Squashed various Commits

----
arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND

Added error checks for upper limit of param.num in
DFE_IOCTL_COMMAND

Change-Id: I0143813d38ec7a5dfa7a8307b075daf7d4a4d101
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>

----
arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw

Added error checks for upper limit of param.num in DFE ioctls
for register array r/w

Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>

----
qseecom: Validate the pointer returned by ion_import_dma_buf

Do a "IS_ERR_OR_NULL" check for the return value of
ion_import_dma_buf.

Change-Id: Iaac8b59b1f076d002430e0e6aba055bd88c83ed7
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>

----
cfg80211: pass station supported channel and oper class info

The information of the peer's supported channels and supported operating
classes are required for the driver to perform TDLS off channel
operations. This commit enhances the function nl80211_(new)set_station
to pass this information of the peer to the driver.

CRs-fixed: 595620
Change-Id: I1d630deb4cf435e7f72e3a59276d3771c2b03114
Signed-off-by: Naresh Jayaram <njayar@codeaurora.org>

----
nl80211: vendor command support

Add support for vendor-specific commands to nl80211. This is
intended to be used for really vendor-specific functionality
that can't be implemented in a generic fashion for any reason.
It's *NOT* intended to be used for any normal/generic feature
or any optimisations that could be implemented across drivers.
Currently, only vendor commands (with replies) are supported,
no dump operations or vendor-specific notifications.
Also add a function wdev_to_ieee80211_vif() to mac80211 which
is needed for mac80211-based drivers wanting to implement any
vendor commands.

Change-Id: If73cf90d152ca0888a563cf4ae685aad9cec6443
CRs-fixed: 576020
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: ad7e718c9b4f717823fd920a0103f7b0fb06183f
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/linville/wireless-next.git
Signed-off-by: Leo Chang <leochang@codeaurora.org>

----
nl80211: support vendor-specific events

In addition to vendor-specific commands, also support vendor-specific
events. These must be registered with cfg80211 before they can be used.
They're also advertised in nl80211 in the wiphy information so that
userspace knows can be expected. The events themselves are sent on a
new multicast group called "vendor".

Change-Id: I184aaa9f9e8461aee572f7d0a35916cd668c2218
CRs-fixed: 576020
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 567ffc3509b2d3f965a49a18631d3da7f9a96d4f
Git-repo: https://git.kernel.org/cgit/linux/kernel/git/linville/wireless-next.git
Signed-off-by: Leo Chang <leochang@codeaurora.org>

----
msm-camera: Assign NULL after freeing memory

In msm_actuator we need to assign memory
pointer to  NULL after freeing that memory
using kfree.

CRs-Fixed: 621818
Change-Id: Id6bc85a74c94556b53f4a868a168637e0733bde4
Signed-off-by: Raghu DP <dp.raghu@codeaurora.org>

----
msm: camera: Clear frame stucture before use

Clear frame structure before use and avoid unnecessary side
effects

CRs-Fixed: 563447

Change-Id: I9acd436f30c65c01fa366328f7227a2045f42657
Signed-off-by: Ashok Raj Deenadayalan <adeena@codeaurora.org>

----
msm: kgsl: Remove sscanf() from kgsl_pwrctrl.c

Replace sscanf() in kgsl_pwrctrl.c with a generic function to safely
convert 32 bit unsigned ints.

CRs-fixed: 563585
Change-Id: Ic0dedbad10e2264ec8fccab622d094d123b49b77
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

----
msm: kgsl: don't use sscanf()

Friends do not let friends use sscanf().

CRs-Fixed: 563605
Change-Id: Ic0dedbad56af5bbee4fc833701d8bc93b118efa9
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Ananta Kishore K <akollipa@codeaurora.org>

----
USB: ci13xxx_msm: shutdown callback to disable D+ pullup

SW reset may not reset the PHY properly by disabling
the D+ pullup.

Implement a shutdown callback to disable the pullup
during soft reboot so that host controller does
not go in bad state.

CRs-Fixed: 616180
Change-Id: I7bc76efdf78009a5e3705c049abd3678dc966885
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>

----
msm: ADSPRPC: Add checks for erroneous values

Check for invalid parameters passed in user invocation
and validate the return values using appropriate macros.

Change-Id: If529873d025ac0c13725efbedda5a58fae327722
Acked-by: Sathish Ambley <sambley@qti.qualcomm.com>
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Signed-off-by: Prados Das <prados@codeaurora.org>

----
msm: wfd: Free ion memory properly during a ion failure

This change takes care of freeing allocated ion memory
properly which avoids unnecessary memory leaks.

CRs-Fixed: 627325
Change-Id: Icbbb1f2c8f8b02541a38aedd0066c7b079b144fb
Signed-off-by: Deepak Verma <dverma@codeaurora.org>

----
misc: isa1200: Add mutex for clk_on

clk_on is a boolean which maintains the enable/disbale
status of clock. To avoid the race condition, mutex call
is added for the clk_on.

CRs-Fixed: 629529
Change-Id: I4f61c629c503c658410b5c14da2e1612b82ec201
Signed-off-by: Sarada Prasanna Garnayak <c_sgarna@codeaurora.org>

----
ASoC: msm: Null dereference check added

In asm_read function we should check buffer pointer
before it is dererferenced.

CRs-Fixed: 612682
Change-Id: I1968c038e1d35381bf174000287d542441e41092
Signed-off-by: Anish Kumar <kanish@codeaurora.org>

----
misc: qfpfuse: Fix overflow condition

Fix potential integer overflow for ioctl command to avoid incorrect
buffer allocation. Use the stack for data buffering to avoid the
small buffer allocation for improved performance. Increase the fuse
blow timeout in the driver to cover all QFPROM implementations

CRs-Fixed: 550574,550575

Change-Id: Iee3cc1d38aa5dbf8ef693a43a0ca716fc8724c62
Acked-by: Radhakrishna Popuri <c_rpopur@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Signed-off-by: Prados Das <prados@codeaurora.org>

----
misc: qfpfuse: validate ioctl input parameters

validate input parameters for ioctl command request

CRs-Fixed: 550574,550575
Change-Id: I87c3818b3bacc43c679aa555d79cc6ed127c6ef8
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
Signed-off-by: Prados Das <prados@codeaurora.org>

----
kernel:Dont set stop_issued flag in stop recording

stop_issued flag should not be set
to TRUE during stop recording and liveshot.

CRs-Fixed: 629368

Change-Id: Ibf57a4e72e48ad1ce9821415ebf6de01fd881e64
Signed-off-by: Raghu DP <dp.raghu@codeaurora.org>

Conflicts:
	drivers/media/video/msm/vfe/msm_vfe32.c

----
msm: kgsl: Fix Z180 memory leak

Decerement entry refcount, which incremented
in kgsl_sharedmem_find_region.

CRs-Fixed: 635747
Change-Id: I621ba8f8e119a9ab8ba5455b28a565e3cae2f7cd
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>

----
msm: kgsl: fix a race condition when calling kref_put

Fix a race condition which can occur if a thread tries to acquire
a reference to a mem_entry or context while another thread has
already decremented the refcount to 0 and is in the process of
destroying said mem_entry or context.

CRs-Fixed: 635747
Change-Id: I6be64ca75f9cb12b03e870b9ca83588197c64e5e
Signed-off-by: Hareesh Gundu <hareeshg@codeaurora.org>
Patch to 3.4.86

Change-Id: Ia42e008a2d77bcd82d9c882ef7bbe5cfc2a5ef2c

Signed-off-by: daeiron <thomasvangerven@gmail.com>

Conflicts:
	include/linux/sched.h
	kernel/hrtimer.c
	net/wireless/nl80211.c
Merge https://github.com/c0llal0/android_kernel_sony_apq8064 into aosb