Merge 4.14.75 into android-4.14

Changes in 4.14.75
	drm/amd/pp: initialize result to before or'ing in data
	drm/amdgpu: add another ATPX quirk for TOPAZ
	serial: mvebu-uart: Fix reporting of effective CSIZE to userspace
	tools/power turbostat: fix possible sprintf buffer overflow
	mac80211: Run TXQ teardown code before de-registering interfaces
	mac80211_hwsim: require at least one channel
	KVM: PPC: Book3S HV: Don't truncate HPTE index in xlate function
	btrfs: btrfs_shrink_device should call commit transaction at the end
	scsi: csiostor: add a check for NULL pointer after kmalloc()
	mac80211: correct use of IEEE80211_VHT_CAP_RXSTBC_X
	mac80211_hwsim: correct use of IEEE80211_VHT_CAP_RXSTBC_X
	gpio: adp5588: Fix sleep-in-atomic-context bug
	mac80211: mesh: fix HWMP sequence numbering to follow standard
	mac80211: avoid kernel panic when building AMSDU from non-linear SKB
	gpiolib: acpi: Switch to cansleep version of GPIO library call
	gpiolib-acpi: Register GpioInt ACPI event handlers from a late_initcall
	net: hns: add the code for cleaning pkt in chip
	net: hns: add netif_carrier_off before change speed and duplex
	cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE
	mac80211: do not convert to A-MSDU if frag/subframe limited
	mac80211: always account for A-MSDU header changes
	tools/kvm_stat: fix python3 issues
	tools/kvm_stat: fix handling of invalid paths in debugfs provider
	gpio: Fix crash due to registration race
	ARC: atomics: unbork atomic_fetch_##op()
	md/raid5-cache: disable reshape completely
	RAID10 BUG_ON in raise_barrier when force is true and conf->barrier is 0
	i2c: uniphier: issue STOP only for last message or I2C_M_STOP
	i2c: uniphier-f: issue STOP only for last message or I2C_M_STOP
	net: cadence: Fix a sleep-in-atomic-context bug in macb_halt_tx()
	fs/cifs: don't translate SFM_SLASH (U+F026) to backslash
	mac80211: fix an off-by-one issue in A-MSDU max_subframe computation
	cfg80211: fix a type issue in ieee80211_chandef_to_operating_class()
	mac80211: fix a race between restart and CSA flows
	mac80211: Fix station bandwidth setting after channel switch
	mac80211: don't Tx a deauth frame if the AP forbade Tx
	mac80211: shorten the IBSS debug messages
	tools/vm/slabinfo.c: fix sign-compare warning
	tools/vm/page-types.c: fix "defined but not used" warning
	mm: madvise(MADV_DODUMP): allow hugetlbfs pages
	bpf: 32-bit RSH verification must truncate input before the ALU op
	netfilter: xt_cluster: add dependency on conntrack module
	HID: add support for Apple Magic Keyboards
	usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
	HID: hid-saitek: Add device ID for RAT 7 Contagion
	scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values fails
	scsi: qedi: Add the CRC size within iSCSI NVM image
	perf evsel: Fix potential null pointer dereference in perf_evsel__new_idx()
	perf util: Fix bad memory access in trace info.
	perf probe powerpc: Ignore SyS symbols irrespective of endianness
	netfilter: nf_tables: release chain in flushing set
	Revert "iio: temperature: maxim_thermocouple: add MAX31856 part"
	RDMA/ucma: check fd type in ucma_migrate_id()
	HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub report
	USB: yurex: Check for truncation in yurex_read()
	nvmet-rdma: fix possible bogus dereference under heavy load
	net/mlx5: Consider PCI domain in search for next dev
	drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS
	drm/nouveau/disp: fix DP disable race
	dm raid: fix rebuild of specific devices by updating superblock
	fs/cifs: suppress a string overflow warning
	net: ena: fix driver when PAGE_SIZE == 64kB
	net: ena: fix missing calls to READ_ONCE
	perf/x86/intel: Add support/quirk for the MISPREDICT bit on Knights Landing CPUs
	dm thin metadata: try to avoid ever aborting transactions
	arch/hexagon: fix kernel/dma.c build warning
	hexagon: modify ffs() and fls() to return int
	arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto"
	drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk
	r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED
	s390/qeth: use vzalloc for QUERY OAT buffer
	s390/qeth: don't dump past end of unknown HW header
	cifs: read overflow in is_valid_oplock_break()
	xen/manage: don't complain about an empty value in control/sysrq node
	xen: avoid crash in disable_hotplug_cpu
	xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage
	ovl: fix access beyond unterminated strings
	ovl: fix memory leak on unlink of indexed file
	ovl: fix format of setxattr debug
	sysfs: Do not return POSIX ACL xattrs via listxattr
	smb2: fix missing files in root share directory listing
	iommu/amd: Clear memory encryption mask from physical address
	ALSA: hda/realtek - Cannot adjust speaker's volume on Dell XPS 27 7760
	crypto: qat - Fix KASAN stack-out-of-bounds bug in adf_probe()
	crypto: mxs-dcp - Fix wait logic on chan threads
	crypto: caam/jr - fix ablkcipher_edesc pointer arithmetic
	gpiolib: Free the last requested descriptor
	Drivers: hv: vmbus: Use get/put_cpu() in vmbus_connect()
	tools: hv: fcopy: set 'error' in case an unknown operation was requested
	proc: restrict kernel stack dumps to root
	ocfs2: fix locking for res->tracking and dlm->tracking_list
	ixgbe: check return value of napi_complete_done()
	dm thin metadata: fix __udivdi3 undefined on 32-bit
	Linux 4.14.75

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 5 insertions, 3 deletions

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index d686ba10fecc..aafa7aa18fbd 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2632,9 +2632,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
 				IEEE80211_VHT_CAP_SHORT_GI_80 |
 				IEEE80211_VHT_CAP_SHORT_GI_160 |
 				IEEE80211_VHT_CAP_TXSTBC |
-				IEEE80211_VHT_CAP_RXSTBC_1 |
-				IEEE80211_VHT_CAP_RXSTBC_2 |
-				IEEE80211_VHT_CAP_RXSTBC_3 |
 				IEEE80211_VHT_CAP_RXSTBC_4 |
 				IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
 			sband->vht_cap.vht_mcs.rx_mcs_map =
@@ -3124,6 +3121,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
 	if (info->attrs[HWSIM_ATTR_CHANNELS])
 		param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
 
+	if (param.channels < 1) {
+		GENL_SET_ERR_MSG(info, "must have at least one channel");
+		return -EINVAL;
+	}
+
 	if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
 		GENL_SET_ERR_MSG(info, "too many channels specified");
 		return -EINVAL;