Merge 4.4.71 into android-4.4

Changes in 4.4.71
	sparc: Fix -Wstringop-overflow warning
	dccp/tcp: do not inherit mc_list from parent
	ipv6/dccp: do not inherit ipv6_mc_list from parent
	s390/qeth: handle sysfs error during initialization
	s390/qeth: unbreak OSM and OSN support
	s390/qeth: avoid null pointer dereference on OSN
	tcp: avoid fragmenting peculiar skbs in SACK
	sctp: fix src address selection if using secondary addresses for ipv6
	sctp: do not inherit ipv6_{mc|ac|fl}_list from parent
	tcp: eliminate negative reordering in tcp_clean_rtx_queue
	net: Improve handling of failures on link and route dumps
	ipv6: Prevent overrun when parsing v6 header options
	ipv6: Check ip6_find_1stfragopt() return value properly.
	bridge: netlink: check vlan_default_pvid range
	qmi_wwan: add another Lenovo EM74xx device ID
	bridge: start hello_timer when enabling KERNEL_STP in br_stp_start
	ipv6: fix out of bound writes in __ip6_append_data()
	be2net: Fix offload features for Q-in-Q packets
	virtio-net: enable TSO/checksum offloads for Q-in-Q vlans
	tcp: avoid fastopen API to be used on AF_UNSPEC
	sctp: fix ICMP processing if skb is non-linear
	ipv4: add reference counting to metrics
	netem: fix skb_orphan_partial()
	net: phy: marvell: Limit errata to 88m1101
	vlan: Fix tcp checksum offloads in Q-in-Q vlans
	i2c: i2c-tiny-usb: fix buffer not being DMA capable
	mmc: sdhci-iproc: suppress spurious interrupt with Multiblock read
	HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference
	scsi: mpt3sas: Force request partial completion alignment
	drm/radeon/ci: disable mclk switching for high refresh rates (v2)
	drm/radeon: Unbreak HPD handling for r600+
	pcmcia: remove left-over %Z format
	ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
	slub/memcg: cure the brainless abuse of sysfs attributes
	drm/gma500/psb: Actually use VBT mode when it is found
	mm/migrate: fix refcount handling when !hugepage_migration_supported()
	mlock: fix mlock count can not decrease in race condition
	xfs: Fix missed holes in SEEK_HOLE implementation
	xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()
	xfs: fix over-copying of getbmap parameters from userspace
	xfs: handle array index overrun in xfs_dir2_leaf_readbuf()
	xfs: prevent multi-fsb dir readahead from reading random blocks
	xfs: fix up quotacheck buffer list error handling
	xfs: support ability to wait on new inodes
	xfs: update ag iterator to support wait on new inodes
	xfs: wait on new inodes during quotaoff dquot release
	xfs: fix indlen accounting error on partial delalloc conversion
	xfs: bad assertion for delalloc an extent that start at i_size
	xfs: fix unaligned access in xfs_btree_visit_blocks
	xfs: in _attrlist_by_handle, copy the cursor back to userspace
	xfs: only return -errno or success from attr ->put_listent
	Linux 4.4.71

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

3 files changed, 44 insertions, 27 deletions

diff --git a/net/core/dst.c b/net/core/dst.c
index a1656e3b8d72..d7ad628bf64e 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -151,13 +151,13 @@ int dst_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard_out);
 
-const u32 dst_default_metrics[RTAX_MAX + 1] = {
+const struct dst_metrics dst_default_metrics = {
 	/* This initializer is needed to force linker to place this variable
 	 * into const section. Otherwise it might end into bss section.
 	 * We really want to avoid false sharing on this variable, and catch
 	 * any writes on it.
 	 */
-	[RTAX_MAX] = 0xdeadbeef,
+	.refcnt = ATOMIC_INIT(1),
 };
 
 void dst_init(struct dst_entry *dst, struct dst_ops *ops,
@@ -169,7 +169,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
 	if (dev)
 		dev_hold(dev);
 	dst->ops = ops;
-	dst_init_metrics(dst, dst_default_metrics, true);
+	dst_init_metrics(dst, dst_default_metrics.metrics, true);
 	dst->expires = 0UL;
 	dst->path = dst;
 	dst->from = NULL;
@@ -315,25 +315,30 @@ EXPORT_SYMBOL(dst_release);
 
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
-	u32 *p = kmalloc(sizeof(u32) * RTAX_MAX, GFP_ATOMIC);
+	struct dst_metrics *p = kmalloc(sizeof(*p), GFP_ATOMIC);
 
 	if (p) {
-		u32 *old_p = __DST_METRICS_PTR(old);
+		struct dst_metrics *old_p = (struct dst_metrics *)__DST_METRICS_PTR(old);
 		unsigned long prev, new;
 
-		memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+		atomic_set(&p->refcnt, 1);
+		memcpy(p->metrics, old_p->metrics, sizeof(p->metrics));
 
 		new = (unsigned long) p;
 		prev = cmpxchg(&dst->_metrics, old, new);
 
 		if (prev != old) {
 			kfree(p);
-			p = __DST_METRICS_PTR(prev);
+			p = (struct dst_metrics *)__DST_METRICS_PTR(prev);
 			if (prev & DST_METRICS_READ_ONLY)
 				p = NULL;
+		} else if (prev & DST_METRICS_REFCOUNTED) {
+			if (atomic_dec_and_test(&old_p->refcnt))
+				kfree(old_p);
 		}
 	}
-	return p;
+	BUILD_BUG_ON(offsetof(struct dst_metrics, metrics) != 0);
+	return (u32 *)p;
 }
 EXPORT_SYMBOL(dst_cow_metrics_generic);
 
@@ -342,7 +347,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
 	unsigned long prev, new;
 
-	new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY;
+	new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;
 	prev = cmpxchg(&dst->_metrics, old, new);
 	if (prev == old)
 		kfree(__DST_METRICS_PTR(old));
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index fe38ef58997c..d43544ce7550 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1458,13 +1458,13 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 					       cb->nlh->nlmsg_seq, 0,
 					       NLM_F_MULTI,
 					       ext_filter_mask);
-			/* If we ran out of room on the first message,
-			 * we're in trouble
-			 */
-			WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
 
-			if (err < 0)
-				goto out;
+			if (err < 0) {
+				if (likely(skb->len))
+					goto out;
+
+				goto out_err;
+			}
 
 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
@@ -1472,10 +1472,12 @@ cont:
 		}
 	}
 out:
+	err = skb->len;
+out_err:
 	cb->args[1] = idx;
 	cb->args[0] = h;
 
-	return skb->len;
+	return err;
 }
 
 int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len)
@@ -3127,8 +3129,12 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
 				err = br_dev->netdev_ops->ndo_bridge_getlink(
 						skb, portid, seq, dev,
 						filter_mask, NLM_F_MULTI);
-				if (err < 0 && err != -EOPNOTSUPP)
-					break;
+				if (err < 0 && err != -EOPNOTSUPP) {
+					if (likely(skb->len))
+						break;
+
+					goto out_err;
+				}
 			}
 			idx++;
 		}
@@ -3139,16 +3145,22 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
 							      seq, dev,
 							      filter_mask,
 							      NLM_F_MULTI);
-				if (err < 0 && err != -EOPNOTSUPP)
-					break;
+				if (err < 0 && err != -EOPNOTSUPP) {
+					if (likely(skb->len))
+						break;
+
+					goto out_err;
+				}
 			}
 			idx++;
 		}
 	}
+	err = skb->len;
+out_err:
 	rcu_read_unlock();
 	cb->args[0] = idx;
 
-	return skb->len;
+	return err;
 }
 
 static inline size_t bridge_nlmsg_size(void)
diff --git a/net/core/sock.c b/net/core/sock.c
index 0689430b7a8b..2871364e4420 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1690,17 +1690,17 @@ EXPORT_SYMBOL(skb_set_owner_w);
 
 void skb_orphan_partial(struct sk_buff *skb)
 {
-	/* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
-	 * so we do not completely orphan skb, but transfert all
-	 * accounted bytes but one, to avoid unexpected reorders.
-	 */
 	if (skb->destructor == sock_wfree
 #ifdef CONFIG_INET
 	    || skb->destructor == tcp_wfree
 #endif
 		) {
-		atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
-		skb->truesize = 1;
+		struct sock *sk = skb->sk;
+
+		if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+			atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+			skb->destructor = sock_efree;
+		}
 	} else {
 		skb_orphan(skb);
 	}