Merge 4.4.161 into android-4.4

Changes in 4.4.161
	mm/vmstat.c: skip NR_TLB_REMOTE_FLUSH* properly
	fbdev/omapfb: fix omapfb_memory_read infoleak
	x86/vdso: Fix asm constraints on vDSO syscall fallbacks
	x86/vdso: Fix vDSO syscall fallback asm constraint regression
	PCI: Reprogram bridge prefetch registers on resume
	mac80211: fix setting IEEE80211_KEY_FLAG_RX_MGMT for AP mode keys
	PM / core: Clear the direct_complete flag on errors
	dm cache: fix resize crash if user doesn't reload cache table
	xhci: Add missing CAS workaround for Intel Sunrise Point xHCI
	USB: serial: simple: add Motorola Tetra MTP6550 id
	of: unittest: Disable interrupt node tests for old world MAC systems
	ext4: always verify the magic number in xattr blocks
	cgroup: Fix deadlock in cpu hotplug path
	ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait
	powerpc/fadump: Return error when fadump registration fails
	ARC: clone syscall to setp r25 as thread pointer
	ucma: fix a use-after-free in ucma_resolve_ip()
	ubifs: Check for name being NULL while mounting
	tcp: increment sk_drops for dropped rx packets
	tcp: use an RB tree for ooo receive queue
	tcp: fix a stale ooo_last_skb after a replace
	tcp: free batches of packets in tcp_prune_ofo_queue()
	tcp: call tcp_drop() from tcp_data_queue_ofo()
	tcp: add tcp_ooo_try_coalesce() helper
	ath10k: fix scan crash due to incorrect length calculation
	ebtables: arpreply: Add the standard target sanity check
	Linux 4.4.161

Change-Id: I4c6607d0be0977857f966b048279590470c854c2
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

5 files changed, 24 insertions, 5 deletions

diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 2ea517c7c6b9..bffd096fae3b 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -125,4 +125,9 @@ extern unsigned int ebt_do_table(struct sk_buff *skb,
 /* True if the target is not a standard target */
 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
 
+static inline bool ebt_invalid_target(int target)
+{
+	return (target < -NUM_STANDARD_TARGETS || target >= 0);
+}
+
 #endif
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index c28bd8be290a..a490dd718654 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2273,6 +2273,8 @@ static inline void __skb_queue_purge(struct sk_buff_head *list)
 		kfree_skb(skb);
 }
 
+void skb_rbtree_purge(struct rb_root *root);
+
 void *netdev_alloc_frag(unsigned int fragsz);
 
 struct sk_buff *__netdev_alloc_skb(struct net_device *dev, unsigned int length,
@@ -2807,6 +2809,12 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len)
 	return __pskb_trim(skb, len);
 }
 
+#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode)
+#define skb_rb_first(root) rb_to_skb(rb_first(root))
+#define skb_rb_last(root)  rb_to_skb(rb_last(root))
+#define skb_rb_next(skb)   rb_to_skb(rb_next(&(skb)->rbnode))
+#define skb_rb_prev(skb)   rb_to_skb(rb_prev(&(skb)->rbnode))
+
 #define skb_queue_walk(queue, skb) \
 		for (skb = (queue)->next;					\
 		     skb != (struct sk_buff *)(queue);				\
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 5b6df1a8dc74..747404dbe506 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -279,10 +279,9 @@ struct tcp_sock {
 	struct sk_buff* lost_skb_hint;
 	struct sk_buff *retransmit_skb_hint;
 
-	/* OOO segments go in this list. Note that socket lock must be held,
-	 * as we do not use sk_buff_head lock.
-	 */
-	struct sk_buff_head	out_of_order_queue;
+	/* OOO segments go in this rbtree. Socket lock must be held. */
+	struct rb_root	out_of_order_queue;
+	struct sk_buff	*ooo_last_skb; /* cache rb_last(out_of_order_queue) */
 
 	/* SACKs data, these 2 need to be together (see tcp_options_write) */
 	struct tcp_sack_block duplicate_sack[1]; /* D-SACK block */
diff --git a/include/net/sock.h b/include/net/sock.h
index 62c9e2268d63..5b1a71559325 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2147,6 +2147,13 @@ sock_skb_set_dropcount(const struct sock *sk, struct sk_buff *skb)
 	SOCK_SKB_CB(skb)->dropcount = atomic_read(&sk->sk_drops);
 }
 
+static inline void sk_drops_add(struct sock *sk, const struct sk_buff *skb)
+{
+	int segs = max_t(u16, 1, skb_shinfo(skb)->gso_segs);
+
+	atomic_add(segs, &sk->sk_drops);
+}
+
 void __sock_recv_timestamp(struct msghdr *msg, struct sock *sk,
 			   struct sk_buff *skb);
 void __sock_recv_wifi_status(struct msghdr *msg, struct sock *sk,
diff --git a/include/net/tcp.h b/include/net/tcp.h
index ef2f863275cf..c6a4c41674e7 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -650,7 +650,7 @@ static inline void tcp_fast_path_check(struct sock *sk)
 {
 	struct tcp_sock *tp = tcp_sk(sk);
 
-	if (skb_queue_empty(&tp->out_of_order_queue) &&
+	if (RB_EMPTY_ROOT(&tp->out_of_order_queue) &&
 	    tp->rcv_wnd &&
 	    atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf &&
 	    !tp->urg_data)