: Ignore SyS symbols irrespective of endianness
  usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
  mm: madvise(MADV_DODUMP): allow hugetlbfs pages
  tools/vm/page-types.c: fix "defined but not used" warning
  tools/vm/slabinfo.c: fix sign-compare warning
  mac80211: shorten the IBSS debug messages
  mac80211: Fix station bandwidth setting after channel switch
  mac80211: fix a race between restart and CSA flows
  cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
  fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
  net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
  i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP
  i2c: uniphier: issue STOP only for last message or I2C_M_STOP
  RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
  cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
  mac80211: mesh: fix HWMP sequence numbering to follow standard
  gpio: adp5588: Fix sleep-in-atomic-context bug
  mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function
  media: v4l: event: Prevent freeing event subscriptions while accessed
  arm64: KVM: Sanitize PSTATE.M when being set from userspace
  arm64: cpufeature: Track 32bit EL0 support
  i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus
  hwmon: (adt7475) Make adt7475_read_word() return errors
  hwmon: (ina2xx) fix sysfs shunt resistor read access
  e1000: ensure to free old tx/rx rings in set_ringparam()
  e1000: check on netif_running() before calling e1000_up()
  net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES
  thermal: of-thermal: disable passive polling when thermal zone is disabled
  ext4: never move the system.data xattr out of the inode body
  arm64: KVM: Tighten guest core register access from userspace
  serial: imx: restore handshaking irq for imx1
  scsi: target: iscsi: Use bin2hex instead of a re-implementation
  IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop
  Input: elantech - enable middle button of touchpad on ThinkPad P72
  USB: remove LPM management from usb_driver_claim_interface()
  Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()"
  USB: usbdevfs: restore warning for nonsensical flags
  USB: usbdevfs: sanitize flags more
  media: uvcvideo: Support realtek's UVC 1.5 device
  slub: make ->cpu_partial unsigned int
  USB: handle NULL config in usb_find_alt_setting()
  USB: fix error handling in usb_driver_claim_interface()
  spi: rspi: Fix interrupted DMA transfers
  spi: rspi: Fix invalid SPI use during system suspend
  spi: sh-msiof: Fix handling of write value for SISTR register
  spi: sh-msiof: Fix invalid SPI use during system suspend
  spi: tegra20-slink: explicitly enable/disable clock
  serial: cpm_uart: return immediately from console poll
  floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
  ARM: dts: dra7: fix DCAN node addresses
  nfsd: fix corrupted reply to badly ordered compound
  module: exclude SHN_UNDEF symbols from kallsyms api
  ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs
  EDAC, i7core: Fix memleaks and use-after-free on probe and remove
  scsi: bnx2i: add error handling for ioremap_nocache
  HID: hid-ntrig: add error handling for sysfs_create_group
  ARM: mvebu: declare asm symbols as character arrays in pmsu.c
  wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()
  rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()
  ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
  ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
  media: tm6000: add error handling for dvb_register_adapter
  drivers/tty: add error handling for pcmcia_loop_config
  staging: android: ashmem: Fix mmap size validation
  media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data
  media: soc_camera: ov772x: correct setting of banding filter
  media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power
  ALSA: snd-aoa: add of_node_put() in error path
  s390/extmem: fix gcc 8 stringop-overflow warning
  alarmtimer: Prevent overflow for relative nanosleep
  powerpc/powernv/ioda2: Reduce upper limit for DMA window size
  usb: wusbcore: security: cast sizeof to int for comparison
  scsi: ibmvscsi: Improve strings handling
  scsi: klist: Make it safe to use klists in atomic context
  scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size
  x86/entry/64: Add two more instruction suffixes
  x86/tsc: Add missing header to tsc_msr.c
  media: fsl-viu: fix error handling in viu_of_probe()
  powerpc/kdump: Handle crashkernel memory reservation failure
  media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()
  md-cluster: clear another node's suspend_area after the copy is finished
  6lowpan: iphc: reset mac_header after decompress to fix panic
  USB: serial: kobil_sct: fix modem-status error handling
  Bluetooth: Add a new Realtek 8723DE ID 0bda:b009
  power: vexpress: fix corruption in notifier registration
  uwb: hwa-rc: fix memory leak at probe
  staging: rts5208: fix missing error check on call to rtsx_write_register
  x86/numa_emulation: Fix emulated-to-physical node mapping
  vmci: type promotion bug in qp_host_get_user_memory()
  tsl2550: fix lux1_input error in low light
  crypto: skcipher - Fix -Wstringop-truncation warnings
  ANDROID: sdcardfs: Change current->fs under lock
  ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro
  Revert "f2fs: use timespec64 for inode timestamps"

Conflicts:
	arch/arm64/include/asm/cpufeature.h

Change-Id: I661204f2419f634173846d03ed4078b93aa006a1
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

8 files changed, 62 insertions, 26 deletions

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 4380e4f600ab..61ea87917433 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -453,7 +453,7 @@ static int clear_wdm_read_flag(struct wdm_device *desc)
 
 	set_bit(WDM_RESPONDING, &desc->flags);
 	spin_unlock_irq(&desc->iuspin);
-	rv = usb_submit_urb(desc->response, GFP_ATOMIC);
+	rv = usb_submit_urb(desc->response, GFP_KERNEL);
 	spin_lock_irq(&desc->iuspin);
 	if (rv) {
 		dev_err(&desc->intf->dev,
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index ad2e6d235c30..5e0af15aebc4 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1289,10 +1289,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 	struct async *as = NULL;
 	struct usb_ctrlrequest *dr = NULL;
 	unsigned int u, totlen, isofrmlen;
-	int i, ret, is_in, num_sgs = 0, ifnum = -1;
+	int i, ret, num_sgs = 0, ifnum = -1;
 	int number_of_packets = 0;
 	unsigned int stream_id = 0;
 	void *buf;
+	bool is_in;
+	bool allow_short = false;
+	bool allow_zero = false;
 	unsigned long mask =	USBDEVFS_URB_SHORT_NOT_OK |
 				USBDEVFS_URB_BULK_CONTINUATION |
 				USBDEVFS_URB_NO_FSBR |
@@ -1326,6 +1329,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 	u = 0;
 	switch (uurb->type) {
 	case USBDEVFS_URB_TYPE_CONTROL:
+		if (is_in)
+			allow_short = true;
 		if (!usb_endpoint_xfer_control(&ep->desc))
 			return -EINVAL;
 		/* min 8 byte setup packet */
@@ -1366,6 +1371,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 		break;
 
 	case USBDEVFS_URB_TYPE_BULK:
+		if (!is_in)
+			allow_zero = true;
+		else
+			allow_short = true;
 		switch (usb_endpoint_type(&ep->desc)) {
 		case USB_ENDPOINT_XFER_CONTROL:
 		case USB_ENDPOINT_XFER_ISOC:
@@ -1386,6 +1395,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 		if (!usb_endpoint_xfer_int(&ep->desc))
 			return -EINVAL;
  interrupt_urb:
+		if (!is_in)
+			allow_zero = true;
+		else
+			allow_short = true;
 		break;
 
 	case USBDEVFS_URB_TYPE_ISO:
@@ -1512,16 +1525,21 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
 	u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
 	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
 		u |= URB_ISO_ASAP;
-	if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
+	if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
 		u |= URB_SHORT_NOT_OK;
 	if (uurb->flags & USBDEVFS_URB_NO_FSBR)
 		u |= URB_NO_FSBR;
-	if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+	if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
 		u |= URB_ZERO_PACKET;
 	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
 		u |= URB_NO_INTERRUPT;
 	as->urb->transfer_flags = u;
 
+	if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
+		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
+	if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
+
 	as->urb->transfer_buffer_length = uurb->buffer_length;
 	as->urb->setup_packet = (unsigned char *)dr;
 	dr = NULL;
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 55322469084d..7dae981b66b1 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 	struct device *dev;
 	struct usb_device *udev;
 	int retval = 0;
-	int lpm_disable_error = -ENODEV;
 
 	if (!iface)
 		return -ENODEV;
@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 
 	iface->condition = USB_INTERFACE_BOUND;
 
-	/* See the comment about disabling LPM in usb_probe_interface(). */
-	if (driver->disable_hub_initiated_lpm) {
-		lpm_disable_error = usb_unlocked_disable_lpm(udev);
-		if (lpm_disable_error) {
-			dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.",
-					__func__, driver->name);
-			return -ENOMEM;
-		}
-	}
-
 	/* Claimed interfaces are initially inactive (suspended) and
 	 * runtime-PM-enabled, but only if the driver has autosuspend
 	 * support.  Otherwise they are marked active, to prevent the
@@ -558,9 +547,20 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 	if (device_is_registered(dev))
 		retval = device_bind_driver(dev);
 
-	/* Attempt to re-enable USB3 LPM, if the disable was successful. */
-	if (!lpm_disable_error)
-		usb_unlocked_enable_lpm(udev);
+	if (retval) {
+		dev->driver = NULL;
+		usb_set_intfdata(iface, NULL);
+		iface->needs_remote_wakeup = 0;
+		iface->condition = USB_INTERFACE_UNBOUND;
+
+		/*
+		 * Unbound interfaces are always runtime-PM-disabled
+		 * and runtime-PM-suspended
+		 */
+		if (driver->supports_autosuspend)
+			pm_runtime_disable(dev);
+		pm_runtime_set_suspended(dev);
+	}
 
 	return retval;
 }
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 062677f8e91d..74087b265317 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -95,6 +95,8 @@ struct usb_host_interface *usb_find_alt_setting(
 	struct usb_interface_cache *intf_cache = NULL;
 	int i;
 
+	if (!config)
+		return NULL;
 	for (i = 0; i < config->desc.bNumInterfaces; i++) {
 		if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
 				== iface_num) {
diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c
index 6ba122cc7490..95df2b3bb6a1 100644
--- a/drivers/usb/gadget/udc/fotg210-udc.c
+++ b/drivers/usb/gadget/udc/fotg210-udc.c
@@ -1066,12 +1066,15 @@ static struct usb_gadget_ops fotg210_gadget_ops = {
 static int fotg210_udc_remove(struct platform_device *pdev)
 {
 	struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
+	int i;
 
 	usb_del_gadget_udc(&fotg210->gadget);
 	iounmap(fotg210->reg);
 	free_irq(platform_get_irq(pdev, 0), fotg210);
 
 	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
+	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+		kfree(fotg210->ep[i]);
 	kfree(fotg210);
 
 	return 0;
@@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
 	/* initialize udc */
 	fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
 	if (fotg210 == NULL)
-		goto err_alloc;
+		goto err;
 
 	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
 		_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
@@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
 	fotg210->reg = ioremap(res->start, resource_size(res));
 	if (fotg210->reg == NULL) {
 		pr_err("ioremap error.\n");
-		goto err_map;
+		goto err_alloc;
 	}
 
 	spin_lock_init(&fotg210->lock);
@@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
 	fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
 				GFP_KERNEL);
 	if (fotg210->ep0_req == NULL)
-		goto err_req;
+		goto err_map;
 
 	fotg210_init(fotg210);
 
@@ -1190,12 +1193,14 @@ err_req:
 	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
 
 err_map:
-	if (fotg210->reg)
-		iounmap(fotg210->reg);
+	iounmap(fotg210->reg);
 
 err_alloc:
+	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
+		kfree(fotg210->ep[i]);
 	kfree(fotg210);
 
+err:
 	return ret;
 }
 
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index e8e8702d5adf..5594a4a4a83f 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -431,6 +431,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,
 	spin_unlock_irqrestore(&dev->lock, flags);
 	mutex_unlock(&dev->io_mutex);
 
+	if (WARN_ON_ONCE(len >= sizeof(in_buffer)))
+		return -EIO;
+
 	return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
 
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 813035f51fe7..7d252678c55a 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -408,12 +408,20 @@ static int kobil_tiocmget(struct tty_struct *tty)
 			  transfer_buffer_length,
 			  KOBIL_TIMEOUT);
 
-	dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n",
-		__func__, result, transfer_buffer[0]);
+	dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n",
+			result);
+	if (result < 1) {
+		if (result >= 0)
+			result = -EIO;
+		goto out_free;
+	}
+
+	dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]);
 
 	result = 0;
 	if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0)
 		result = TIOCM_DSR;
+out_free:
 	kfree(transfer_buffer);
 	return result;
 }
diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
index b66faaf3e842..4019c11f24e2 100644
--- a/drivers/usb/wusbcore/security.c
+++ b/drivers/usb/wusbcore/security.c
@@ -230,7 +230,7 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc,
 
 	result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
 				    0, secd, sizeof(*secd));
-	if (result < sizeof(*secd)) {
+	if (result < (int)sizeof(*secd)) {
 		dev_err(dev, "Can't read security descriptor or "
 			"not enough data: %d\n", result);
 		goto out;