Merge 4.4.260 into android-4.4-p

Changes in 4.4.260
	futex: Ensure the correct return value from futex_lock_pi()
	net: usb: qmi_wwan: support ZTE P685M modem
	iwlwifi: pcie: fix to correct null check
	mmc: sdhci-esdhc-imx: fix kernel panic when remove module
	scripts: use pkg-config to locate libcrypto
	scripts: set proper OpenSSL include dir also for sign-file
	hugetlb: fix update_and_free_page contig page struct assumption
	JFS: more checks for invalid superblock
	xfs: Fix assert failure in xfs_setattr_size()
	net: fix up truesize of cloned skb in skb_prepare_for_shift()
	mm/hugetlb.c: fix unnecessary address expansion of pmd sharing
	staging: fwserial: Fix error handling in fwserial_create
	x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk
	vt/consolemap: do font sum unsigned
	wlcore: Fix command execute failure 19 for wl12xx
	pktgen: fix misuse of BUG_ON() in pktgen_thread_worker()
	ath10k: fix wmi mgmt tx queue full due to race condition
	x86/build: Treat R_386_PLT32 relocation as R_386_PC32
	Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data
	staging: most: sound: add sanity check for function argument
	media: uvcvideo: Allow entities with no pads
	scsi: iscsi: Restrict sessions and handles to admin capabilities
	sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output
	scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE
	scsi: iscsi: Verify lengths on passthrough PDUs
	Xen/gnttab: handle p2m update errors on a per-slot basis
	xen-netback: respect gnttab_map_refs()'s return value
	zsmalloc: account the number of compacted pages correctly
	swap: fix swapfile read/write offset
	media: v4l: ioctl: Fix memory leak in video_usercopy
	Linux 4.4.260

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic12a2f4dc153baf99cb1716d41b4dd6024ad4317

1 files changed, 12 insertions, 12 deletions

diff --git a/kernel/futex.c b/kernel/futex.c
index 70ad21bbb1d5..a14b7ef90e5c 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2283,7 +2283,7 @@ retry:
 		}
 
 		if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
-			/* We got the lock after all, nothing to fix. */
+			/* We got the lock. pi_state is correct. Tell caller */
 			return 1;
 		}
 
@@ -2328,7 +2328,7 @@ retry:
 	 */
 	pi_state_update_owner(pi_state, newowner);
 
-	return 0;
+	return argowner == current;
 
 	/*
 	 * To handle the page fault we need to drop the hash bucket
@@ -2411,8 +2411,6 @@ static long futex_wait_restart(struct restart_block *restart);
  */
 static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 {
-	int ret = 0;
-
 	if (locked) {
 		/*
 		 * Got the lock. We might not be the anticipated owner if we
@@ -2423,8 +2421,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 		 * stable state, anything else needs more attention.
 		 */
 		if (q->pi_state->owner != current)
-			ret = fixup_pi_state_owner(uaddr, q, current);
-		goto out;
+			return fixup_pi_state_owner(uaddr, q, current);
+		return 1;
 	}
 
 	/*
@@ -2435,10 +2433,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 	 * Another speculative read; pi_state->owner == current is unstable
 	 * but needs our attention.
 	 */
-	if (q->pi_state->owner == current) {
-		ret = fixup_pi_state_owner(uaddr, q, NULL);
-		goto out;
-	}
+	if (q->pi_state->owner == current)
+		return fixup_pi_state_owner(uaddr, q, NULL);
 
 	/*
 	 * Paranoia check. If we did not take the lock, then we should not be
@@ -2447,8 +2443,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
 	if (WARN_ON_ONCE(rt_mutex_owner(&q->pi_state->pi_mutex) == current))
 		return fixup_pi_state_owner(uaddr, q, current);
 
-out:
-	return ret ? ret : locked;
+	return 0;
 }
 
 /**
@@ -3070,6 +3065,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 			 */
 			free_pi_state(q.pi_state);
 			spin_unlock(q.lock_ptr);
+			/*
+			 * Adjust the return value. It's either -EFAULT or
+			 * success (1) but the caller expects 0 for success.
+			 */
+			ret = ret < 0 ? ret : 0;
 		}
 	} else {
 		struct rt_mutex *pi_mutex;