Merge 4.9.55 into android-4.9

Changes in 4.9.55
	USB: gadgetfs: Fix crash caused by inadequate synchronization
	USB: gadgetfs: fix copy_to_user while holding spinlock
	usb: gadget: udc: atmel: set vbus irqflags explicitly
	usb: gadget: udc: renesas_usb3: fix for no-data control transfer
	usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
	usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
	usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
	usb-storage: fix bogus hardware error messages for ATA pass-thru devices
	usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
	usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
	ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
	usb: pci-quirks.c: Corrected timeout values used in handshake
	USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
	USB: dummy-hcd: fix connection failures (wrong speed)
	USB: dummy-hcd: fix infinite-loop resubmission bug
	USB: dummy-hcd: Fix erroneous synchronization change
	USB: devio: Don't corrupt user memory
	usb: gadget: mass_storage: set msg_registered after msg registered
	USB: g_mass_storage: Fix deadlock when driver is unbound
	USB: uas: fix bug in handling of alternate settings
	USB: core: harden cdc_parse_cdc_header
	usb: Increase quirk delay for USB devices
	USB: fix out-of-bounds in usb_set_configuration
	xhci: fix finding correct bus_state structure for USB 3.1 hosts
	xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
	xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
	Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
	iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
	iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
	iio: ad_sigma_delta: Implement a dedicated reset function
	staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
	iio: core: Return error for failed read_reg
	IIO: BME280: Updates to Humidity readings need ctrl_reg write!
	iio: ad7793: Fix the serial interface reset
	iio: adc: mcp320x: Fix readout of negative voltages
	iio: adc: mcp320x: Fix oops on module unload
	uwb: properly check kthread_run return value
	uwb: ensure that endpoint is interrupt
	staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
	mm, oom_reaper: skip mm structs with mmu notifiers
	lib/ratelimit.c: use deferred printk() version
	lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
	ALSA: compress: Remove unused variable
	Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
	ALSA: usx2y: Suppress kernel warning at page allocation failures
	mlxsw: spectrum: Prevent mirred-related crash on removal
	net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
	sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
	tcp: update skb->skb_mstamp more carefully
	bpf/verifier: reject BPF_ALU64|BPF_END
	tcp: fix data delivery rate
	udpv6: Fix the checksum computation when HW checksum does not apply
	ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
	net: phy: Fix mask value write on gmii2rgmii converter speed register
	ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
	net/sched: cls_matchall: fix crash when used with classful qdisc
	tcp: fastopen: fix on syn-data transmit failure
	net: emac: Fix napi poll list corruption
	packet: hold bind lock when rebinding to fanout hook
	bpf: one perf event close won't free bpf program attached by another perf event
	isdn/i4l: fetch the ppp_write buffer in one shot
	net_sched: always reset qdisc backlog in qdisc_reset()
	net: qcom/emac: specify the correct size when mapping a DMA buffer
	vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
	l2tp: Avoid schedule while atomic in exit_net
	l2tp: fix race condition in l2tp_tunnel_delete
	tun: bail out from tun_get_user() if the skb is empty
	net: dsa: Fix network device registration order
	packet: in packet_do_bind, test fanout with bind_lock held
	packet: only test po->has_vnet_hdr once in packet_snd
	net: Set sk_prot_creator when cloning sockets to the right proto
	netlink: do not proceed if dump's start() errs
	ip6_gre: ip6gre_tap device should keep dst
	ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
	tipc: use only positive error codes in messages
	net: rtnetlink: fix info leak in RTM_GETSTATS call
	socket, bpf: fix possible use after free
	powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
	powerpc/tm: Fix illegal TM state in signal handler
	percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
	driver core: platform: Don't read past the end of "driver_override" buffer
	Drivers: hv: fcopy: restore correct transfer length
	stm class: Fix a use-after-free
	ftrace: Fix kmemleak in unregister_ftrace_graph
	HID: i2c-hid: allocate hid buffers for real worst case
	HID: wacom: leds: Don't try to control the EKR's read-only LEDs
	HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
	HID: wacom: bits shifted too much for 9th and 10th buttons
	rocker: fix rocker_tlv_put_* functions for KASAN
	netlink: fix nla_put_{u8,u16,u32} for KASAN
	iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
	iwlwifi: add workaround to disable wide channels in 5GHz
	scsi: sd: Do not override max_sectors_kb sysfs setting
	brcmfmac: add length check in brcmf_cfg80211_escan_handler()
	brcmfmac: setup passive scan if requested by user-space
	drm/i915/bios: ignore HDMI on port A
	nvme-pci: Use PCI bus address for data/queues in CMB
	mmc: core: add driver strength selection when selecting hs400es
	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
	vfs: deny copy_file_range() for non regular files
	ext4: fix data corruption for mmap writes
	ext4: Don't clear SGID when inheriting ACLs
	ext4: don't allow encrypted operations without keys
	f2fs: don't allow encrypted operations without keys
	KVM: x86: fix singlestepping over syscall
	Linux 4.9.55

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

3 files changed, 10 insertions, 4 deletions

diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 8008e06b7efe..865e7c262322 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -604,7 +604,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size)
 {
 	/* the worst case is computed from the set_report command with a
 	 * reportID > 15 and the maximum report length */
-	int args_len = sizeof(__u8) + /* optional ReportID byte */
+	int args_len = sizeof(__u8) + /* ReportID */
+		       sizeof(__u8) + /* optional ReportID byte */
 		       sizeof(__u16) + /* data register */
 		       sizeof(__u16) + /* size of the report */
 		       report_size; /* report */
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 53ac19b3727a..d72dfb2bbdb8 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -611,8 +611,10 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev)
 
 	/* Try to find an already-probed interface from the same device */
 	list_for_each_entry(data, &wacom_udev_list, list) {
-		if (compare_device_paths(hdev, data->dev, '/'))
+		if (compare_device_paths(hdev, data->dev, '/')) {
+			kref_get(&data->kref);
 			return data;
+		}
 	}
 
 	/* Fallback to finding devices that appear to be "siblings" */
@@ -712,6 +714,9 @@ static int wacom_led_control(struct wacom *wacom)
 	if (!wacom->led.groups)
 		return -ENOTSUPP;
 
+	if (wacom->wacom_wac.features.type == REMOTE)
+		return -ENOTSUPP;
+
 	if (wacom->wacom_wac.pid) { /* wireless connected */
 		report_id = WAC_CMD_WL_LED_CONTROL;
 		buf_size = 13;
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index c6a922ee5d3b..db951c4fd6dd 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -559,8 +559,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom)
 				keys = data[9] & 0x07;
 			}
 		} else {
-			buttons = ((data[6] & 0x10) << 10) |
-			          ((data[5] & 0x10) << 9)  |
+			buttons = ((data[6] & 0x10) << 5)  |
+			          ((data[5] & 0x10) << 4)  |
 			          ((data[6] & 0x0F) << 4)  |
 			          (data[5] & 0x0F);
 		}