Merge 4.4.163 into android-4.4

Changes in 4.4.163
	xfrm: Validate address prefix lengths in the xfrm selector.
	xfrm6: call kfree_skb when skb is toobig
	mac80211: Always report TX status
	cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
	ARM: 8799/1: mm: fix pci_ioremap_io() offset check
	xfrm: validate template mode
	mac80211_hwsim: do not omit multicast announce of first added radio
	Bluetooth: SMP: fix crash in unpairing
	pxa168fb: prepare the clock
	asix: Check for supported Wake-on-LAN modes
	ax88179_178a: Check for supported Wake-on-LAN modes
	lan78xx: Check for supported Wake-on-LAN modes
	sr9800: Check for supported Wake-on-LAN modes
	r8152: Check for supported Wake-on-LAN Modes
	smsc75xx: Check for Wake-on-LAN modes
	smsc95xx: Check for Wake-on-LAN modes
	perf/ring_buffer: Prevent concurent ring buffer access
	net: cxgb3_main: fix a missing-check bug
	KEYS: put keyring if install_session_keyring_to_cred() fails
	ipv6: suppress sparse warnings in IP6_ECN_set_ce()
	net: drop write-only stack variable
	ser_gigaset: use container_of() instead of detour
	tracing: Skip more functions when doing stack tracing of events
	ARM: dts: apq8064: add ahci ports-implemented mask
	x86/mm/pat: Prevent hang during boot when mapping pages
	radix-tree: fix radix_tree_iter_retry() for tagged iterators.
	af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers
	net/mlx4_en: Resolve dividing by zero in 32-bit system
	ipv6: orphan skbs in reassembly unit
	um: Avoid longjmp/setjmp symbol clashes with libpthread.a
	sched/cgroup: Fix cgroup entity load tracking tear-down
	btrfs: don't create or leak aliased root while cleaning up orphans
	thermal: allow spear-thermal driver to be a module
	thermal: allow u8500-thermal driver to be a module
	tpm: fix: return rc when devm_add_action() fails
	x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
	aacraid: Start adapter after updating number of MSIX vectors
	perf/core: Don't leak event in the syscall error path
	usbvision: revert commit 588afcc1
	MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue
	ASoC: ak4613: Enable cache usage to fix crashes on resume
	ASoC: wm8940: Enable cache usage to fix crashes on resume
	CIFS: handle guest access errors to Windows shares
	arm64: Fix potential race with hardware DBM in ptep_set_access_flags()
	xfrm: Clear sk_dst_cache when applying per-socket policy.
	scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
	sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata
	sch_red: update backlog as well
	usb-storage: fix bogus hardware error messages for ATA pass-thru devices
	bpf: generally move prog destruction to RCU deferral
	drm/nouveau/fbcon: fix oops without fbdev emulation
	fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio
	ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector
	net/mlx5e: Fix LRO modify
	net/mlx5e: Correctly handle RSS indirection table when changing number of channels
	ixgbe: fix RSS limit for X550
	ixgbe: Correct X550EM_x revision check
	ALSA: timer: Fix zero-division by continue of uninitialized instance
	vti6: flush x-netns xfrm cache when vti interface is removed
	gro: Allow tunnel stacking in the case of FOU/GUE
	brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
	l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()
	tty: serial: sprd: fix error return code in sprd_probe()
	video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe()
	sparc64 mm: Fix more TSB sizing issues
	gpu: host1x: fix error return code in host1x_probe()
	sparc64: Fix exception handling in UltraSPARC-III memcpy.
	gpio: msic: fix error return code in platform_msic_gpio_probe()
	usb: imx21-hcd: fix error return code in imx21_probe()
	usb: ehci-omap: fix error return code in ehci_hcd_omap_probe()
	usb: dwc3: omap: fix error return code in dwc3_omap_probe()
	spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe()
	MIPS: Handle non word sized instructions when examining frame
	spi/bcm63xx: fix error return code in bcm63xx_spi_probe()
	spi: xlp: fix error return code in xlp_spi_probe()
	ASoC: spear: fix error return code in spdif_in_probe()
	PM / devfreq: tegra: fix error return code in tegra_devfreq_probe()
	bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal
	scsi: aacraid: Fix typo in blink status
	MIPS: microMIPS: Fix decoding of swsp16 instruction
	igb: Remove superfluous reset to PHY and page 0 selection
	MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression
	ARM: dts: imx53-qsb: disable 1.2GHz OPP
	fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
	mtd: spi-nor: Add support for is25wp series chips
	perf tools: Disable parallelism for 'make clean'
	bridge: do not add port to router list when receives query with source 0.0.0.0
	net: bridge: remove ipv6 zero address check in mcast queries
	ipv6: mcast: fix a use-after-free in inet6_mc_check
	ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called
	net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs
	net: sched: gred: pass the right attribute to gred_change_table_def()
	net: socket: fix a missing-check bug
	net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
	r8169: fix NAPI handling under high load
	sctp: fix race on sctp_id2asoc
	net: drop skb on failure in ip_check_defrag()
	vhost: Fix Spectre V1 vulnerability
	rtnetlink: Disallow FDB configuration for non-Ethernet device
	mremap: properly flush TLB before releasing the page
	crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned
	ahci: don't ignore result code of ahci_reset_controller()
	cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
	ptp: fix Spectre v1 vulnerability
	RDMA/ucma: Fix Spectre v1 vulnerability
	IB/ucm: Fix Spectre v1 vulnerability
	cdc-acm: correct counting of UART states in serial state notification
	usb: gadget: storage: Fix Spectre v1 vulnerability
	USB: fix the usbfs flag sanitization for control transfers
	Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
	sched/fair: Fix throttle_list starvation with low CFS quota
	x86/percpu: Fix this_cpu_read()
	cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE
	l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6
	x86/time: Correct the attribute on jiffies' definition
	Linux 4.4.163

Change-Id: Idb0efd175853886145a1fb7eaaf18797c39e5f6f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

4 files changed, 11 insertions, 6 deletions

diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
index 8da8b46da722..1c447405ebbf 100644
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -1416,8 +1416,8 @@ static int aac_acquire_resources(struct aac_dev *dev)
 		/* After EEH recovery or suspend resume, max_msix count
 		 * may change, therfore updating in init as well.
 		 */
-		aac_adapter_start(dev);
 		dev->init->Sa_MSIXVectors = cpu_to_le32(dev->max_msix);
+		aac_adapter_start(dev);
 	}
 	return 0;
 
diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c
index e415e1c58eb5..cf3ac0654a3a 100644
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -444,7 +444,7 @@ err_out:
 	return -1;
 
 err_blink:
-	return (status > 16) & 0xFF;
+	return (status >> 16) & 0xFF;
 }
 
 /**
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 692445bcca6f..850ddc5fac04 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -381,11 +381,12 @@ static void scsi_target_reap_ref_release(struct kref *kref)
 		= container_of(kref, struct scsi_target, reap_ref);
 
 	/*
-	 * if we get here and the target is still in the CREATED state that
+	 * if we get here and the target is still in a CREATED state that
 	 * means it was allocated but never made visible (because a scan
 	 * turned up no LUNs), so don't call device_del() on it.
 	 */
-	if (starget->state != STARGET_CREATED) {
+	if ((starget->state != STARGET_CREATED) &&
+	    (starget->state != STARGET_CREATED_REMOVE)) {
 		transport_remove_device(&starget->dev);
 		device_del(&starget->dev);
 	}
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 8db0c48943d6..085e470d1c49 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1212,11 +1212,15 @@ restart:
 	spin_lock_irqsave(shost->host_lock, flags);
 	list_for_each_entry(starget, &shost->__targets, siblings) {
 		if (starget->state == STARGET_DEL ||
-		    starget->state == STARGET_REMOVE)
+		    starget->state == STARGET_REMOVE ||
+		    starget->state == STARGET_CREATED_REMOVE)
 			continue;
 		if (starget->dev.parent == dev || &starget->dev == dev) {
 			kref_get(&starget->reap_ref);
-			starget->state = STARGET_REMOVE;
+			if (starget->state == STARGET_CREATED)
+				starget->state = STARGET_CREATED_REMOVE;
+			else
+				starget->state = STARGET_REMOVE;
 			spin_unlock_irqrestore(shost->host_lock, flags);
 			__scsi_remove_target(starget);
 			scsi_target_reap(starget);