Merge android-4.4.99 (7eab308) into msm-4.4

* refs/heads/tmp-7eab308
  Linux 4.4.99
  misc: panel: properly restore atomic counter on error path
  target: Fix node_acl demo-mode + uncached dynamic shutdown regression
  target/iscsi: Fix iSCSI task reassignment handling
  brcmfmac: remove setting IBSS mode when stopping AP
  tipc: fix link attribute propagation bug
  security/keys: add CONFIG_KEYS_COMPAT to Kconfig
  tcp/dccp: fix other lockdep splats accessing ireq_opt
  tcp/dccp: fix lockdep splat in inet_csk_route_req()
  tcp/dccp: fix ireq->opt races
  ipip: only increase err_count for some certain type icmp in ipip_err
  ppp: fix race in ppp device destruction
  sctp: reset owner sk for data chunks on out queues when migrating a sock
  tun: allow positive return values on dev_get_valid_name() call
  ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err
  net/unix: don't show information about sockets from other namespaces
  ipv6: flowlabel: do not leave opt->tot_len with garbage
  packet: avoid panic in packet_getsockopt()
  sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect
  tun: call dev_get_valid_name() before register_netdevice()
  l2tp: check ps->sock before running pppol2tp_session_ioctl()
  tcp: fix tcp_mtu_probe() vs highest_sack
  tun/tap: sanitize TUNSETSNDBUF input
  ALSA: seq: Cancel pending autoload work at unbinding device
  Input: ims-psu - check if CDC union descriptor is sane
  usb: usbtest: fix NULL pointer dereference
  mac80211: don't compare TKIP TX MIC key in reinstall prevention
  mac80211: use constant time comparison with keys
  mac80211: accept key reinstall without changing anything
  FROMLIST: binder: fix proc->files use-after-free

Change-Id: I9aaf4f803a5da1fc983879a214b2fddda7879f41
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

4 files changed, 29 insertions, 3 deletions

diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 79de9608ac48..ed96fdefd8e5 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -1117,6 +1117,8 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
 	case TUNSETSNDBUF:
 		if (get_user(s, sp))
 			return -EFAULT;
+		if (s <= 0)
+			return -EINVAL;
 
 		q->sk.sk_sndbuf = s;
 		return 0;
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index e5bb870b5461..dc454138d600 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1110,7 +1110,17 @@ ppp_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats64)
 static struct lock_class_key ppp_tx_busylock;
 static int ppp_dev_init(struct net_device *dev)
 {
+	struct ppp *ppp;
+
 	dev->qdisc_tx_busylock = &ppp_tx_busylock;
+
+	ppp = netdev_priv(dev);
+	/* Let the netdevice take a reference on the ppp file. This ensures
+	 * that ppp_destroy_interface() won't run before the device gets
+	 * unregistered.
+	 */
+	atomic_inc(&ppp->file.refcnt);
+
 	return 0;
 }
 
@@ -1133,6 +1143,15 @@ static void ppp_dev_uninit(struct net_device *dev)
 	wake_up_interruptible(&ppp->file.rwait);
 }
 
+static void ppp_dev_priv_destructor(struct net_device *dev)
+{
+	struct ppp *ppp;
+
+	ppp = netdev_priv(dev);
+	if (atomic_dec_and_test(&ppp->file.refcnt))
+		ppp_destroy_interface(ppp);
+}
+
 static const struct net_device_ops ppp_netdev_ops = {
 	.ndo_init	 = ppp_dev_init,
 	.ndo_uninit      = ppp_dev_uninit,
@@ -1150,6 +1169,7 @@ static void ppp_setup(struct net_device *dev)
 	dev->tx_queue_len = 3;
 	dev->type = ARPHRD_PPP;
 	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+	dev->destructor = ppp_dev_priv_destructor;
 	netif_keep_dst(dev);
 }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 89ad2b750531..1b0184b3818a 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1685,6 +1685,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
 		if (!dev)
 			return -ENOMEM;
+		err = dev_get_valid_name(net, dev, name);
+		if (err < 0)
+			goto err_free_dev;
 
 		dev_net_set(dev, net);
 		dev->rtnl_link_ops = &tun_link_ops;
@@ -2072,6 +2075,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
 			ret = -EFAULT;
 			break;
 		}
+		if (sndbuf <= 0) {
+			ret = -EINVAL;
+			break;
+		}
 
 		tun->sndbuf = sndbuf;
 		tun_set_sndbuf(tun);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index 5fecae0ba52e..83e5aa6a9f28 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -4295,9 +4295,6 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev)
 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0);
 		if (err < 0)
 			brcmf_err("setting AP mode failed %d\n", err);
-		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0);
-		if (err < 0)
-			brcmf_err("setting INFRA mode failed %d\n", err);
 		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS))
 			brcmf_fil_iovar_int_set(ifp, "mbss", 0);
 		err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY,