Merge android-4.4@73a2b70 (v4.4.92) into msm-4.4

* refs/heads/tmp-73a2b70
  Linux 4.4.92
  ext4: don't allow encrypted operations without keys
  ext4: Don't clear SGID when inheriting ACLs
  ext4: fix data corruption for mmap writes
  sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
  nvme: protect against simultaneous shutdown invocations
  drm/i915/bios: ignore HDMI on port A
  brcmfmac: setup passive scan if requested by user-space
  uwb: ensure that endpoint is interrupt
  uwb: properly check kthread_run return value
  iio: adc: mcp320x: Fix oops on module unload
  iio: adc: mcp320x: Fix readout of negative voltages
  iio: ad7793: Fix the serial interface reset
  iio: core: Return error for failed read_reg
  staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
  iio: ad_sigma_delta: Implement a dedicated reset function
  iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
  iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
  xhci: fix finding correct bus_state structure for USB 3.1 hosts
  USB: fix out-of-bounds in usb_set_configuration
  usb: Increase quirk delay for USB devices
  USB: core: harden cdc_parse_cdc_header
  USB: uas: fix bug in handling of alternate settings
  scsi: sd: Do not override max_sectors_kb sysfs setting
  iwlwifi: add workaround to disable wide channels in 5GHz
  HID: i2c-hid: allocate hid buffers for real worst case
  ftrace: Fix kmemleak in unregister_ftrace_graph
  stm class: Fix a use-after-free
  Drivers: hv: fcopy: restore correct transfer length
  driver core: platform: Don't read past the end of "driver_override" buffer
  ALSA: usx2y: Suppress kernel warning at page allocation failures
  ALSA: compress: Remove unused variable
  lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
  USB: g_mass_storage: Fix deadlock when driver is unbound
  usb: gadget: mass_storage: set msg_registered after msg registered
  USB: devio: Don't corrupt user memory
  USB: dummy-hcd: Fix erroneous synchronization change
  USB: dummy-hcd: fix infinite-loop resubmission bug
  USB: dummy-hcd: fix connection failures (wrong speed)
  usb: pci-quirks.c: Corrected timeout values used in handshake
  ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
  usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
  usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
  usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
  usb: gadget: udc: atmel: set vbus irqflags explicitly
  USB: gadgetfs: fix copy_to_user while holding spinlock
  USB: gadgetfs: Fix crash caused by inadequate synchronization
  usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write
  ANDROID: binder: init desired_prio.sched_policy before use it
  BACKPORT: net: xfrm: support setting an output mark.
  UPSTREAM: xfrm: Only add l3mdev oif to dst lookups
  UPSTREAM: net: l3mdev: Add master device lookup by index
  Linux 4.4.91
  ttpci: address stringop overflow warning
  ALSA: au88x0: avoid theoretical uninitialized access
  ARM: remove duplicate 'const' annotations'
  IB/qib: fix false-postive maybe-uninitialized warning
  drivers: firmware: psci: drop duplicate const from psci_of_match
  libata: transport: Remove circular dependency at free time
  xfs: remove kmem_zalloc_greedy
  i2c: meson: fix wrong variable usage in meson_i2c_put_data
  md/raid10: submit bio directly to replacement disk
  rds: ib: add error handle
  iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
  parisc: perf: Fix potential NULL pointer dereference
  netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
  exynos-gsc: Do not swap cb/cr for semi planar formats
  MIPS: IRQ Stack: Unwind IRQ stack onto task stack
  netfilter: invoke synchronize_rcu after set the _hook_ to NULL
  bridge: netlink: register netdevice before executing changelink
  mmc: sdio: fix alignment issue in struct sdio_func
  usb: plusb: Add support for PL-27A1
  team: fix memory leaks
  net/packet: check length in getsockopt() called with PACKET_HDRLEN
  net: core: Prevent from dereferencing null pointer when releasing SKB
  MIPS: Lantiq: Fix another request_mem_region() return code check
  ASoC: dapm: fix some pointer error handling
  usb: chipidea: vbus event may exist before starting gadget
  audit: log 32-bit socketcalls
  ASoC: dapm: handle probe deferrals
  partitions/efi: Fix integer overflow in GPT size calculation
  USB: serial: mos7840: fix control-message error handling
  USB: serial: mos7720: fix control-message error handling
  drm/amdkfd: fix improper return value on error
  IB/ipoib: Replace list_del of the neigh->list with list_del_init
  IB/ipoib: rtnl_unlock can not come after free_netdev
  IB/ipoib: Fix deadlock over vlan_mutex
  tty: goldfish: Fix a parameter of a call to free_irq
  ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
  iio: adc: hx711: Add DT binding for avia,hx711
  iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
  hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
  sh_eth: use correct name for ECMR_MPDE bit
  extcon: axp288: Use vbus-valid instead of -present to determine cable presence
  igb: re-assign hw address pointer on reset after PCI error
  MIPS: ralink: Fix incorrect assignment on ralink_soc
  MIPS: Ensure bss section ends on a long-aligned address
  ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
  RDS: RDMA: Fix the composite message user notification
  GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
  drm: bridge: add DT bindings for TI ths8135
  drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
  FROMLIST: tracing: Add support for preempt and irq enable/disable events
  FROMLIST: tracing: Prepare to add preempt and irq trace events
  ANDROID: binder: fix transaction leak.
  ANDROID: binder: Add tracing for binder priority inheritance.
  Linux 4.4.90
  fix xen_swiotlb_dma_mmap prototype
  swiotlb-xen: implement xen_swiotlb_dma_mmap callback
  video: fbdev: aty: do not leak uninitialized padding in clk to userspace
  KVM: VMX: use cmpxchg64
  ARM: pxa: fix the number of DMA requestor lines
  ARM: pxa: add the number of DMA requestor lines
  dmaengine: mmp-pdma: add number of requestors
  cxl: Fix driver use count
  KVM: VMX: remove WARN_ON_ONCE in kvm_vcpu_trigger_posted_interrupt
  KVM: VMX: do not change SN bit in vmx_update_pi_irte()
  timer/sysclt: Restrict timer migration sysctl values to 0 and 1
  gfs2: Fix debugfs glocks dump
  x86/fpu: Don't let userspace set bogus xcomp_bv
  btrfs: prevent to set invalid default subvolid
  btrfs: propagate error to btrfs_cmp_data_prepare caller
  btrfs: fix NULL pointer dereference from free_reloc_roots()
  PCI: Fix race condition with driver_override
  kvm: nVMX: Don't allow L2 to access the hardware CR8
  KVM: VMX: Do not BUG() on out-of-bounds guest IRQ
  arm64: fault: Route pte translation faults via do_translation_fault
  arm64: Make sure SPsel is always set
  seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()
  bsg-lib: don't free job in bsg_prepare_job
  nl80211: check for the required netlink attributes presence
  vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets
  SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags
  SMB: Validate negotiate (to protect against downgrade) even if signing off
  Fix SMB3.1.1 guest authentication to Samba
  powerpc/pseries: Fix parent_dn reference leak in add_dt_node()
  KEYS: prevent KEYCTL_READ on negative key
  KEYS: prevent creating a different user's keyrings
  KEYS: fix writing past end of user-supplied buffer in keyring_read()
  crypto: talitos - fix sha224
  crypto: talitos - Don't provide setkey for non hmac hashing algs.
  scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly
  md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list
  md/raid5: fix a race condition in stripe batch
  tracing: Erase irqsoff trace with empty write
  tracing: Fix trace_pipe behavior for instance traces
  KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce()
  mac80211: flush hw_roc_start work before cancelling the ROC
  cifs: release auth_key.response for reconnect.
  f2fs: catch up to v4.14-rc1
  UPSTREAM: cpufreq: schedutil: use now as reference when aggregating shared policy requests
  ANDROID: add script to fetch android kernel config fragments
  f2fs: reorganize stat information
  f2fs: clean up flush/discard command namings
  f2fs: check in-memory sit version bitmap
  f2fs: check in-memory nat version bitmap
  f2fs: check in-memory block bitmap
  f2fs: introduce FI_ATOMIC_COMMIT
  f2fs: clean up with list_{first, last}_entry
  f2fs: return fs_trim if there is no candidate
  f2fs: avoid needless checkpoint in f2fs_trim_fs
  f2fs: relax async discard commands more
  f2fs: drop exist_data for inline_data when truncated to 0
  f2fs: don't allow encrypted operations without keys
  f2fs: show the max number of atomic operations
  f2fs: get io size bit from mount option
  f2fs: support IO alignment for DATA and NODE writes
  f2fs: add submit_bio tracepoint
  f2fs: reassign new segment for mode=lfs
  f2fs: fix a missing discard prefree segments
  f2fs: use rb_entry_safe
  f2fs: add a case of no need to read a page in write begin
  f2fs: fix a problem of using memory after free
  f2fs: remove unneeded condition
  f2fs: don't cache nat entry if out of memory
  f2fs: remove unused values in recover_fsync_data
  f2fs: support async discard based on v4.9
  f2fs: resolve op and op_flags confilcts
  f2fs: remove wrong backported codes
  FROMLIST: binder: fix use-after-free in binder_transaction()
  UPSTREAM: ipv6: fib: Unlink replaced routes from their nodes

Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Conflicts:
	fs/f2fs/crypto_key.c
	fs/f2fs/f2fs_crypto.h
	net/wireless/nl80211.c
	sound/usb/card.c

Change-Id: I742aeaec84c7892165976b7bea3e07bdd6881d93
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

diff --cc Documentation/devicetree/bindings/vendor-prefixes.txt
Simple merge

diff --cc Makefile
Simple merge

diff --cc arch/arm64/kernel/head.S
Simple merge

diff --cc arch/arm64/mm/fault.c
Simple merge

diff --cc drivers/android/binder.c
Simple merge

diff --cc drivers/base/platform.c
Simple merge

diff --cc drivers/firmware/psci.c
Simple merge

diff --cc drivers/hwtracing/stm/core.c
Simple merge

diff --cc drivers/iommu/io-pgtable-arm.c
Simple merge

diff --cc drivers/md/raid10.c
Simple merge

diff --cc drivers/md/raid5.c
Simple merge

diff --cc drivers/scsi/sd.c
Simple merge

diff --cc drivers/usb/core/config.c
Simple merge

diff --cc drivers/usb/core/hub.c
Simple merge

diff --cc drivers/usb/gadget/function/f_mass_storage.c
Simple merge

diff --cc drivers/usb/host/xhci.h
Simple merge

diff --cc fs/ext4/inode.c
Simple merge

diff --cc fs/ext4/namei.c
Simple merge

diff --cc include/uapi/drm/drm_fourcc.h
Simple merge

diff --cc include/uapi/linux/usb/ch9.h
Simple merge

diff --cc kernel/cpuset.c
Simple merge

diff --cc kernel/sched/core.c
Simple merge

diff --cc kernel/sysctl.c
Simple merge

diff --cc kernel/time/timer.c
Simple merge

diff --cc kernel/trace/Kconfig
Simple merge

diff --cc kernel/trace/Makefile
Simple merge

diff --cc kernel/trace/trace.c
Simple merge

diff --cc net/core/dev.c
Simple merge

diff --cc sound/core/compress_offload.c
Simple merge

diff --cc sound/soc/soc-dapm.c
Simple merge

diff --cc sound/usb/card.c
index 23ea575,83336bb..8609653
--- 1/sound/usb/card.c
--- 2/sound/usb/card.c
+++ b/sound/usb/card.c
@@@ -314,17 -249,13 +314,33 @@@ static int snd_usb_create_streams(struc
                /* fall through */
  
        case UAC_VERSION_1: {
 -              struct uac1_ac_header_descriptor *h1 = control_header;
 +              void *control_header;
 +              struct uac1_ac_header_descriptor *h1;
++              int rest_bytes;
 +
 +              control_header = snd_usb_find_csint_desc(host_iface->extra,
 +                                      host_iface->extralen, NULL, UAC_HEADER);
 +              if (!control_header) {
 +                      dev_err(&dev->dev, "cannot find UAC_HEADER\n");
 +                      return -EINVAL;
 +              }
 +
++              rest_bytes = (void *)(host_iface->extra + host_iface->extralen) -
++                      control_header;
++
++              /* just to be sure -- this shouldn't hit at all */
++              if (rest_bytes <= 0) {
++                      dev_err(&dev->dev, "invalid control header\n");
++                      return -EINVAL;
++              }
++
 +              h1 = control_header;
+ 
+               if (rest_bytes < sizeof(*h1)) {
+                       dev_err(&dev->dev, "too short v1 buffer descriptor\n");
+                       return -EINVAL;
+               }
+ 
                if (!h1->bInCollection) {
                        dev_info(&dev->dev, "skipping empty audio interface (v1)\n");
                        return -EINVAL;