Merge 4.4.163 into android-4.4

Changes in 4.4.163
	xfrm: Validate address prefix lengths in the xfrm selector.
	xfrm6: call kfree_skb when skb is toobig
	mac80211: Always report TX status
	cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
	ARM: 8799/1: mm: fix pci_ioremap_io() offset check
	xfrm: validate template mode
	mac80211_hwsim: do not omit multicast announce of first added radio
	Bluetooth: SMP: fix crash in unpairing
	pxa168fb: prepare the clock
	asix: Check for supported Wake-on-LAN modes
	ax88179_178a: Check for supported Wake-on-LAN modes
	lan78xx: Check for supported Wake-on-LAN modes
	sr9800: Check for supported Wake-on-LAN modes
	r8152: Check for supported Wake-on-LAN Modes
	smsc75xx: Check for Wake-on-LAN modes
	smsc95xx: Check for Wake-on-LAN modes
	perf/ring_buffer: Prevent concurent ring buffer access
	net: cxgb3_main: fix a missing-check bug
	KEYS: put keyring if install_session_keyring_to_cred() fails
	ipv6: suppress sparse warnings in IP6_ECN_set_ce()
	net: drop write-only stack variable
	ser_gigaset: use container_of() instead of detour
	tracing: Skip more functions when doing stack tracing of events
	ARM: dts: apq8064: add ahci ports-implemented mask
	x86/mm/pat: Prevent hang during boot when mapping pages
	radix-tree: fix radix_tree_iter_retry() for tagged iterators.
	af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers
	net/mlx4_en: Resolve dividing by zero in 32-bit system
	ipv6: orphan skbs in reassembly unit
	um: Avoid longjmp/setjmp symbol clashes with libpthread.a
	sched/cgroup: Fix cgroup entity load tracking tear-down
	btrfs: don't create or leak aliased root while cleaning up orphans
	thermal: allow spear-thermal driver to be a module
	thermal: allow u8500-thermal driver to be a module
	tpm: fix: return rc when devm_add_action() fails
	x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
	aacraid: Start adapter after updating number of MSIX vectors
	perf/core: Don't leak event in the syscall error path
	usbvision: revert commit 588afcc1
	MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue
	ASoC: ak4613: Enable cache usage to fix crashes on resume
	ASoC: wm8940: Enable cache usage to fix crashes on resume
	CIFS: handle guest access errors to Windows shares
	arm64: Fix potential race with hardware DBM in ptep_set_access_flags()
	xfrm: Clear sk_dst_cache when applying per-socket policy.
	scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
	sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata
	sch_red: update backlog as well
	usb-storage: fix bogus hardware error messages for ATA pass-thru devices
	bpf: generally move prog destruction to RCU deferral
	drm/nouveau/fbcon: fix oops without fbdev emulation
	fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio
	ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector
	net/mlx5e: Fix LRO modify
	net/mlx5e: Correctly handle RSS indirection table when changing number of channels
	ixgbe: fix RSS limit for X550
	ixgbe: Correct X550EM_x revision check
	ALSA: timer: Fix zero-division by continue of uninitialized instance
	vti6: flush x-netns xfrm cache when vti interface is removed
	gro: Allow tunnel stacking in the case of FOU/GUE
	brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
	l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()
	tty: serial: sprd: fix error return code in sprd_probe()
	video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe()
	sparc64 mm: Fix more TSB sizing issues
	gpu: host1x: fix error return code in host1x_probe()
	sparc64: Fix exception handling in UltraSPARC-III memcpy.
	gpio: msic: fix error return code in platform_msic_gpio_probe()
	usb: imx21-hcd: fix error return code in imx21_probe()
	usb: ehci-omap: fix error return code in ehci_hcd_omap_probe()
	usb: dwc3: omap: fix error return code in dwc3_omap_probe()
	spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe()
	MIPS: Handle non word sized instructions when examining frame
	spi/bcm63xx: fix error return code in bcm63xx_spi_probe()
	spi: xlp: fix error return code in xlp_spi_probe()
	ASoC: spear: fix error return code in spdif_in_probe()
	PM / devfreq: tegra: fix error return code in tegra_devfreq_probe()
	bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal
	scsi: aacraid: Fix typo in blink status
	MIPS: microMIPS: Fix decoding of swsp16 instruction
	igb: Remove superfluous reset to PHY and page 0 selection
	MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression
	ARM: dts: imx53-qsb: disable 1.2GHz OPP
	fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
	mtd: spi-nor: Add support for is25wp series chips
	perf tools: Disable parallelism for 'make clean'
	bridge: do not add port to router list when receives query with source 0.0.0.0
	net: bridge: remove ipv6 zero address check in mcast queries
	ipv6: mcast: fix a use-after-free in inet6_mc_check
	ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called
	net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs
	net: sched: gred: pass the right attribute to gred_change_table_def()
	net: socket: fix a missing-check bug
	net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
	r8169: fix NAPI handling under high load
	sctp: fix race on sctp_id2asoc
	net: drop skb on failure in ip_check_defrag()
	vhost: Fix Spectre V1 vulnerability
	rtnetlink: Disallow FDB configuration for non-Ethernet device
	mremap: properly flush TLB before releasing the page
	crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned
	ahci: don't ignore result code of ahci_reset_controller()
	cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
	ptp: fix Spectre v1 vulnerability
	RDMA/ucma: Fix Spectre v1 vulnerability
	IB/ucm: Fix Spectre v1 vulnerability
	cdc-acm: correct counting of UART states in serial state notification
	usb: gadget: storage: Fix Spectre v1 vulnerability
	USB: fix the usbfs flag sanitization for control transfers
	Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
	sched/fair: Fix throttle_list starvation with low CFS quota
	x86/percpu: Fix this_cpu_read()
	cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE
	l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6
	x86/time: Correct the attribute on jiffies' definition
	Linux 4.4.163

Change-Id: Idb0efd175853886145a1fb7eaaf18797c39e5f6f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

3 files changed, 29 insertions, 10 deletions

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index b1b0a1c0bd8d..ecc3da6a14a1 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -3083,9 +3083,8 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 	/* LE address type */
 	addr_type = le_addr_type(cp->addr.type);
 
-	hci_remove_irk(hdev, &cp->addr.bdaddr, addr_type);
-
-	err = hci_remove_ltk(hdev, &cp->addr.bdaddr, addr_type);
+	/* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */
+	err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type);
 	if (err < 0) {
 		err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE,
 					MGMT_STATUS_NOT_PAIRED, &rp,
@@ -3099,8 +3098,6 @@ static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 		goto done;
 	}
 
-	/* Abort any ongoing SMP pairing */
-	smp_cancel_pairing(conn);
 
 	/* Defer clearing up the connection parameters until closing to
 	 * give a chance of keeping them if a repairing happens.
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 0dc27d2e8f18..bedfaef2c59e 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2371,30 +2371,51 @@ unlock:
 	return ret;
 }
 
-void smp_cancel_pairing(struct hci_conn *hcon)
+int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
+				  u8 addr_type)
 {
-	struct l2cap_conn *conn = hcon->l2cap_data;
+	struct hci_conn *hcon;
+	struct l2cap_conn *conn;
 	struct l2cap_chan *chan;
 	struct smp_chan *smp;
+	int err;
+
+	err = hci_remove_ltk(hdev, bdaddr, addr_type);
+	hci_remove_irk(hdev, bdaddr, addr_type);
+
+	hcon = hci_conn_hash_lookup_le(hdev, bdaddr, addr_type);
+	if (!hcon)
+		goto done;
 
+	conn = hcon->l2cap_data;
 	if (!conn)
-		return;
+		goto done;
 
 	chan = conn->smp;
 	if (!chan)
-		return;
+		goto done;
 
 	l2cap_chan_lock(chan);
 
 	smp = chan->data;
 	if (smp) {
+		/* Set keys to NULL to make sure smp_failure() does not try to
+		 * remove and free already invalidated rcu list entries. */
+		smp->ltk = NULL;
+		smp->slave_ltk = NULL;
+		smp->remote_irk = NULL;
+
 		if (test_bit(SMP_FLAG_COMPLETE, &smp->flags))
 			smp_failure(conn, 0);
 		else
 			smp_failure(conn, SMP_UNSPECIFIED);
+		err = 0;
 	}
 
 	l2cap_chan_unlock(chan);
+
+done:
+	return err;
 }
 
 static int smp_cmd_encrypt_info(struct l2cap_conn *conn, struct sk_buff *skb)
diff --git a/net/bluetooth/smp.h b/net/bluetooth/smp.h
index ffcc70b6b199..993cbd7bcfe7 100644
--- a/net/bluetooth/smp.h
+++ b/net/bluetooth/smp.h
@@ -180,7 +180,8 @@ enum smp_key_pref {
 };
 
 /* SMP Commands */
-void smp_cancel_pairing(struct hci_conn *hcon);
+int smp_cancel_and_remove_pairing(struct hci_dev *hdev, bdaddr_t *bdaddr,
+				  u8 addr_type);
 bool smp_sufficient_security(struct hci_conn *hcon, u8 sec_level,
 			     enum smp_key_pref key_pref);
 int smp_conn_security(struct hci_conn *hcon, __u8 sec_level);