Merge remote-tracking branch 'ALS/kernel.lnx.3.18.r33-rel'

* ALS/kernel.lnx.3.18.r33-rel:
  Linux 3.18.123
  USB: serial: ti_usb_3410_5052: fix array underflow in completion handler
  drm/panel: type promotion bug in s6e8aa0_read_mtp_id()
  ALSA: pcm: Fix snd_interval_refine first/last with open min/max
  rtc: bq4802: add error handling for devm_ioremap
  parport: sunbpp: fix error return code
  ARM: hisi: check of_iomap and fix missing of_node_put
  ARM: hisi: handle of_iomap and fix missing of_node_put
  MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads
  mtdchar: fix overflows in adjustment of `count`
  audit: fix use-after-free in audit_add_watch
  binfmt_elf: Respect error return from `regset->active'
  CIFS: fix wrapping bugs in num_entries()
  cifs: prevent integer overflow in nxt_dir_entry()
  usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()
  USB: yurex: Fix buffer over-read in yurex_write()
  usb: misc: uss720: Fix two sleep-in-atomic-context bugs
  USB: serial: io_ti: fix array underflow in completion handler
  usb: host: u132-hcd: Fix a sleep-in-atomic-context bug in u132_get_frame()
  usb: Avoid use-after-free by flushing endpoints early in usb_set_interface()
  USB: Add quirk to support DJI CineSSD
  usb: Don't die twice if PCI xhci host is not responding in resume
  Tools: hv: Fix a bug in the key delete code
  IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
  xen/netfront: fix waiting for xenbus state change
  pstore: Fix incorrect persistent ram buffer mapping
  RDMA/cma: Protect cma dev list with lock
  platform/x86: toshiba_acpi: Fix defined but not used build warnings
  s390/qeth: reset layer2 attribute on layer switch
  s390/qeth: fix race in used-buffer accounting
  mac80211: restrict delayed tailroom needed decrement
  powerpc/powernv: opal_put_chars partial write fix
  perf powerpc: Fix callchain ip filtering
  fbdev: Distinguish between interlaced and progressive modes
  perf powerpc: Fix callchain ip filtering when return address is in a register
  fbdev/via: fix defined but not used warning
  video: goldfishfb: fix memory leak on driver remove
  fbdev: omapfb: off by one in omapfb_register_client()
  mtd/maps: fix solutionengine.c printk format warnings
  MIPS: ath79: fix system restart
  gfs2: Special-case rindex for gfs2_grow
  xfrm: fix 'passing zero to ERR_PTR()' warning
  ALSA: usb-audio: Fix multiple definitions in AU0828_DEVICE() macro
  ALSA: msnd: Fix the default sample sizes
  mm: get rid of vmacache_flush_all() entirely
  netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user
  xhci: Fix use-after-free in xhci_free_virt_device
  MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON
  f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
  mfd: ti_am335x_tscadc: Fix struct clk memory leak
  partitions/aix: fix usage of uninitialized lv_info and lvname structures
  partitions/aix: append null character to print data from disk
  net: dcb: For wild-card lookups, use priority -1, not 0
  net: mvneta: fix mtu change on port without link
  gpio: ml-ioh: Fix buffer underwrite on probe error path
  x86/mm: Remove in_nmi() warning from vmalloc_fault()
  Bluetooth: hidp: Fix handling of strncpy for hid->name information
  scsi: 3ware: fix return 0 on the error path of probe
  ata: libahci: Correct setting of DEVSLP register
  MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET
  ath10k: prevent active scans on potential unusable channels
  macintosh/via-pmu: Add missing mmio accessors
  tty: rocket: Fix possible buffer overwrite on register_PCI
  uio: potential double frees if __uio_register_device() fails
  md/raid5: fix data corruption of replacements after originals dropped
  scsi: target: fix __transport_register_session locking
  Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV
  staging/rts5208: Fix read overflow in memcpy
  staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page
  kthread: fix boot hang (regression) on MIPS/OpenRISC
  kthread: Fix use-after-free if kthread fork fails
  cfq: Give a chance for arming slice idle timer in case of group_idle
  i2c: xiic: Make the start and the byte count write atomic
  ASoC: wm8994: Fix missing break in switch
  Fixes: Commit 86af955 ("mm: numa: avoid waiting on freed migrated pages")
  enic: do not call enic_change_mtu in enic_probe
  irda: Only insert new objects into the global database via setsockopt
  irda: Fix memory leak caused by repeated binds of irda socket
  kbuild: make missing $DEPMOD a Warning instead of an Error
  debugobjects: Make stack check warning more informative
  btrfs: Don't remove block group that still has pinned down bytes
  btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized
  btrfs: replace: Reset on-disk dev stats value after replace
  powerpc/pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX.
  SMB3: Number of requests sent should be displayed for SMB3 not just CIFS
  smb3: fix reset of bytes read and written stats
  selftests/powerpc: Kill child processes on SIGINT
  staging: comedi: ni_mio_common: fix subdevice flags for PFI subdevice
  dm kcopyd: avoid softlockup in run_complete_job
  PCI: mvebu: Fix I/O space end address calculation
  scsi: aic94xx: fix an error code in aic94xx_init()
  s390/dasd: fix hanging offline processing due to canceled worker
  powerpc: Fix size calculation using resource_size()
  net/9p: fix error path of p9_virtio_probe
  platform/x86: asus-nb-wmi: Add keymap entry for lid flip action on UX360
  mfd: sm501: Set coherent_dma_mask when creating subdevices
  ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()
  mm/fadvise.c: fix signed overflow UBSAN complaint
  scripts: modpost: check memory allocation results
  fat: validate ->i_start before using
  reiserfs: change j_timestamp type to time64_t
  fork: don't copy inconsistent signal handler state to child
  hfs: prevent crash on exit from failed search
  hfsplus: don't return 0 when fill_super() failed
  cifs: check if SMB2 PDU size has been padded and suppress the warning
  ASoC: msm: qdsp6v2: use correct stream id of next session
  msm: mdss: Fix Gamma LUT bounds condition
  msm: kgsl: Add a property to find if secure context is supported
  msm: kgsl: Add a property to find alignment of secure buffers
  ARM: dts: msm: Enable reset via PM_RESIN_N for mdm9650 CV2X
  ARM: dts: msm: Enable use-default-batt-values for apq8009-dragon
  msm: ipa: Validate routing rule id
  net: core: null pointer derefernce in sockev_client_cb
  ASoC: msm: qdsp6v2: Fix rtac memory unmap issue in ASM driver
  netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
  netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets
  ARM: dts: msm: Invert interrupt polarity for K61 on mdm9650 CV2X
  msm:ipa: Prevent NAT table deletion only if public ip is not assigned
  msm: ipa3: Add mutex to prevent race condition
  diag: Prevent out of bound access while initializing msg mask
  ARM: dts: msm: Add wlan naples support to apq8009 dragon refboard
  Revert "rtc: alarm: Add power-on alarm feature"
  ARM: dts: msm: Enable mhi_dev IPC_RTR export for mdm9650 CV2X
  crypto: msm: Fix device stuck issue
  nl80211: nl80211_update_ft_ies to validate NL80211_ATTR_IE
  mmc: sd: limit SD card power limit according to cards capabilities
  ARM: dts: msm: Add QDSD_BOOT_CTL to sdhci node for MSM8953 MTP.
  msm: ais: Fix out-of-bounds read in string class name
  msm:ais:Handling bigger value than upper bound in msm_cpp_irq api
  net: memset smsg to avoid the padding data
  mdss: mdp: Fix fudge factor overflow check
  ARM: dts: msm: Support IPC with PCIe host for mdm9650 EP TTP
  ARM: dts: msm: Enable reset via PM_RESIN_N for mdm9650 PCIe EP TTP
  ASoC: msm: qdsp6v2: align param size of PSPD matrix
  msm: ep_pcie: Apply gpio settings based on the device tree flags
  UPSTREAM: scsi: sg: don't return bogus Sg_requests
  msm: camera: cpp: Check for valid tx level
  ASoC: msm: add new dai link for compress capture for apq8009
  ASoC: msm: qdsp6v2: add routing controls to support compress capture
  ARM: dts: msm: Fix address and size width for common cma node for sdx20
  futex: Replace barrier() in unqueue_me() with READ_ONCE()
  futex: Remove requirement for lock_page() in get_futex_key()
  BACKPORT: futex: Prevent overflow by strengthen input validation
  diag: Allocate DCI memory using vzalloc instead of kzalloc
  defconfig: msm: enable MSM_SYSMON_COMM for 8909
  defconfig: Enable rng driver for msm8909
  msm: ipa: Add WLAN FW SSR event
  msm: camera: Fix for Possible information leak issue
  fbdev: msm: Fix unintialisation of variables
  ASoC: msm: qdsp6v2: update backend name
  power: qpnp-charger: Fix null pointer dereference error

Signed-off-by: Josh Choo <[email protected]>

Makefile

@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 122
+SUBLEVEL = 123
 EXTRAVERSION =
 NAME = Diseased Newt
 

arch/arm/boot/dts/qcom/apq8009-dragon.dtsi

@@ -80,6 +80,33 @@
 		status = "disabled";
 	};
 
+	cnss_sdio: qcom,cnss_sdio {
+		compatible = "qcom,cnss_sdio";
+		subsys-name = "AR6320";
+		/**
+		 * There is no vdd-wlan on board and this is not for DSRC.
+		 * IO and XTAL share the same vreg.
+		 */
+		vdd-wlan-io-supply = <&pm8916_l5>;
+		qcom,wlan-ramdump-dynamic = <0x200000>;
+		qcom,msm-bus,name = "msm-cnss";
+		qcom,msm-bus,num-cases = <4>;
+		qcom,msm-bus,num-paths = <1>;
+		qcom,msm-bus,vectors-KBps =
+				<79 512 0 0>,             /* No vote */
+				<79 512 6250 200000>,     /* 50 Mbps */
+				<79 512 25000 200000>,    /* 200 Mbps */
+				<79 512 2048000 4096000>; /* MAX */
+	};
+
+	qcom,wcnss-wlan@a000000 {
+		status = "disabled";
+	};
+
+	qcom,pronto@a21b000 {
+		status = "disabled";
+	};
+
 	bluetooth: bt_qca9379 {
 		compatible = "qca,qca9379";
 		qca,bt-reset-gpio = <&msm_gpio 47 0>; /* BT_EN */
@@ -105,8 +132,62 @@
 	};
 };
 
+&msm_gpio {
+	sdc2_wlan_gpio_on: sdc2_wlan_gpio_on {
+		mux {
+			pins = "gpio43";
+			function = "gpio";
+		};
+		config {
+			pins = "gpio43";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+	};
+
+	sdc2_wlan_gpio_off: sdc2_wlan_gpio_off {
+		mux {
+			pins = "gpio43";
+			function = "gpio";
+		};
+		config {
+			pins = "gpio43";
+			drive-strength = <2>;
+			bias-disable;
+			output-low;
+		};
+	};
+};
+
 &sdhc_2 {
-	status = "disabled";
+	/delete-property/cd-gpios;
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_2>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 125 0>,
+			<1 &intc 0 221 0>,
+			<2 &msm_gpio 40 0x1>;
+	interrupt-names = "hc_irq", "pwr_irq", "sdiowakeup_irq";
+
+	qcom,vdd-voltage-level = <1800000 2950000>;
+	qcom,vdd-current-level = <15000 400000>;
+
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+	qcom,vdd-io-current-level = <200 50000>;
+	qcom,clk-rates = <400000 25000000 50000000 100000000 200000000>;
+	qcom,bus-speed-mode = "SDR12", "SDR25", "SDR50", "DDR50", "SDR104";
+
+	pinctrl-names = "active", "sleep";
+	pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on
+			&sdc2_wlan_gpio_on>;
+	pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off
+			&sdc2_wlan_gpio_off>;
+	qcom,nonremovable;
+	qcom,core_3_0v_support;
+	status = "ok";
 };
 
 &usb_otg {
@@ -164,3 +245,10 @@
 	status = "ok";
 	qcom,disable-bms;
 };
+
+&pm8916_chg {
+	status = "ok";
+	qcom,charging-disabled;
+	qcom,use-default-batt-values;
+};
+

arch/arm/boot/dts/qcom/mdm9650-cv2x.dtsi

@@ -56,6 +56,15 @@
 	pps {
 		use-system-time-ts;
 	};
+
+	qcom,ipc_router_external_ap_xprt {
+		compatible = "qcom,ipc-router-mhi-dev-xprt";
+		qcom,out-chan-id = <20>;
+		qcom,in-chan-id = <21>;
+		qcom,xprt-remote = "external-ap";
+		qcom,xprt-linkid = <2>;
+		qcom,xprt-version = <1>;
+	};
 };
 
 &cnss_pcie {
@@ -97,7 +106,7 @@
 		spi-max-frequency = <4800000>;
 		reg = <0>;
 		interrupt-parent = <&tlmm_pinmux>;
-		interrupts = <68 0>;
+		interrupts = <68 IRQ_TYPE_EDGE_RISING>;
 		reset-gpio = <&tlmm_pinmux 89 GPIO_ACTIVE_LOW>;
 		pinctrl-names = "active", "sleep";
 		pinctrl-0 = <&can_rst_on>;
@@ -321,3 +330,18 @@
 		qcom,vadc-thermal-node;
 	};
 };
+
+&pmd9650_pon {
+	interrupts = <0x0 0x8 0x0>, <0x0 0x8 0x1>;
+	interrupt-names = "kpdpwr", "resin";
+	qcom,s3-src = "resin";
+
+	qcom,pon_2 {
+		qcom,pon-type = <1>;
+		qcom,support-reset = <1>;
+		qcom,s1-timer = <0>;
+		qcom,s2-timer = <2000>;
+		qcom,s2-type = <7>;
+		qcom,pull-up = <1>;
+	};
+};

arch/arm/boot/dts/qcom/mdm9650-pcie-ep-ttp.dts

@@ -13,7 +13,9 @@
 
 /dts-v1/;
 
+#include <dt-bindings/gpio/gpio.h>
 #include "mdm9650-v1.1-mtp.dtsi"
+
 / {
 	model = "Qualcomm Technologies, Inc. MDM 9650 PCIE EP TTP";
 	compatible = "qcom,mdm9650-ttp", "qcom,mdm9650", "qcom,ttp";
@@ -165,7 +167,8 @@
 
 &pcie_ep {
 	status = "ok";
-	mdm2apstatus-gpio = <&tlmm_pinmux 85 0>;
+	mdm2apstatus-gpio = <&tlmm_pinmux 64 GPIO_ACTIVE_LOW>;
+	clkreq-gpio = <&tlmm_pinmux 85 0>;
 };
 
 &pcie0 {
@@ -182,13 +185,40 @@
 
 &pcie0_mdm2apstatus_default {
 	mux {
-		pins = "gpio85";
+		pins = "gpio64";
 		function = "gpio";
 	};
 
+	config {
+		pins = "gpio64";
+		drive-strength = <2>;
+		bias-pull-up;
+	};
+};
+
+&pcie0_clkreq_default {
+	mux {
+		pins = "gpio85";
+		function = "gpio";
+	};
 	config {
 		pins = "gpio85";
 		drive-strength = <2>;
-		bias-pull-down;
+		bias-pull-up;
+	};
+};
+
+&pmd9650_pon {
+	interrupts = <0x0 0x8 0x0>, <0x0 0x8 0x1>;
+	interrupt-names = "kpdpwr", "resin";
+	qcom,s3-src = "resin";
+
+	qcom,pon_2 {
+		qcom,pon-type = <1>;
+		qcom,support-reset = <1>;
+		qcom,s1-timer = <0>;
+		qcom,s2-timer = <2000>;
+		qcom,s2-type = <7>;
+		qcom,pull-up = <1>;
 	};
 };

arch/arm/boot/dts/qcom/msm8953.dtsi

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -1772,8 +1772,10 @@
 
 	sdhc_1: sdhci@7824900 {
 		compatible = "qcom,sdhci-msm";
-		reg = <0x7824900 0x500>, <0x7824000 0x800>, <0x7824e00 0x200>;
-		reg-names = "hc_mem", "core_mem", "cmdq_mem";
+		reg = <0x7824900 0x500>, <0x7824000 0x800>, <0x7824e00 0x200>,
+				<0x0119d000 0x4>;
+		reg-names = "hc_mem", "core_mem", "cmdq_mem",
+				"tlmm_mem";
 
 		interrupts = <0 123 0>, <0 138 0>;
 		interrupt-names = "hc_irq", "pwr_irq";

arch/arm/boot/dts/qcom/sdx20.dtsi

@@ -42,10 +42,10 @@
 &reserved_mem {
 	linux,cma {
 		compatible = "shared-dma-pool";
-		alloc-ranges = <0 0x00000000 0 0x90000000>;
+		alloc-ranges = <0 0x90000000>;
 		reusable;
-		alignment = <0 0x400000>;
-		size = <0 0xc00000>;
+		alignment = <0x400000>;
+		size = <0xc00000>;
 		linux,cma-default;
 	};
 };

arch/arm/configs/msm8909-perf_defconfig

@@ -316,6 +316,7 @@ CONFIG_SERIAL_MSM_HS=y
 CONFIG_SERIAL_MSM_SMD=y
 CONFIG_DIAG_CHAR=y
 CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_MSM_LEGACY=y
 CONFIG_MSM_SMD_PKT=y
 CONFIG_MSM_ADSPRPC=y
 CONFIG_I2C_CHARDEV=y
@@ -484,6 +485,7 @@ CONFIG_MSM_QMI_INTERFACE=y
 CONFIG_MSM_IPC_ROUTER_SMD_XPRT=y
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_MSM_SUBSYSTEM_RESTART=y
+CONFIG_MSM_SYSMON_COMM=y
 CONFIG_MSM_PIL=y
 CONFIG_MSM_PIL_SSR_GENERIC=y
 CONFIG_MSM_PIL_MSS_QDSP6V5=y

arch/arm/configs/msm8909_defconfig

@@ -495,6 +495,7 @@ CONFIG_MSM_QMI_INTERFACE=y
 CONFIG_MSM_IPC_ROUTER_SMD_XPRT=y
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_MSM_SUBSYSTEM_RESTART=y
+CONFIG_MSM_SYSMON_COMM=y
 CONFIG_MSM_PIL=y
 CONFIG_MSM_PIL_SSR_GENERIC=y
 CONFIG_MSM_PIL_MSS_QDSP6V5=y

arch/arm/mach-hisi/hotplug.c

@@ -145,13 +145,20 @@ static int hi3xxx_hotplug_init(void)
 	struct device_node *node;
 
 	node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl");
-	if (node) {
-		ctrl_base = of_iomap(node, 0);
-		id = HI3620_CTRL;
-		return 0;
+	if (!node) {
+		id = ERROR_CTRL;
+		return -ENOENT;
 	}
-	id = ERROR_CTRL;
-	return -ENOENT;
+
+	ctrl_base = of_iomap(node, 0);
+	of_node_put(node);
+	if (!ctrl_base) {
+		id = ERROR_CTRL;
+		return -ENOMEM;
+	}
+
+	id = HI3620_CTRL;
+	return 0;
 }
 
 void hi3xxx_set_cpu(int cpu, bool enable)
@@ -170,11 +177,15 @@ static bool hix5hd2_hotplug_init(void)
 	struct device_node *np;
 
 	np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl");
-	if (np) {
-		ctrl_base = of_iomap(np, 0);
-		return true;
-	}
-	return false;
+	if (!np)
+		return false;
+
+	ctrl_base = of_iomap(np, 0);
+	of_node_put(np);
+	if (!ctrl_base)
+		return false;
+
+	return true;
 }
 
 void hix5hd2_set_cpu(int cpu, bool enable)

arch/mips/ath79/setup.c

@@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN];
 
 static void ath79_restart(char *command)
 {
+	local_irq_disable();
 	ath79_device_reset_set(AR71XX_RESET_FULL_CHIP);
 	for (;;)
 		if (cpu_wait)

arch/mips/include/asm/io.h

@@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address)
 /*
  * ISA I/O bus memory addresses are 1:1 with the physical address.
  */
-static inline unsigned long isa_virt_to_bus(volatile void * address)
+static inline unsigned long isa_virt_to_bus(volatile void *address)
 {
-	return (unsigned long)address - PAGE_OFFSET;
+	return virt_to_phys(address);
 }
 
-static inline void * isa_bus_to_virt(unsigned long address)
+static inline void *isa_bus_to_virt(unsigned long address)
 {
-	return (void *)(address + PAGE_OFFSET);
+	return phys_to_virt(address);
 }
 
 #define isa_page_to_bus page_to_phys

arch/mips/include/asm/mach-ath79/ath79.h

@@ -132,6 +132,7 @@ static inline u32 ath79_pll_rr(unsigned reg)
 static inline void ath79_reset_wr(unsigned reg, u32 val)
 {
 	__raw_writel(val, ath79_reset_base + reg);
+	(void) __raw_readl(ath79_reset_base + reg); /* flush */
 }
 
 static inline u32 ath79_reset_rr(unsigned reg)

arch/mips/kernel/process.c

@@ -87,7 +87,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
 	struct thread_info *ti = task_thread_info(p);
 	struct pt_regs *childregs, *regs = current_pt_regs();
 	unsigned long childksp;
-	p->set_child_tid = p->clear_child_tid = NULL;
 
 	childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
 

arch/mips/loongson/common/cs5536/cs5536_ohci.c

@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg)
 		break;
 	case PCI_OHCI_INT_REG:
 		_rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo);
-		if ((lo & 0x00000f00) == CS5536_USB_INTR)
+		if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR)
 			conf_data = 1;
 		break;
 	default: