Merge 4.9.103 into android-4.9

Changes in 4.9.103
	net/mlx4_core: Fix error handling in mlx4_init_port_info.
	net: test tailroom before appending to linear skb
	packet: in packet_snd start writing at link layer allocation
	sock_diag: fix use-after-free read in __sk_free
	tcp: purge write queue in tcp_connect_init()
	vmxnet3: set the DMA mask before the first DMA map operation
	vmxnet3: use DMA memory barriers where required
	ext2: fix a block leak
	s390: add assembler macros for CPU alternatives
	s390: move expoline assembler macros to a header
	s390/crc32-vx: use expoline for indirect branches
	s390/lib: use expoline for indirect branches
	s390/ftrace: use expoline for indirect branches
	s390/kernel: use expoline for indirect branches
	s390: move spectre sysfs attribute code
	s390: extend expoline to BC instructions
	s390: use expoline thunks in the BPF JIT
	scsi: libsas: defer ata device eh commands to libata
	scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()
	scsi: zfcp: fix infinite iteration on ERP ready list
	cfg80211: limit wiphy names to 128 bytes
	hfsplus: stop workqueue when fill_super() failed
	x86/kexec: Avoid double free_page() upon do_kexec_load() failure
	usb: gadget: f_uac2: fix bFirstInterface in composite gadget
	usb: dwc3: Undo PHY init if soft reset fails
	usb: dwc3: omap: don't miss events during suspend/resume
	usb: gadget: core: Fix use-after-free of usb_request
	usb: gadget: fsl_udc_core: fix ep valid checks
	usb: dwc2: Fix dwc2_hsotg_core_init_disconnected()
	usb: cdc_acm: prevent race at write to acm while system resumes
	USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM
	net/usb/qmi_wwan.c: Add USB id for lt4120 modem
	net-usb: add qmi_wwan if on lte modem wistron neweb d18q1
	Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB
	ALSA: usb-audio: Add native DSD support for Luxman DA-06
	usb: dwc3: Add SoftReset PHY synchonization delay
	usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields
	xhci: zero usb device slot_id member when disabling and freeing a xhci slot
	usb: dwc2: Fix interval type issue
	usb: dwc2: host: Fix transaction errors in host mode
	usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS
	usb: gadget: ffs: Execute copy_to_user() with USER_DS set
	usb: gadget: udc: change comparison to bitshift when dealing with a mask
	usb: gadget: composite: fix incorrect handling of OS desc requests
	media: em28xx: USB bulk packet size fix
	Bluetooth: btusb: Add device ID for RTL8822BE
	staging: lustre: fix bug in osc_enter_cache_try
	staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr
	staging: lustre: lmv: correctly iput lmo_root
	crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss
	scsi: fas216: fix sense buffer initialization
	scsi: ufs: Enable quirk to ignore sending WRITE_SAME command
	scsi: bnx2fc: Fix check in SCSI completion handler for timed out request
	scsi: sym53c8xx_2: iterator underflow in sym_getsync()
	scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
	scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
	scsi: storvsc: Increase cmd_per_lun for higher speed devices
	scsi: aacraid: fix shutdown crash when init fails
	scsi: qla4xxx: skip error recovery in case of register disconnect.
	scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM
	scsi: sd: Keep disk read-only when re-reading partition
	scsi: aacraid: Insure command thread is not recursively stopped
	scsi: mvsas: fix wrong endianness of sgpio api
	scsi: lpfc: Fix issue_lip if link is disabled
	scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
	scsi: lpfc: Fix frequency of Release WQE CQEs
	ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read()
	ASoC: topology: create TLV data for dapm widgets
	ASoC: samsung: i2s: Ensure the RCLK rate is properly determined
	clk: rockchip: Fix wrong parent for SDMMC phase clock for rk3228
	clk: Don't show the incorrect clock phase
	clk: tegra: Fix pll_u rate configuration
	media: cx23885: Set subdev host data to clk_freq pointer
	clk: rockchip: Prevent calculating mmc phase if clock rate is zero
	clk: samsung: s3c2410: Fix PLL rates
	clk: samsung: exynos7: Fix PLL rates
	clk: samsung: exynos5260: Fix PLL rates
	clk: samsung: exynos5433: Fix PLL rates
	clk: samsung: exynos5250: Fix PLL rates
	clk: samsung: exynos3250: Fix PLL rates
	media: dmxdev: fix error code for invalid ioctls
	media: cx23885: Override 888 ImpactVCBe crystal frequency
	media: s3c-camif: fix out-of-bounds array access
	media: vb2: Fix videobuf2 to map correct area
	media: vivid: fix incorrect capabilities for radio
	media: cx25821: prevent out-of-bounds read on array card
	serial: xuartps: Fix out-of-bounds access through DT alias
	serial: samsung: Fix out-of-bounds access through serial port index
	serial: mxs-auart: Fix out-of-bounds access through serial port index
	serial: imx: Fix out-of-bounds access through serial port index
	serial: fsl_lpuart: Fix out-of-bounds access through DT alias
	serial: arc_uart: Fix out-of-bounds access through DT alias
	serial: 8250: Don't service RX FIFO if interrupts are disabled
	rtc: snvs: Fix usage of snvs_rtc_enable
	rtc: hctosys: Ensure system time doesn't overflow time_t
	rtc: tx4939: avoid unintended sign extension on a 24 bit shift
	Linux 4.9.103

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

3 files changed, 20 insertions, 6 deletions

diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c
index e1cfa06810ef..e79f2a181ad2 100644
--- a/drivers/rtc/hctosys.c
+++ b/drivers/rtc/hctosys.c
@@ -49,6 +49,11 @@ static int __init rtc_hctosys(void)
 
 	tv64.tv_sec = rtc_tm_to_time64(&tm);
 
+#if BITS_PER_LONG == 32
+	if (tv64.tv_sec > INT_MAX)
+		goto err_read;
+#endif
+
 	err = do_settimeofday64(&tv64);
 
 	dev_info(rtc->dev.parent,
diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
index a753ef9c1459..3e8fd33c2576 100644
--- a/drivers/rtc/rtc-snvs.c
+++ b/drivers/rtc/rtc-snvs.c
@@ -132,20 +132,23 @@ static int snvs_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
 	struct snvs_rtc_data *data = dev_get_drvdata(dev);
 	unsigned long time;
+	int ret;
 
 	rtc_tm_to_time(tm, &time);
 
 	/* Disable RTC first */
-	snvs_rtc_enable(data, false);
+	ret = snvs_rtc_enable(data, false);
+	if (ret)
+		return ret;
 
 	/* Write 32-bit time to 47-bit timer, leaving 15 LSBs blank */
 	regmap_write(data->regmap, data->offset + SNVS_LPSRTCLR, time << CNTR_TO_SECS_SH);
 	regmap_write(data->regmap, data->offset + SNVS_LPSRTCMR, time >> (32 - CNTR_TO_SECS_SH));
 
 	/* Enable RTC again */
-	snvs_rtc_enable(data, true);
+	ret = snvs_rtc_enable(data, true);
 
-	return 0;
+	return ret;
 }
 
 static int snvs_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
@@ -287,7 +290,11 @@ static int snvs_rtc_probe(struct platform_device *pdev)
 	regmap_write(data->regmap, data->offset + SNVS_LPSR, 0xffffffff);
 
 	/* Enable RTC */
-	snvs_rtc_enable(data, true);
+	ret = snvs_rtc_enable(data, true);
+	if (ret) {
+		dev_err(&pdev->dev, "failed to enable rtc %d\n", ret);
+		goto error_rtc_device_register;
+	}
 
 	device_init_wakeup(&pdev->dev, true);
 
diff --git a/drivers/rtc/rtc-tx4939.c b/drivers/rtc/rtc-tx4939.c
index 560d9a5e0225..a9528083061d 100644
--- a/drivers/rtc/rtc-tx4939.c
+++ b/drivers/rtc/rtc-tx4939.c
@@ -86,7 +86,8 @@ static int tx4939_rtc_read_time(struct device *dev, struct rtc_time *tm)
 	for (i = 2; i < 6; i++)
 		buf[i] = __raw_readl(&rtcreg->dat);
 	spin_unlock_irq(&pdata->lock);
-	sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2];
+	sec = ((unsigned long)buf[5] << 24) | (buf[4] << 16) |
+		(buf[3] << 8) | buf[2];
 	rtc_time_to_tm(sec, tm);
 	return rtc_valid_tm(tm);
 }
@@ -147,7 +148,8 @@ static int tx4939_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 	alrm->enabled = (ctl & TX4939_RTCCTL_ALME) ? 1 : 0;
 	alrm->pending = (ctl & TX4939_RTCCTL_ALMD) ? 1 : 0;
 	spin_unlock_irq(&pdata->lock);
-	sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2];
+	sec = ((unsigned long)buf[5] << 24) | (buf[4] << 16) |
+		(buf[3] << 8) | buf[2];
 	rtc_time_to_tm(sec, &alrm->time);
 	return rtc_valid_tm(&alrm->time);
 }