Merge 3.18.105 into android-3.18

Changes in 3.18.105
	NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION
	IB/srpt: Fix abort handling
	af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
	mac80211: bail out from prep_connection() if a reconfig is ongoing
	bna: Avoid reading past end of buffer
	qlge: Avoid reading past end of buffer
	net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control
	lockd: fix lockd shutdown race
	pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
	s390: move _text symbol to address higher than zero
	net/mlx4_en: Avoid adding steering rules with invalid ring
	CIFS: silence lockdep splat in cifs_relock_file()
	net: qca_spi: Fix alignment issues in rx path
	netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
	KVM: PPC: Book3S PR: Check copy_to/from_user return values
	vmxnet3: ensure that adapter is in proper state during force_close
	SMB2: Fix share type handling
	PowerCap: Fix an error code in powercap_register_zone()
	staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning
	x86/tsc: Provide 'tsc=unstable' boot parameter
	ARM: dts: imx6qdl-wandboard: Fix audio channel swap
	ipv6: avoid dad-failures for addresses with NODAD
	async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome()
	usb: dwc3: keystone: check return value
	btrfs: fix incorrect error return ret being passed to mapping_set_error
	ata: libahci: properly propagate return value of platform_get_irq()
	neighbour: update neigh timestamps iff update is effective
	usb: chipidea: properly handle host or gadget initialization failure
	USB: ene_usb6250: fix first command execution
	net: x25: fix one potential use-after-free issue
	USB: ene_usb6250: fix SCSI residue overwriting
	sh_eth: Use platform device for printing before register_netdev()
	ath5k: fix memory leak on buf on failed eeprom read
	selftests/powerpc: Fix TM resched DSCR test with some compilers
	xfrm: fix state migration copy replay sequence numbers
	ARM: davinci: da8xx: Create DSP device only when assigned memory
	ray_cs: Avoid reading past end of buffer
	leds: pca955x: Correct I2C Functionality
	block: fix an error code in add_partition()
	libceph: NULL deref on crush_decode() error path
	netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
	scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats()
	fix race in drivers/char/random.c:get_reg()
	ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff()
	net: move somaxconn init from sysctl code
	bonding: Don't update slave->link until ready to commit
	KVM: nVMX: Fix handling of lmsw instruction
	net: llc: add lock_sock in llc_ui_bind to avoid a race condition
	l2tp: fix missing print session offset info
	scsi: libiscsi: Allow sd_shutdown on bad transport
	vfb: fix video mode and line_length being set when loaded
	wl1251: check return from call to wl1251_acx_arp_ip_filter
	hdlcdrv: Fix divide by zero in hdlcdrv_ioctl
	ovl: filter trusted xattr for non-admin
	powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE]
	arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage
	rtc: interface: Validate alarm-time before handling rollover
	net: freescale: fix potential null pointer dereference
	KVM: SVM: do not zero out segment attributes if segment is unusable or not present
	powerpc/spufs: Fix coredump of SPU contexts
	perf trace: Add mmap alias for s390
	qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M
	mISDN: Fix a sleep-in-atomic bug
	drm/omap: fix tiled buffer stride calculations
	Fix serial console on SNI RM400 machines
	bio-integrity: Do not allocate integrity context for bio w/o data
	skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow
	net/mlx4: Fix the check in attaching steering rules
	perf report: Ensure the perf DSO mapping matches what libdw sees
	tags: honor COMPILED_SOURCE with apart output directory
	e1000e: fix race condition around skb_tstamp_tx()
	cx25840: fix unchecked return values
	mceusb: sporadic RX truncation corruption fix
	net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support
	e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails
	perf/core: Correct event creation with PERF_FORMAT_GROUP
	MIPS: mm: fixed mappings: correct initialisation
	MIPS: kprobes: flush_insn_slot should flush only if probe initialised
	net: emac: fix reset timeout with AR8035 phy
	perf tests: Decompress kernel module before objdump
	xen: avoid type warning in xchg_xen_ulong
	bnx2x: Allow vfs to disable txvlan offload
	sctp: fix recursive locking warning in sctp_do_peeloff
	sparc64: ldc abort during vds iso boot
	iio: magnetometer: st_magn_spi: fix spi_device_id table
	Bluetooth: Send HCI Set Event Mask Page 2 command only when needed
	ACPICA: Events: Add runtime stub support for event APIs
	ACPICA: Disassembler: Abort on an invalid/unknown AML opcode
	vxlan: dont migrate permanent fdb entries during learn
	bcache: stop writeback thread after detaching
	bcache: segregate flash only volume write streams
	scsi: libsas: fix memory leak in sas_smp_get_phy_events()
	scsi: libsas: fix error when getting phy events
	scsi: libsas: initialize sas_phy status according to response of DISCOVER
	tty: n_gsm: Allow ADM response in addition to UA for control dlci
	EDAC, mv64x60: Fix an error handling path
	ipsec: check return value of skb_to_sgvec always
	rxrpc: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec always
	virtio_net: check return value of skb_to_sgvec in one more location
	random: use lockless method of accessing and updating f->reg_idx
	futex: Remove requirement for lock_page() in get_futex_key()
	net: fix possible out-of-bound read in skb_network_protocol()
	netlink: make sure nladdr has correct size in netlink_connect()
	pptp: remove a buggy dst release in pptp_connect()
	sctp: do not leak kernel memory to user space
	sctp: sctp_sockaddr_af must check minimal addr length for AF_INET6
	sky2: Increase D3 delay to sky2 stops working after suspend
	vhost: correctly remove wait queue during poll failure
	bonding: fix the err path for dev hwaddr sync in bond_enslave
	bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave
	bonding: process the err returned by dev_set_allmulti properly in bond_enslave
	net: fool proof dev_valid_name()
	ip_tunnel: better validate user provided tunnel names
	ipv6: sit: better validate user provided tunnel names
	ip6_gre: better validate user provided tunnel names
	vti6: better validate user provided tunnel names
	ip6_tunnel: better validate user provided tunnel names
	r8169: fix setting driver_data after register_netdev
	net sched actions: fix dumping which requires several messages to user space
	ipv6: the entire IPv6 header chain must fit the first fragment
	Revert "xhci: plat: Register shutdown for xhci_plat"
	Linux 3.18.105

Change-Id: I677f68d1da800725d509d133abc2bdacd95a9a0d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>