Merge android-4.4.160 (a94efb1) into msm-4.4

* refs/heads/tmp-a94efb1
  Linux 4.4.160
  dm thin metadata: fix __udivdi3 undefined on 32-bit
  ocfs2: fix locking for res->tracking and dlm->tracking_list
  proc: restrict kernel stack dumps to root
  crypto: mxs-dcp - Fix wait logic on chan threads
  ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760
  smb2: fix missing files in root share directory listing
  xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage
  xen: avoid crash in disable_hotplug_cpu
  xen/manage: don't complain about an empty value in control/sysrq node
  cifs: read overflow in is_valid_oplock_break()
  s390/qeth: don't dump past end of unknown HW header
  r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
  arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto"
  hexagon: modify ffs() and fls() to return int
  arch/hexagon: fix kernel/dma.c build warning
  dm thin metadata: try to avoid ever aborting transactions
  fs/cifs: suppress a string overflow warning
  drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
  USB: yurex: Check for truncation in yurex_read()
  RDMA/ucma: check fd type in ucma_migrate_id()
  perf probe powerpc: Ignore SyS symbols irrespective of endianness
  usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
  mm: madvise(MADV_DODUMP): allow hugetlbfs pages
  tools/vm/page-types.c: fix "defined but not used" warning
  tools/vm/slabinfo.c: fix sign-compare warning
  mac80211: shorten the IBSS debug messages
  mac80211: Fix station bandwidth setting after channel switch
  mac80211: fix a race between restart and CSA flows
  cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
  fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
  net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
  i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP
  i2c: uniphier: issue STOP only for last message or I2C_M_STOP
  RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
  cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
  mac80211: mesh: fix HWMP sequence numbering to follow standard
  gpio: adp5588: Fix sleep-in-atomic-context bug
  mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
  KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function
  media: v4l: event: Prevent freeing event subscriptions while accessed
  arm64: KVM: Sanitize PSTATE.M when being set from userspace
  arm64: cpufeature: Track 32bit EL0 support
  i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus
  hwmon: (adt7475) Make adt7475_read_word() return errors
  hwmon: (ina2xx) fix sysfs shunt resistor read access
  e1000: ensure to free old tx/rx rings in set_ringparam()
  e1000: check on netif_running() before calling e1000_up()
  net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES
  thermal: of-thermal: disable passive polling when thermal zone is disabled
  ext4: never move the system.data xattr out of the inode body
  arm64: KVM: Tighten guest core register access from userspace
  serial: imx: restore handshaking irq for imx1
  scsi: target: iscsi: Use bin2hex instead of a re-implementation
  IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop
  Input: elantech - enable middle button of touchpad on ThinkPad P72
  USB: remove LPM management from usb_driver_claim_interface()
  Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()"
  USB: usbdevfs: restore warning for nonsensical flags
  USB: usbdevfs: sanitize flags more
  media: uvcvideo: Support realtek's UVC 1.5 device
  slub: make ->cpu_partial unsigned int
  USB: handle NULL config in usb_find_alt_setting()
  USB: fix error handling in usb_driver_claim_interface()
  spi: rspi: Fix interrupted DMA transfers
  spi: rspi: Fix invalid SPI use during system suspend
  spi: sh-msiof: Fix handling of write value for SISTR register
  spi: sh-msiof: Fix invalid SPI use during system suspend
  spi: tegra20-slink: explicitly enable/disable clock
  serial: cpm_uart: return immediately from console poll
  floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
  ARM: dts: dra7: fix DCAN node addresses
  nfsd: fix corrupted reply to badly ordered compound
  module: exclude SHN_UNDEF symbols from kallsyms api
  ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs
  EDAC, i7core: Fix memleaks and use-after-free on probe and remove
  scsi: bnx2i: add error handling for ioremap_nocache
  HID: hid-ntrig: add error handling for sysfs_create_group
  ARM: mvebu: declare asm symbols as character arrays in pmsu.c
  wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()
  rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()
  ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
  ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
  media: tm6000: add error handling for dvb_register_adapter
  drivers/tty: add error handling for pcmcia_loop_config
  staging: android: ashmem: Fix mmap size validation
  media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data
  media: soc_camera: ov772x: correct setting of banding filter
  media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power
  ALSA: snd-aoa: add of_node_put() in error path
  s390/extmem: fix gcc 8 stringop-overflow warning
  alarmtimer: Prevent overflow for relative nanosleep
  powerpc/powernv/ioda2: Reduce upper limit for DMA window size
  usb: wusbcore: security: cast sizeof to int for comparison
  scsi: ibmvscsi: Improve strings handling
  scsi: klist: Make it safe to use klists in atomic context
  scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size
  x86/entry/64: Add two more instruction suffixes
  x86/tsc: Add missing header to tsc_msr.c
  media: fsl-viu: fix error handling in viu_of_probe()
  powerpc/kdump: Handle crashkernel memory reservation failure
  media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()
  md-cluster: clear another node's suspend_area after the copy is finished
  6lowpan: iphc: reset mac_header after decompress to fix panic
  USB: serial: kobil_sct: fix modem-status error handling
  Bluetooth: Add a new Realtek 8723DE ID 0bda:b009
  power: vexpress: fix corruption in notifier registration
  uwb: hwa-rc: fix memory leak at probe
  staging: rts5208: fix missing error check on call to rtsx_write_register
  x86/numa_emulation: Fix emulated-to-physical node mapping
  vmci: type promotion bug in qp_host_get_user_memory()
  tsl2550: fix lux1_input error in low light
  crypto: skcipher - Fix -Wstringop-truncation warnings
  ANDROID: sdcardfs: Change current->fs under lock
  ANDROID: sdcardfs: Don't use OVERRIDE_CRED macro
  Revert "f2fs: use timespec64 for inode timestamps"

Conflicts:
	arch/arm64/include/asm/cpufeature.h

Change-Id: I661204f2419f634173846d03ed4078b93aa006a1
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

6 files changed, 91 insertions, 17 deletions

diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c
index 346b5c1a9185..c40eb04dd856 100644
--- a/net/6lowpan/iphc.c
+++ b/net/6lowpan/iphc.c
@@ -569,6 +569,7 @@ int lowpan_header_decompress(struct sk_buff *skb, const struct net_device *dev,
 		hdr.hop_limit, &hdr.daddr);
 
 	skb_push(skb, sizeof(hdr));
+	skb_reset_mac_header(skb);
 	skb_reset_network_header(skb);
 	skb_copy_to_linear_data(skb, &hdr, sizeof(hdr));
 
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 08ac73b33947..0a35dd68f1a1 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -948,8 +948,8 @@ static void ieee80211_rx_mgmt_deauth_ibss(struct ieee80211_sub_if_data *sdata,
 	if (len < IEEE80211_DEAUTH_FRAME_LEN)
 		return;
 
-	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM BSSID=%pM (reason: %d)\n",
-		 mgmt->sa, mgmt->da, mgmt->bssid, reason);
+	ibss_dbg(sdata, "RX DeAuth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+	ibss_dbg(sdata, "\tBSSID=%pM (reason: %d)\n", mgmt->bssid, reason);
 	sta_info_destroy_addr(sdata, mgmt->sa);
 }
 
@@ -967,9 +967,9 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
 	auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
 	auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
 
-	ibss_dbg(sdata,
-		 "RX Auth SA=%pM DA=%pM BSSID=%pM (auth_transaction=%d)\n",
-		 mgmt->sa, mgmt->da, mgmt->bssid, auth_transaction);
+	ibss_dbg(sdata, "RX Auth SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+	ibss_dbg(sdata, "\tBSSID=%pM (auth_transaction=%d)\n",
+		 mgmt->bssid, auth_transaction);
 
 	if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1)
 		return;
@@ -1174,10 +1174,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 		rx_timestamp = drv_get_tsf(local, sdata);
 	}
 
-	ibss_dbg(sdata,
-		 "RX beacon SA=%pM BSSID=%pM TSF=0x%llx BCN=0x%llx diff=%lld @%lu\n",
+	ibss_dbg(sdata, "RX beacon SA=%pM BSSID=%pM TSF=0x%llx\n",
 		 mgmt->sa, mgmt->bssid,
-		 (unsigned long long)rx_timestamp,
+		 (unsigned long long)rx_timestamp);
+	ibss_dbg(sdata, "\tBCN=0x%llx diff=%lld @%lu\n",
 		 (unsigned long long)beacon_timestamp,
 		 (unsigned long long)(rx_timestamp - beacon_timestamp),
 		 jiffies);
@@ -1536,9 +1536,9 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 
 	tx_last_beacon = drv_tx_last_beacon(local);
 
-	ibss_dbg(sdata,
-		 "RX ProbeReq SA=%pM DA=%pM BSSID=%pM (tx_last_beacon=%d)\n",
-		 mgmt->sa, mgmt->da, mgmt->bssid, tx_last_beacon);
+	ibss_dbg(sdata, "RX ProbeReq SA=%pM DA=%pM\n", mgmt->sa, mgmt->da);
+	ibss_dbg(sdata, "\tBSSID=%pM (tx_last_beacon=%d)\n",
+		 mgmt->bssid, tx_last_beacon);
 
 	if (!tx_last_beacon && is_multicast_ether_addr(mgmt->da))
 		return;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 2ee53dc1ddf7..15d23aeea634 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -253,8 +253,27 @@ static void ieee80211_restart_work(struct work_struct *work)
 	     "%s called with hardware scan in progress\n", __func__);
 
 	rtnl_lock();
-	list_for_each_entry(sdata, &local->interfaces, list)
+	list_for_each_entry(sdata, &local->interfaces, list) {
+		/*
+		 * XXX: there may be more work for other vif types and even
+		 * for station mode: a good thing would be to run most of
+		 * the iface type's dependent _stop (ieee80211_mg_stop,
+		 * ieee80211_ibss_stop) etc...
+		 * For now, fix only the specific bug that was seen: race
+		 * between csa_connection_drop_work and us.
+		 */
+		if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+			/*
+			 * This worker is scheduled from the iface worker that
+			 * runs on mac80211's workqueue, so we can't be
+			 * scheduling this worker after the cancel right here.
+			 * The exception is ieee80211_chswitch_done.
+			 * Then we can have a race...
+			 */
+			cancel_work_sync(&sdata->u.mgd.csa_connection_drop_work);
+		}
 		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
+	}
 	ieee80211_scan_cancel(local);
 	ieee80211_reconfig(local);
 	rtnl_unlock();
@@ -460,10 +479,7 @@ static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
 		cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
 			    IEEE80211_VHT_CAP_SHORT_GI_80 |
 			    IEEE80211_VHT_CAP_SHORT_GI_160 |
-			    IEEE80211_VHT_CAP_RXSTBC_1 |
-			    IEEE80211_VHT_CAP_RXSTBC_2 |
-			    IEEE80211_VHT_CAP_RXSTBC_3 |
-			    IEEE80211_VHT_CAP_RXSTBC_4 |
+			    IEEE80211_VHT_CAP_RXSTBC_MASK |
 			    IEEE80211_VHT_CAP_TXSTBC |
 			    IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
 			    IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index f55cddcd556c..466922f09d04 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -552,6 +552,10 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
 		forward = false;
 		reply = true;
 		target_metric = 0;
+
+		if (SN_GT(target_sn, ifmsh->sn))
+			ifmsh->sn = target_sn;
+
 		if (time_after(jiffies, ifmsh->last_sn_update +
 					net_traversal_jiffies(sdata)) ||
 		    time_before(jiffies, ifmsh->last_sn_update)) {
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index c16b4da20db2..000dd7e6c310 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1021,6 +1021,10 @@ static void ieee80211_chswitch_work(struct work_struct *work)
 	 */
 
 	if (sdata->reserved_chanctx) {
+		struct ieee80211_supported_band *sband = NULL;
+		struct sta_info *mgd_sta = NULL;
+		enum ieee80211_sta_rx_bandwidth bw = IEEE80211_STA_RX_BW_20;
+
 		/*
 		 * with multi-vif csa driver may call ieee80211_csa_finish()
 		 * many times while waiting for other interfaces to use their
@@ -1029,6 +1033,48 @@ static void ieee80211_chswitch_work(struct work_struct *work)
 		if (sdata->reserved_ready)
 			goto out;
 
+		if (sdata->vif.bss_conf.chandef.width !=
+		    sdata->csa_chandef.width) {
+			/*
+			 * For managed interface, we need to also update the AP
+			 * station bandwidth and align the rate scale algorithm
+			 * on the bandwidth change. Here we only consider the
+			 * bandwidth of the new channel definition (as channel
+			 * switch flow does not have the full HT/VHT/HE
+			 * information), assuming that if additional changes are
+			 * required they would be done as part of the processing
+			 * of the next beacon from the AP.
+			 */
+			switch (sdata->csa_chandef.width) {
+			case NL80211_CHAN_WIDTH_20_NOHT:
+			case NL80211_CHAN_WIDTH_20:
+			default:
+				bw = IEEE80211_STA_RX_BW_20;
+				break;
+			case NL80211_CHAN_WIDTH_40:
+				bw = IEEE80211_STA_RX_BW_40;
+				break;
+			case NL80211_CHAN_WIDTH_80:
+				bw = IEEE80211_STA_RX_BW_80;
+				break;
+			case NL80211_CHAN_WIDTH_80P80:
+			case NL80211_CHAN_WIDTH_160:
+				bw = IEEE80211_STA_RX_BW_160;
+				break;
+			}
+
+			mgd_sta = sta_info_get(sdata, ifmgd->bssid);
+			sband =
+				local->hw.wiphy->bands[sdata->csa_chandef.chan->band];
+		}
+
+		if (sdata->vif.bss_conf.chandef.width >
+		    sdata->csa_chandef.width) {
+			mgd_sta->sta.bandwidth = bw;
+			rate_control_rate_update(local, sband, mgd_sta,
+						 IEEE80211_RC_BW_CHANGED);
+		}
+
 		ret = ieee80211_vif_use_reserved_context(sdata);
 		if (ret) {
 			sdata_info(sdata,
@@ -1039,6 +1085,13 @@ static void ieee80211_chswitch_work(struct work_struct *work)
 			goto out;
 		}
 
+		if (sdata->vif.bss_conf.chandef.width <
+		    sdata->csa_chandef.width) {
+			mgd_sta->sta.bandwidth = bw;
+			rate_control_rate_update(local, sband, mgd_sta,
+						 IEEE80211_RC_BW_CHANGED);
+		}
+
 		goto out;
 	}
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index afdbc1200a1b..b633caf325f3 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1355,7 +1355,7 @@ bool ieee80211_chandef_to_operating_class(struct cfg80211_chan_def *chandef,
 					  u8 *op_class)
 {
 	u8 vht_opclass;
-	u16 freq = chandef->center_freq1;
+	u32 freq = chandef->center_freq1;
 
 	if (freq >= 2412 && freq <= 2472) {
 		if (chandef->width > NL80211_CHAN_WIDTH_40)