Merge 4.4.215 into android-4.4-p

Changes in 4.4.215
	x86/vdso: Use RDPID in preference to LSL when available
	KVM: x86: emulate RDPID
	ALSA: hda: Use scnprintf() for printing texts for sysfs/procfs
	ecryptfs: fix a memory leak bug in parse_tag_1_packet()
	ecryptfs: fix a memory leak bug in ecryptfs_init_messaging()
	ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
	ubifs: Fix deadlock in concurrent bulk-read and writepage
	ext4: fix checksum errors with indexed dirs
	Btrfs: fix race between using extent maps and merging them
	btrfs: log message when rw remount is attempted with unclean tree-log
	padata: Remove broken queue flushing
	s390/time: Fix clk type in get_tod_clock
	hwmon: (pmbus/ltc2978) Fix PMBus polling of MFR_COMMON definitions.
	jbd2: move the clearing of b_modified flag to the journal_unmap_buffer()
	jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer
	btrfs: print message when tree-log replay starts
	scsi: qla2xxx: fix a potential NULL pointer dereference
	Revert "KVM: VMX: Add non-canonical check on writes to RTIT address MSRs"
	drm/gma500: Fixup fbdev stolen size usage evaluation
	brcmfmac: Fix use after free in brcmf_sdio_readframes()
	gianfar: Fix TX timestamping with a stacked DSA driver
	pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
	media: i2c: mt9v032: fix enum mbus codes and frame sizes
	media: sti: bdisp: fix a possible sleep-in-atomic-context bug in bdisp_device_run()
	efi/x86: Map the entire EFI vendor string before copying it
	MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init()
	uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()
	usb: gadget: udc: fix possible sleep-in-atomic-context bugs in gr_probe()
	nfs: NFS_SWAP should depend on SWAP
	jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
	tracing: Fix very unlikely race of registering two stat tracers
	ext4, jbd2: ensure panic when aborting with zero errno
	kconfig: fix broken dependency in randconfig-generated .config
	clk: qcom: rcg2: Don't crash if our parent can't be found; return an error
	drm/amdgpu: remove 4 set but not used variable in amdgpu_atombios_get_connector_info_from_object_table
	regulator: rk808: Lower log level on optional GPIOs being not available
	NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use le16_add_cpu().
	reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
	ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
	b43legacy: Fix -Wcast-function-type
	ipw2x00: Fix -Wcast-function-type
	iwlegacy: Fix -Wcast-function-type
	rtlwifi: rtl_pci: Fix -Wcast-function-type
	orinoco: avoid assertion in case of NULL pointer
	ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
	scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
	ARM: dts: r8a7779: Add device node for ARM global timer
	x86/vdso: Provide missing include file
	pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
	ALSA: sh: Fix compile warning wrt const
	tools lib api fs: Fix gcc9 stringop-truncation compilation error
	usbip: Fix unsafe unaligned pointer usage
	soc/tegra: fuse: Correct straps' address for older Tegra124 device trees
	rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
	Input: edt-ft5x06 - work around first register access error
	wan: ixp4xx_hss: fix compile-testing on 64-bit
	ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
	PCI: Don't disable bridge BARs when assigning bus resources
	driver core: Print device when resources present in really_probe()
	drm/nouveau: Fix copy-paste error in nouveau_fence_wait_uevent_handler
	drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
	iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
	scsi: iscsi: Don't destroy session if there are outstanding connections
	cmd64x: potential buffer overflow in cmd64x_program_timings()
	ide: serverworks: potential overflow in svwks_set_pio_mode()
	remoteproc: Initialize rproc_class before use
	s390/ftrace: generate traced function stack frame
	ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
	jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
	ARM: 8951/1: Fix Kexec compilation issue.
	hostap: Adjust indentation in prism2_hostapd_add_sta
	iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop
	drm/nouveau/disp/nv50-: prevent oops when no channel method map provided
	trigger_next should increase position index
	radeon: insert 10ms sleep in dce5_crtc_load_lut
	ocfs2: fix a NULL pointer dereference when call ocfs2_update_inode_fsync_trans()
	lib/scatterlist.c: adjust indentation in __sg_alloc_table
	reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
	bcache: explicity type cast in bset_bkey_last()
	irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when building INVALL
	microblaze: Prevent the overflow of the start
	brd: check and limit max_part par
	selinux: ensure we cleanup the internal AVC counters on error in avc_update()
	enic: prevent waking up stopped tx queues over watchdog reset
	floppy: check FDC index for errors before assigning it
	staging: android: ashmem: Disallow ashmem memory from being remapped
	staging: vt6656: fix sign of rx_dbm to bb_pre_ed_rssi.
	usb: uas: fix a plug & unplug racing
	USB: Fix novation SourceControl XL after suspend
	USB: hub: Don't record a connect-change event during reset-resume
	staging: rtl8188eu: Fix potential security hole
	staging: rtl8188eu: Fix potential overuse of kernel memory
	x86/mce/amd: Fix kobject lifetime
	tty: serial: imx: setup the correct sg entry for tx dma
	Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"
	xhci: apply XHCI_PME_STUCK_QUIRK to Intel Comet Lake platforms
	VT_RESIZEX: get rid of field-by-field copyin
	vt: vt_ioctl: fix race in VT_RESIZEX
	KVM: nVMX: Don't emulate instructions in guest mode
	netfilter: xt_bpf: add overflow checks
	ext4: fix a data race in EXT4_I(inode)->i_disksize
	ext4: add cond_resched() to __ext4_find_entry()
	KVM: nVMX: Refactor IO bitmap checks into helper function
	KVM: nVMX: Check IO instruction VM-exit conditions
	KVM: apic: avoid calculating pending eoi from an uninitialized val
	Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents
	scsi: Revert "RDMA/isert: Fix a recently introduced regression related to logout"
	scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"
	ecryptfs: replace BUG_ON with error handling code
	ALSA: rawmidi: Avoid bit fields for state flags
	ALSA: seq: Avoid concurrent access to queue flags
	ALSA: seq: Fix concurrent access to queue current tick/time
	xen: Enable interrupts when calling _cond_resched()
	Linux 4.4.215

Change-Id: I32c4136741a79ab940022d590d5ace780290acbb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 27 insertions, 23 deletions

diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index ebbd7d054cab..a7d12dd6d56e 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -797,7 +797,7 @@ start_journal_io:
 		err = journal_submit_commit_record(journal, commit_transaction,
 						 &cbh, crc32_sum);
 		if (err)
-			__jbd2_journal_abort_hard(journal);
+			jbd2_journal_abort(journal, err);
 	}
 
 	blk_finish_plug(&plug);
@@ -890,7 +890,7 @@ start_journal_io:
 		err = journal_submit_commit_record(journal, commit_transaction,
 						&cbh, crc32_sum);
 		if (err)
-			__jbd2_journal_abort_hard(journal);
+			jbd2_journal_abort(journal, err);
 	}
 	if (cbh)
 		err = journal_wait_on_commit_record(journal, cbh);
@@ -987,29 +987,33 @@ restart_loop:
 		 * it. */
 
 		/*
-		* A buffer which has been freed while still being journaled by
-		* a previous transaction.
-		*/
-		if (buffer_freed(bh)) {
+		 * A buffer which has been freed while still being journaled
+		 * by a previous transaction, refile the buffer to BJ_Forget of
+		 * the running transaction. If the just committed transaction
+		 * contains "add to orphan" operation, we can completely
+		 * invalidate the buffer now. We are rather through in that
+		 * since the buffer may be still accessible when blocksize <
+		 * pagesize and it is attached to the last partial page.
+		 */
+		if (buffer_freed(bh) && !jh->b_next_transaction) {
+			struct address_space *mapping;
+
+			clear_buffer_freed(bh);
+			clear_buffer_jbddirty(bh);
+
 			/*
-			 * If the running transaction is the one containing
-			 * "add to orphan" operation (b_next_transaction !=
-			 * NULL), we have to wait for that transaction to
-			 * commit before we can really get rid of the buffer.
-			 * So just clear b_modified to not confuse transaction
-			 * credit accounting and refile the buffer to
-			 * BJ_Forget of the running transaction. If the just
-			 * committed transaction contains "add to orphan"
-			 * operation, we can completely invalidate the buffer
-			 * now. We are rather through in that since the
-			 * buffer may be still accessible when blocksize <
-			 * pagesize and it is attached to the last partial
-			 * page.
+			 * Block device buffers need to stay mapped all the
+			 * time, so it is enough to clear buffer_jbddirty and
+			 * buffer_freed bits. For the file mapping buffers (i.e.
+			 * journalled data) we need to unmap buffer and clear
+			 * more bits. We also need to be careful about the check
+			 * because the data page mapping can get cleared under
+			 * out hands, which alse need not to clear more bits
+			 * because the page and buffers will be freed and can
+			 * never be reused once we are done with them.
 			 */
-			jh->b_modified = 0;
-			if (!jh->b_next_transaction) {
-				clear_buffer_freed(bh);
-				clear_buffer_jbddirty(bh);
+			mapping = READ_ONCE(bh->b_page->mapping);
+			if (mapping && !sb_is_blkdev_sb(mapping->host->i_sb)) {
 				clear_buffer_mapped(bh);
 				clear_buffer_new(bh);
 				clear_buffer_req(bh);