Merge 4.14.79 into android-4.14

Changes in 4.14.79
	xfrm: Validate address prefix lengths in the xfrm selector.
	xfrm6: call kfree_skb when skb is toobig
	xfrm: reset transport header back to network header after all input transforms ahave been applied
	xfrm: reset crypto_done when iterating over multiple input xfrms
	mac80211: Always report TX status
	cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
	mac80211: fix pending queue hang due to TX_DROP
	cfg80211: Address some corner cases in scan result channel updating
	mac80211: TDLS: fix skb queue/priority assignment
	mac80211: fix TX status reporting for ieee80211s
	xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.
	ARM: 8799/1: mm: fix pci_ioremap_io() offset check
	xfrm: validate template mode
	netfilter: bridge: Don't sabotage nf_hook calls from an l3mdev
	arm64: hugetlb: Fix handling of young ptes
	ARM: dts: BCM63xx: Fix incorrect interrupt specifiers
	net: macb: Clean 64b dma addresses if they are not detected
	soc: fsl: qbman: qman: avoid allocating from non existing gen_pool
	soc: fsl: qe: Fix copy/paste bug in ucc_get_tdm_sync_shift()
	nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT
	mac80211_hwsim: do not omit multicast announce of first added radio
	Bluetooth: SMP: fix crash in unpairing
	pxa168fb: prepare the clock
	qed: Avoid implicit enum conversion in qed_set_tunn_cls_info
	qed: Fix mask parameter in qed_vf_prep_tunn_req_tlv
	qed: Avoid implicit enum conversion in qed_roce_mode_to_flavor
	qed: Avoid constant logical operation warning in qed_vf_pf_acquire
	qed: Avoid implicit enum conversion in qed_iwarp_parse_rx_pkt
	nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
	asix: Check for supported Wake-on-LAN modes
	ax88179_178a: Check for supported Wake-on-LAN modes
	lan78xx: Check for supported Wake-on-LAN modes
	sr9800: Check for supported Wake-on-LAN modes
	r8152: Check for supported Wake-on-LAN Modes
	smsc75xx: Check for Wake-on-LAN modes
	smsc95xx: Check for Wake-on-LAN modes
	cfg80211: fix use-after-free in reg_process_hint()
	perf/core: Fix perf_pmu_unregister() locking
	perf/ring_buffer: Prevent concurent ring buffer access
	perf/x86/intel/uncore: Fix PCI BDF address of M3UPI on SKX
	perf/x86/amd/uncore: Set ThreadMask and SliceMask for L3 Cache perf events
	net: fec: fix rare tx timeout
	declance: Fix continuation with the adapter identification message
	net: qualcomm: rmnet: Skip processing loopback packets
	locking/ww_mutex: Fix runtime warning in the WW mutex selftest
	be2net: don't flip hw_features when VXLANs are added/deleted
	net: cxgb3_main: fix a missing-check bug
	yam: fix a missing-check bug
	ocfs2: fix crash in ocfs2_duplicate_clusters_by_page()
	iwlwifi: mvm: check for short GI only for OFDM
	iwlwifi: dbg: allow wrt collection before ALIVE
	iwlwifi: fix the ALIVE notification layout
	tools/testing/nvdimm: unit test clear-error commands
	usbip: vhci_hcd: update 'status' file header and format
	scsi: aacraid: address UBSAN warning regression
	IB/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush
	IB/rxe: put the pool on allocation failure
	s390/qeth: fix error handling in adapter command callbacks
	net/mlx5: Fix mlx5_get_vector_affinity function
	powerpc/pseries: Add empty update_numa_cpu_lookup_table() for NUMA=n
	dm integrity: fail early if required HMAC key is not available
	net: phy: realtek: Use the dummy stubs for MMD register access for rtl8211b
	net: phy: Add general dummy stubs for MMD register access
	net/mlx5e: Refine ets validation function
	scsi: qla2xxx: Avoid double completion of abort command
	kbuild: set no-integrated-as before incl. arch Makefile
	IB/mlx5: Avoid passing an invalid QP type to firmware
	ARM: tegra: Fix ULPI regression on Tegra20
	l2tp: remove configurable payload offset
	cifs: Use ULL suffix for 64-bit constant
	test_bpf: Fix testing with CONFIG_BPF_JIT_ALWAYS_ON=y on other arches
	KVM: x86: Update the exit_qualification access bits while walking an address
	sparc64: Fix regression in pmdp_invalidate().
	tpm: move the delay_msec increment after sleep in tpm_transmit()
	bpf: sockmap, map_release does not hold refcnt for pinned maps
	tpm: tpm_crb: relinquish locality on error path.
	xen-netfront: Update features after registering netdev
	xen-netfront: Fix mismatched rtnl_unlock
	IB/usnic: Update with bug fixes from core code
	mmc: dw_mmc-rockchip: correct property names in debug
	MIPS: Workaround GCC __builtin_unreachable reordering bug
	lan78xx: Don't reset the interface on open
	enic: do not overwrite error code
	iio: buffer: fix the function signature to match implementation
	selftests/powerpc: Add ptrace hw breakpoint test
	scsi: ibmvfc: Avoid unnecessary port relogin
	scsi: sd: Remember that READ CAPACITY(16) succeeded
	btrfs: quota: Set rescan progress to (u64)-1 if we hit last leaf
	net: phy: phylink: Don't release NULL GPIO
	x86/paravirt: Fix some warning messages
	net: stmmac: mark PM functions as __maybe_unused
	kconfig: fix the rule of mainmenu_stmt symbol
	libertas: call into generic suspend code before turning off power
	perf tests: Fix indexing when invoking subtests
	compiler.h: Allow arch-specific asm/compiler.h
	ARM: dts: imx53-qsb: disable 1.2GHz OPP
	perf python: Use -Wno-redundant-decls to build with PYTHON=python3
	rxrpc: Don't check RXRPC_CALL_TX_LAST after calling rxrpc_rotate_tx_window()
	rxrpc: Only take the rwind and mtu values from latest ACK
	rxrpc: Fix connection-level abort handling
	net: ena: fix warning in rmmod caused by double iounmap
	net: ena: fix NULL dereference due to untimely napi initialization
	selftests: rtnetlink.sh explicitly requires bash.
	fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
	sch_netem: restore skb->dev after dequeuing from the rbtree
	mtd: spi-nor: Add support for is25wp series chips
	kvm: x86: fix WARN due to uninitialized guest FPU state
	ARM: dts: r8a7790: Correct critical CPU temperature
	media: uvcvideo: Fix driver reference counting
	ALSA: usx2y: Fix invalid stream URBs
	Revert "netfilter: ipv6: nf_defrag: drop skb dst before queueing"
	perf tools: Disable parallelism for 'make clean'
	drm/i915/gvt: fix memory leak of a cmd_entry struct on error exit path
	bridge: do not add port to router list when receives query with source 0.0.0.0
	net: bridge: remove ipv6 zero address check in mcast queries
	ipv6: mcast: fix a use-after-free in inet6_mc_check
	ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called
	llc: set SOCK_RCU_FREE in llc_sap_add_socket()
	net: fec: don't dump RX FIFO register when not available
	net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs
	net: sched: gred: pass the right attribute to gred_change_table_def()
	net: socket: fix a missing-check bug
	net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
	net: udp: fix handling of CHECKSUM_COMPLETE packets
	r8169: fix NAPI handling under high load
	sctp: fix race on sctp_id2asoc
	udp6: fix encap return code for resubmitting
	vhost: Fix Spectre V1 vulnerability
	virtio_net: avoid using netif_tx_disable() for serializing tx routine
	ethtool: fix a privilege escalation bug
	bonding: fix length of actor system
	ip6_tunnel: Fix encapsulation layout
	openvswitch: Fix push/pop ethernet validation
	net/mlx5: Take only bit 24-26 of wqe.pftype_wq for page fault type
	net: sched: Fix for duplicate class dump
	net: drop skb on failure in ip_check_defrag()
	net: fix pskb_trim_rcsum_slow() with odd trim offset
	net/mlx5e: fix csum adjustments caused by RXFCS
	rtnetlink: Disallow FDB configuration for non-Ethernet device
	net: ipmr: fix unresolved entry dumps
	net: bcmgenet: Poll internal PHY for GENETv5
	net/sched: cls_api: add missing validation of netlink attributes
	net/mlx5: Fix build break when CONFIG_SMP=n
	Linux 4.14.79

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

6 files changed, 26 insertions, 7 deletions

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h b/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
index 3684a3e180e5..007bfe7656a4 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/alive.h
@@ -95,8 +95,8 @@ enum {
 #define IWL_ALIVE_FLG_RFKILL	BIT(0)
 
 struct iwl_lmac_alive {
-	__le32 ucode_minor;
 	__le32 ucode_major;
+	__le32 ucode_minor;
 	u8 ver_subtype;
 	u8 ver_type;
 	u8 mac;
@@ -113,8 +113,8 @@ struct iwl_lmac_alive {
 } __packed; /* UCODE_ALIVE_NTFY_API_S_VER_3 */
 
 struct iwl_umac_alive {
-	__le32 umac_minor;		/* UMAC version: minor */
 	__le32 umac_major;		/* UMAC version: major */
+	__le32 umac_minor;		/* UMAC version: minor */
 	__le32 error_info_addr;		/* SRAM address for UMAC error log */
 	__le32 dbg_print_buff_addr;
 } __packed; /* UMAC_ALIVE_DATA_API_S_VER_2 */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index 2fa7ec466275..839010417241 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -950,7 +950,20 @@ int iwl_fw_dbg_collect_desc(struct iwl_fw_runtime *fwrt,
 	if (trigger)
 		delay = msecs_to_jiffies(le32_to_cpu(trigger->stop_delay));
 
-	if (WARN(fwrt->trans->state == IWL_TRANS_NO_FW,
+	/*
+	 * If the loading of the FW completed successfully, the next step is to
+	 * get the SMEM config data. Thus, if fwrt->smem_cfg.num_lmacs is non
+	 * zero, the FW was already loaded successully. If the state is "NO_FW"
+	 * in such a case - WARN and exit, since FW may be dead. Otherwise, we
+	 * can try to collect the data, since FW might just not be fully
+	 * loaded (no "ALIVE" yet), and the debug data is accessible.
+	 *
+	 * Corner case: got the FW alive but crashed before getting the SMEM
+	 *	config. In such a case, due to HW access problems, we might
+	 *	collect garbage.
+	 */
+	if (WARN((fwrt->trans->state == IWL_TRANS_NO_FW) &&
+		 fwrt->smem_cfg.num_lmacs,
 		 "Can't collect dbg data when FW isn't alive\n"))
 		return -EIO;
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 2d14a58cbdd7..c73e4be9bde3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -439,7 +439,8 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
 		rx_status->bw = RATE_INFO_BW_160;
 		break;
 	}
-	if (rate_n_flags & RATE_MCS_SGI_MSK)
+	if (!(rate_n_flags & RATE_MCS_CCK_MSK) &&
+	    rate_n_flags & RATE_MCS_SGI_MSK)
 		rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
 	if (rate_n_flags & RATE_HT_MCS_GF_MSK)
 		rx_status->enc_flags |= RX_ENC_FLAG_HT_GF;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index e2196dc35dc6..8ba8c70571fb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -981,7 +981,9 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
 		rx_status->bw = RATE_INFO_BW_160;
 		break;
 	}
-	if (rate_n_flags & RATE_MCS_SGI_MSK)
+
+	if (!(rate_n_flags & RATE_MCS_CCK_MSK) &&
+	    rate_n_flags & RATE_MCS_SGI_MSK)
 		rx_status->enc_flags |= RX_ENC_FLAG_SHORT_GI;
 	if (rate_n_flags & RATE_HT_MCS_GF_MSK)
 		rx_status->enc_flags |= RX_ENC_FLAG_HT_GF;
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index aafa7aa18fbd..477f9f2f6626 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2730,8 +2730,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
 	list_add_tail(&data->list, &hwsim_radios);
 	spin_unlock_bh(&hwsim_radio_lock);
 
-	if (idx > 0)
-		hwsim_mcast_new_radio(idx, info, param);
+	hwsim_mcast_new_radio(idx, info, param);
 
 	return idx;
 
diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c
index 43743c26c071..39bf85d0ade0 100644
--- a/drivers/net/wireless/marvell/libertas/if_sdio.c
+++ b/drivers/net/wireless/marvell/libertas/if_sdio.c
@@ -1317,6 +1317,10 @@ static int if_sdio_suspend(struct device *dev)
 	if (priv->wol_criteria == EHS_REMOVE_WAKEUP) {
 		dev_info(dev, "Suspend without wake params -- powering down card\n");
 		if (priv->fw_ready) {
+			ret = lbs_suspend(priv);
+			if (ret)
+				return ret;
+
 			priv->power_up_on_resume = true;
 			if_sdio_power_off(card);
 		}