Merge 4.4.217 into android-4.4-p

Changes in 4.4.217
	NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
	r8152: check disconnect status after long sleep
	net: nfc: fix bounds checking bugs on "pipe"
	bnxt_en: reinitialize IRQs when MTU is modified
	fib: add missing attribute validation for tun_id
	nl802154: add missing attribute validation
	nl802154: add missing attribute validation for dev_type
	team: add missing attribute validation for port ifindex
	team: add missing attribute validation for array index
	nfc: add missing attribute validation for SE API
	nfc: add missing attribute validation for vendor subcommand
	ipvlan: add cond_resched_rcu() while processing muticast backlog
	ipvlan: do not add hardware address of master to its unicast filter list
	ipvlan: egress mcast packets are not exceptional
	ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
	ipvlan: don't deref eth hdr before checking it's set
	macvlan: add cond_resched() during multicast processing
	net: fec: validate the new settings in fec_enet_set_coalesce()
	slip: make slhc_compress() more robust against malicious packets
	bonding/alb: make sure arp header is pulled before accessing it
	net: fq: add missing attribute validation for orphan mask
	iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
	drm/amd/display: remove duplicated assignment to grph_obj_type
	gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
	KVM: x86: clear stale x86_emulate_ctxt->intercept value
	ARC: define __ALIGN_STR and __ALIGN symbols for ARC
	efi: Fix a race and a buffer overflow while reading efivars via sysfs
	iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
	iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
	nl80211: add missing attribute validation for critical protocol indication
	nl80211: add missing attribute validation for channel switch
	netfilter: cthelper: add missing attribute validation for cthelper
	iommu/vt-d: Fix the wrong printing in RHSA parsing
	iommu/vt-d: Ignore devices with out-of-spec domain number
	mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
	ipv6: restrict IPV6_ADDRFORM operation
	efi: Add a sanity check to efivar_store_raw()
	batman-adv: Fix invalid read while copying bat_iv.bcast_own
	batman-adv: Only put gw_node list reference when removed
	batman-adv: Only put orig_node_vlan list reference when removed
	batman-adv: Avoid endless loop in bat-on-bat netdevice check
	batman-adv: Fix unexpected free of bcast_own on add_if error
	batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
	batman-adv: init neigh node last seen field
	batman-adv: Deactivate TO_BE_ACTIVATED hardif on shutdown
	batman-adv: Drop reference to netdevice on last reference
	batman-adv: Fix reference counting of vlan object for tt_local_entry
	batman-adv: Avoid duplicate neigh_node additions
	batman-adv: fix skb deref after free
	batman-adv: Fix use-after-free/double-free of tt_req_node
	batman-adv: Fix ICMP RR ethernet access after skb_linearize
	batman-adv: Clean up untagged vlan when destroying via rtnl-link
	batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag
	batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag
	batman-adv: Fix orig_node_vlan leak on orig_node_release
	batman-adv: lock crc access in bridge loop avoidance
	batman-adv: Fix non-atomic bla_claim::backbone_gw access
	batman-adv: Fix reference leak in batadv_find_router
	batman-adv: Free last_bonding_candidate on release of orig_node
	batman-adv: Fix speedy join in gateway client mode
	batman-adv: Add missing refcnt for last_candidate
	batman-adv: Fix double free during fragment merge error
	batman-adv: Fix transmission of final, 16th fragment
	batman-adv: Fix rx packet/bytes stats on local ARP reply
	batman-adv: fix TT sync flag inconsistencies
	batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
	batman-adv: Fix internal interface indices types
	batman-adv: update data pointers after skb_cow()
	batman-adv: Fix skbuff rcsum on packet reroute
	batman-adv: Avoid race in TT TVLV allocator helper
	batman-adv: Fix TT sync flags for intermediate TT responses
	batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
	batman-adv: Fix debugfs path for renamed hardif
	batman-adv: Fix debugfs path for renamed softif
	batman-adv: Avoid storing non-TT-sync flags on singular entries too
	batman-adv: Prevent duplicated gateway_node entry
	batman-adv: Prevent duplicated nc_node entry
	batman-adv: Prevent duplicated global TT entry
	batman-adv: Prevent duplicated tvlv handler
	batman-adv: Reduce claim hash refcnt only for removed entry
	batman-adv: Reduce tt_local hash refcnt only for removed entry
	batman-adv: Reduce tt_global hash refcnt only for removed entry
	batman-adv: Only read OGM tvlv_len after buffer len check
	batman-adv: Avoid free/alloc race when handling OGM buffer
	batman-adv: Don't schedule OGM for disabled interface
	perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
	net: ks8851-ml: Fix IRQ handling and locking
	signal: avoid double atomic counter increments for user accounting
	jbd2: fix data races at struct journal_head
	ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
	ARM: 8958/1: rename missed uaccess .fixup section
	mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
	ipv4: ensure rcu_read_lock() in cipso_v4_error()
	Linux 4.4.217

Change-Id: Ic8c9ec91c66a9a0bb0b6291ad0a5101d18889a67
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 15 insertions, 18 deletions

diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index d0956f726547..86c69208da2b 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -828,19 +828,29 @@ static struct batadv_nc_node
 	spinlock_t *lock; /* Used to lock list selected by "int in_coding" */
 	struct list_head *list;
 
+	/* Select ingoing or outgoing coding node */
+	if (in_coding) {
+		lock = &orig_neigh_node->in_coding_list_lock;
+		list = &orig_neigh_node->in_coding_list;
+	} else {
+		lock = &orig_neigh_node->out_coding_list_lock;
+		list = &orig_neigh_node->out_coding_list;
+	}
+
+	spin_lock_bh(lock);
+
 	/* Check if nc_node is already added */
 	nc_node = batadv_nc_find_nc_node(orig_node, orig_neigh_node, in_coding);
 
 	/* Node found */
 	if (nc_node)
-		return nc_node;
+		goto unlock;
 
 	nc_node = kzalloc(sizeof(*nc_node), GFP_ATOMIC);
 	if (!nc_node)
-		return NULL;
+		goto unlock;
 
-	if (!atomic_inc_not_zero(&orig_neigh_node->refcount))
-		goto free;
+	atomic_inc(&orig_neigh_node->refcount);
 
 	/* Initialize nc_node */
 	INIT_LIST_HEAD(&nc_node->list);
@@ -848,28 +858,15 @@ static struct batadv_nc_node
 	nc_node->orig_node = orig_neigh_node;
 	atomic_set(&nc_node->refcount, 2);
 
-	/* Select ingoing or outgoing coding node */
-	if (in_coding) {
-		lock = &orig_neigh_node->in_coding_list_lock;
-		list = &orig_neigh_node->in_coding_list;
-	} else {
-		lock = &orig_neigh_node->out_coding_list_lock;
-		list = &orig_neigh_node->out_coding_list;
-	}
-
 	batadv_dbg(BATADV_DBG_NC, bat_priv, "Adding nc_node %pM -> %pM\n",
 		   nc_node->addr, nc_node->orig_node->orig);
 
 	/* Add nc_node to orig_node */
-	spin_lock_bh(lock);
 	list_add_tail_rcu(&nc_node->list, list);
+unlock:
 	spin_unlock_bh(lock);
 
 	return nc_node;
-
-free:
-	kfree(nc_node);
-	return NULL;
 }
 
 /**