Merge 4.4.218 into android-msm-wahoo-4.4

Changes in 4.4.218: (92 commits)
        spi: qup: call spi_qup_pm_resume_runtime before suspending
        powerpc: Include .BTF section
        ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
        spi/zynqmp: remove entry that causes a cs glitch
        drm/exynos: dsi: propagate error value and silence meaningless warning
        drm/exynos: dsi: fix workaround for the legacy clock name
        altera-stapl: altera_get_note: prevent write beyond end of 'key'
        USB: Disable LPM on WD19's Realtek Hub
        usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
        USB: serial: option: add ME910G1 ECM composition 0x110b
        usb: host: xhci-plat: add a shutdown
        USB: serial: pl2303: add device-id for HP LD381
        ALSA: line6: Fix endless MIDI read loop
        ALSA: seq: virmidi: Fix running status after receiving sysex
        ALSA: seq: oss: Fix running status after receiving sysex
        ALSA: pcm: oss: Avoid plugin buffer overflow
        ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
        staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
        staging/speakup: fix get_word non-space look-ahead
        intel_th: Fix user-visible error codes
        rtc: max8907: add missing select REGMAP_IRQ
        memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event
        mm: slub: be more careful about the double cmpxchg of freelist
        mm, slub: prevent kmalloc_node crashes and memory leaks
        x86/mm: split vmalloc_sync_all()
        USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
        USB: cdc-acm: fix rounding error in TIOCSSERIAL
        kbuild: Disable -Wpointer-to-enum-cast
        futex: Fix inode life-time issue
        futex: Unbreak futex hashing
        ALSA: hda/realtek: Fix pop noise on ALC225
        arm64: smp: fix smp_send_stop() behaviour
        Revert "drm/dp_mst: Skip validating ports during destruction, just ref"
        hsr: fix general protection fault in hsr_addr_is_self()
        net: dsa: Fix duplicate frames flooded by learning
        net_sched: cls_route: remove the right filter from hashtable
        net_sched: keep alloc_hash updated after hash allocation
        NFC: fdp: Fix a signedness bug in fdp_nci_send_patch()
        slcan: not call free_netdev before rtnl_unlock in slcan_open
        vxlan: check return value of gro_cells_init()
        hsr: use rcu_read_lock() in hsr_get_node_{list/status}()
        hsr: add restart routine into hsr_get_node_list()
        hsr: set .netnsok flag
        vhost: Check docket sk_family instead of call getname
        IB/ipoib: Do not warn if IPoIB debugfs doesn't exist
        uapi glibc compat: fix outer guard of net device flags enum
        KVM: VMX: Do not allow reexecute_instruction() when skipping MMIO instr
        drivers/hwspinlock: use correct radix tree API
        net: ipv4: don't let PMTU updates increase route MTU
        cpupower: avoid multiple definition with gcc -fno-common
        dt-bindings: net: FMan erratum A050385
        scsi: ipr: Fix softlockup when rescanning devices in petitboot
        mac80211: Do not send mesh HWMP PREQ if HWMP is disabled
        sxgbe: Fix off by one in samsung driver strncpy size arg
        i2c: hix5hd2: add missed clk_disable_unprepare in remove
        perf probe: Do not depend on dwfl_module_addrsym()
        scripts/dtc: Remove redundant YYLOC global declaration
        scsi: sd: Fix optimal I/O size for devices that change reported values
        mac80211: mark station unauthorized before key removal
        genirq: Fix reference leaks on irq affinity notifiers
        vti[6]: fix packet tx through bpf_redirect() in XinY cases
        xfrm: fix uctx len check in verify_sec_ctx_len
        xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire
        xfrm: policy: Fix doulbe free in xfrm_policy_timer
        vti6: Fix memory leak of skb if input policy check fails
        tools: Let O= makes handle a relative path with -C option
        USB: serial: option: add support for ASKEY WWHC050
        USB: serial: option: add BroadMobi BM806U
        USB: serial: option: add Wistron Neweb D19Q1
        USB: cdc-acm: restore capability check order
        USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
        usb: musb: fix crash with highmen PIO and usbmon
        media: flexcop-usb: fix endpoint sanity check
        media: usbtv: fix control-message timeouts
        staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
        staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
        libfs: fix infoleak in simple_attr_read()
        media: ov519: add missing endpoint sanity checks
        media: dib0700: fix rc endpoint lookup
        media: stv06xx: add missing descriptor sanity checks
        media: xirlink_cit: add missing descriptor sanity checks
        vt: selection, introduce vc_is_sel
        vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines
        vt: switch vt_dont_switch to bool
        vt: vt_ioctl: remove unnecessary console allocation checks
        vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
        locking/atomic, kref: Add kref_read()
        vt: vt_ioctl: fix use-after-free in vt_in_use()
        bpf: Explicitly memset the bpf_attr structure
        net: ks8851-ml: Fix IO operations, again
        perf map: Fix off by one in strncpy() size argument
        Linux 4.4.218

Signed-off-by: Nathan Chancellor <[email protected]>

Conflicts:
	arch/arm64/kernel/smp.c
	drivers/scsi/sd.c

Documentation/devicetree/bindings/powerpc/fsl/fman.txt

@@ -110,6 +110,13 @@ PROPERTIES
 		Usage: required
 		Definition: See soc/fsl/qman.txt and soc/fsl/bman.txt
 
+- fsl,erratum-a050385
+		Usage: optional
+		Value type: boolean
+		Definition: A boolean property. Indicates the presence of the
+		erratum A050385 which indicates that DMA transactions that are
+		split can result in a FMan lock.
+
 =============================================================================
 FMan MURAM Node
 

Makefile

@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 217
+SUBLEVEL = 218
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 

arch/arm/boot/dts/dra7.dtsi

@@ -227,6 +227,7 @@
 				device_type = "pci";
 				ranges = <0x81000000 0 0          0x03000 0 0x00010000
 					  0x82000000 0 0x20013000 0x13000 0 0xffed000>;
+				dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
 				bus-range = <0x00 0xff>;
 				#interrupt-cells = <1>;
 				num-lanes = <1>;
@@ -263,6 +264,7 @@
 				device_type = "pci";
 				ranges = <0x81000000 0 0          0x03000 0 0x00010000
 					  0x82000000 0 0x30013000 0x13000 0 0xffed000>;
+				dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
 				bus-range = <0x00 0xff>;
 				#interrupt-cells = <1>;
 				num-lanes = <1>;

arch/arm64/kernel/smp.c

@@ -757,7 +757,7 @@ static void ipi_cpu_stop(unsigned int cpu, struct pt_regs *regs)
 		raw_spin_unlock(&stop_lock);
 	}
 
-	set_cpu_active(cpu, false);
+	set_cpu_online(cpu, false);
 
 	flush_cache_all();
 	local_irq_disable();
@@ -915,11 +915,22 @@ void tick_broadcast(const struct cpumask *mask)
 }
 #endif
 
+/*
+ * The number of CPUs online, not counting this CPU (which may not be
+ * fully online and so not counted in num_online_cpus()).
+ */
+static inline unsigned int num_other_online_cpus(void)
+{
+	unsigned int this_cpu_online = cpu_online(smp_processor_id());
+
+	return num_online_cpus() - this_cpu_online;
+}
+
 void smp_send_stop(void)
 {
 	unsigned long timeout;
 
-	if (num_online_cpus() > 1) {
+	if (num_other_online_cpus()) {
 		cpumask_t mask;
 
 		cpumask_copy(&mask, cpu_online_mask);
@@ -930,10 +941,10 @@ void smp_send_stop(void)
 
 	/* Wait up to one second for other CPUs to stop */
 	timeout = USEC_PER_SEC;
-	while (num_active_cpus() > 1 && timeout--)
+	while (num_other_online_cpus() && timeout--)
 		udelay(1);
 
-	if (num_active_cpus() > 1)
+	if (num_other_online_cpus())
 		pr_warning("SMP: failed to stop secondary CPUs\n");
 }
 

arch/powerpc/kernel/vmlinux.lds.S

@@ -256,6 +256,12 @@ SECTIONS
 		*(.branch_lt)
 	}
 
+#ifdef CONFIG_DEBUG_INFO_BTF
+	.BTF : AT(ADDR(.BTF) - LOAD_OFFSET) {
+		*(.BTF)
+	}
+#endif
+
 	.opd : AT(ADDR(.opd) - LOAD_OFFSET) {
 		*(.opd)
 	}

arch/x86/kvm/vmx.c

@@ -6187,8 +6187,8 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu)
 			return 1;
 		}
 		else
-			return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP,
-						       NULL, 0) == EMULATE_DONE;
+			return emulate_instruction(vcpu, EMULTYPE_SKIP) ==
+								EMULATE_DONE;
 	}
 
 	ret = handle_mmio_page_fault(vcpu, gpa, true);

arch/x86/mm/fault.c

@@ -228,7 +228,7 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
 	return pmd_k;
 }
 
-void vmalloc_sync_all(void)
+static void vmalloc_sync(void)
 {
 	unsigned long address;
 
@@ -255,6 +255,16 @@ void vmalloc_sync_all(void)
 	}
 }
 
+void vmalloc_sync_mappings(void)
+{
+	vmalloc_sync();
+}
+
+void vmalloc_sync_unmappings(void)
+{
+	vmalloc_sync();
+}
+
 /*
  * 32-bit:
  *
@@ -349,11 +359,23 @@ static void dump_pagetable(unsigned long address)
 
 #else /* CONFIG_X86_64: */
 
-void vmalloc_sync_all(void)
+void vmalloc_sync_mappings(void)
 {
+	/*
+	 * 64-bit mappings might allocate new p4d/pud pages
+	 * that need to be propagated to all tasks' PGDs.
+	 */
 	sync_global_pgds(VMALLOC_START & PGDIR_MASK, VMALLOC_END, 0);
 }
 
+void vmalloc_sync_unmappings(void)
+{
+	/*
+	 * Unmappings never allocate or free p4d/pud pages.
+	 * No work is required here.
+	 */
+}
+
 /*
  * 64-bit:
  *

drivers/acpi/apei/ghes.c

@@ -229,7 +229,7 @@ static int ghes_estatus_pool_expand(unsigned long len)
 	 * New allocation must be visible in all pgd before it can be found by
 	 * an NMI allocating from the pool.
 	 */
-	vmalloc_sync_all();
+	vmalloc_sync_mappings();
 
 	return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
 }

drivers/gpu/drm/drm_dp_mst_topology.c

@@ -975,20 +975,9 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
 static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
 {
 	struct drm_dp_mst_port *rport = NULL;
-
 	mutex_lock(&mgr->lock);
-	/*
-	 * Port may or may not be 'valid' but we don't care about that when
-	 * destroying the port and we are guaranteed that the port pointer
-	 * will be valid until we've finished
-	 */
-	if (current_work() == &mgr->destroy_connector_work) {
-		kref_get(&port->kref);
-		rport = port;
-	} else if (mgr->mst_primary) {
-		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
-						       port);
-	}
+	if (mgr->mst_primary)
+		rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
 	mutex_unlock(&mgr->lock);
 	return rport;
 }

drivers/gpu/drm/exynos/exynos_drm_dsi.c

@@ -1899,8 +1899,9 @@ static int exynos_dsi_probe(struct platform_device *pdev)
 	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies),
 				      dsi->supplies);
 	if (ret) {
-		dev_info(dev, "failed to get regulators: %d\n", ret);
-		return -EPROBE_DEFER;
+		if (ret != -EPROBE_DEFER)
+			dev_info(dev, "failed to get regulators: %d\n", ret);
+		return ret;
 	}
 
 	dsi->clks = devm_kzalloc(dev,
@@ -1913,9 +1914,10 @@ static int exynos_dsi_probe(struct platform_device *pdev)
 		dsi->clks[i] = devm_clk_get(dev, clk_names[i]);
 		if (IS_ERR(dsi->clks[i])) {
 			if (strcmp(clk_names[i], "sclk_mipi") == 0) {
-				strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME);
-				i--;
-				continue;
+				dsi->clks[i] = devm_clk_get(dev,
+							OLD_SCLK_MIPI_CLK_NAME);
+				if (!IS_ERR(dsi->clks[i]))
+					continue;
 			}
 
 			dev_info(dev, "failed to get the clock: %s\n",

drivers/hwspinlock/hwspinlock_core.c

@@ -313,7 +313,7 @@ int of_hwspin_lock_get_id(struct device_node *np, int index)
 		hwlock = radix_tree_deref_slot(slot);
 		if (unlikely(!hwlock))
 			continue;
-		if (radix_tree_is_indirect_ptr(hwlock)) {
+		if (radix_tree_deref_retry(hwlock)) {
 			slot = radix_tree_iter_retry(&iter);
 			continue;
 		}

drivers/hwtracing/intel_th/msu.c

@@ -483,7 +483,7 @@ static int msc_configure(struct msc *msc)
 	u32 reg;
 
 	if (msc->mode > MSC_MODE_MULTI)
-		return -ENOTSUPP;
+		return -EINVAL;
 
 	if (msc->mode == MSC_MODE_MULTI)
 		msc_buffer_clear_hw_header(msc);
@@ -935,7 +935,7 @@ static int msc_buffer_alloc(struct msc *msc, unsigned long *nr_pages,
 	} else if (msc->mode == MSC_MODE_MULTI) {
 		ret = msc_buffer_multi_alloc(msc, nr_pages, nr_wins);
 	} else {
-		ret = -ENOTSUPP;
+		ret = -EINVAL;
 	}
 
 	if (!ret) {
@@ -1164,7 +1164,7 @@ static ssize_t intel_th_msc_read(struct file *file, char __user *buf,
 		if (ret >= 0)
 			*ppos = iter->offset;
 	} else {
-		ret = -ENOTSUPP;
+		ret = -EINVAL;
 	}
 
 put_count:

drivers/i2c/busses/i2c-hix5hd2.c

@@ -500,6 +500,7 @@ static int hix5hd2_i2c_remove(struct platform_device *pdev)
 	i2c_del_adapter(&priv->adap);
 	pm_runtime_disable(priv->dev);
 	pm_runtime_set_suspended(priv->dev);
+	clk_disable_unprepare(priv->clk);
 
 	return 0;
 }

drivers/infiniband/ulp/ipoib/ipoib_fs.c

@@ -281,8 +281,6 @@ void ipoib_delete_debug_files(struct net_device *dev)
 {
 	struct ipoib_dev_priv *priv = netdev_priv(dev);
 
-	WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n");
-	WARN_ONCE(!priv->path_dentry, "null path debug file\n");
 	debugfs_remove(priv->mcg_dentry);
 	debugfs_remove(priv->path_dentry);
 	priv->mcg_dentry = priv->path_dentry = NULL;

drivers/media/usb/b2c2/flexcop-usb.c

@@ -481,6 +481,9 @@ static int flexcop_usb_init(struct flexcop_usb *fc_usb)
 		return ret;
 	}
 
+	if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	switch (fc_usb->udev->speed) {
 	case USB_SPEED_LOW:
 		err("cannot handle USB speed because it is too slow.");
@@ -514,9 +517,6 @@ static int flexcop_usb_probe(struct usb_interface *intf,
 	struct flexcop_device *fc = NULL;
 	int ret;
 
-	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
-		return -ENODEV;
-
 	if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
 		err("out of memory\n");
 		return -ENOMEM;

drivers/media/usb/dvb-usb/dib0700_core.c

@@ -783,7 +783,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf)
 
 	/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */
 
-	if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1)
+	if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep + 1)
 		return -ENODEV;
 
 	purb = usb_alloc_urb(0, GFP_KERNEL);
@@ -805,7 +805,7 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf)
 	 * Some devices like the Hauppauge NovaTD model 52009 use an interrupt
 	 * endpoint, while others use a bulk one.
 	 */
-	e = &intf->altsetting[0].endpoint[rc_ep].desc;
+	e = &intf->cur_altsetting->endpoint[rc_ep].desc;
 	if (usb_endpoint_dir_in(e)) {
 		if (usb_endpoint_xfer_bulk(e)) {
 			pipe = usb_rcvbulkpipe(d->udev, rc_ep);

drivers/media/usb/gspca/ov519.c

@@ -3507,6 +3507,11 @@ static void ov511_mode_init_regs(struct sd *sd)
 		return;
 	}
 
+	if (alt->desc.bNumEndpoints < 1) {
+		sd->gspca_dev.usb_err = -ENODEV;
+		return;
+	}
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5);
 
@@ -3632,6 +3637,11 @@ static void ov518_mode_init_regs(struct sd *sd)
 		return;
 	}
 
+	if (alt->desc.bNumEndpoints < 1) {
+		sd->gspca_dev.usb_err = -ENODEV;
+		return;
+	}
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2);
 

drivers/media/usb/gspca/stv06xx/stv06xx.c

@@ -293,6 +293,9 @@ static int stv06xx_start(struct gspca_dev *gspca_dev)
 		return -EIO;
 	}
 
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	err = stv06xx_write_bridge(sd, STV_ISO_SIZE_L, packet_size);
 	if (err < 0)
@@ -317,11 +320,21 @@ static int stv06xx_start(struct gspca_dev *gspca_dev)
 
 static int stv06xx_isoc_init(struct gspca_dev *gspca_dev)
 {
+	struct usb_interface_cache *intfc;
 	struct usb_host_interface *alt;
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	intfc = gspca_dev->dev->actconfig->intf_cache[0];
+
+	if (intfc->num_altsetting < 2)
+		return -ENODEV;
+
+	alt = &intfc->altsetting[1];
+
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	/* Start isoc bandwidth "negotiation" at max isoc bandwidth */
-	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	alt->endpoint[0].desc.wMaxPacketSize =
 		cpu_to_le16(sd->sensor->max_packet_size[gspca_dev->curr_mode]);
 
@@ -334,6 +347,10 @@ static int stv06xx_isoc_nego(struct gspca_dev *gspca_dev)
 	struct usb_host_interface *alt;
 	struct sd *sd = (struct sd *) gspca_dev;
 
+	/*
+	 * Existence of altsetting and endpoint was verified in
+	 * stv06xx_isoc_init()
+	 */
 	alt = &gspca_dev->dev->actconfig->intf_cache[0]->altsetting[1];
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 	min_packet_size = sd->sensor->min_packet_size[gspca_dev->curr_mode];

drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c

@@ -198,6 +198,10 @@ static int pb0100_start(struct sd *sd)
 	alt = usb_altnum_to_altsetting(intf, sd->gspca_dev.alt);
 	if (!alt)
 		return -ENODEV;
+
+	if (alt->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize);
 
 	/* If we don't have enough bandwidth use a lower framerate */