Merge 4.4.226 into android-4.4-p

Changes in 4.4.226
	ax25: fix setsockopt(SO_BINDTODEVICE)
	net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()"
	sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
	net/mlx5: Add command entry handling completion
	net: sun: fix missing release regions in cas_init_one().
	net/mlx4_core: fix a memory leak bug.
	uapi: fix linux/if_pppol2tp.h userspace compilation errors
	IB/cma: Fix reference count leak when no ipv4 addresses are set
	cachefiles: Fix race between read_waiter and read_copier involving op->to_do
	usb: gadget: legacy: fix redundant initialization warnings
	cifs: Fix null pointer check in cifs_read
	Input: usbtouchscreen - add support for BonXeon TP
	Input: evdev - call input_flush_device() on release(), not flush()
	Input: xpad - add custom init packet for Xbox One S controllers
	Input: i8042 - add ThinkPad S230u to i8042 reset list
	IB/qib: Call kobject_put() when kobject_init_and_add() fails
	ALSA: hwdep: fix a left shifting 1 by 31 UB bug
	ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
	exec: Always set cap_ambient in cap_bprm_set_creds
	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
	include/asm-generic/topology.h: guard cpumask_of_node() macro argument
	iommu: Fix reference count leak in iommu_group_alloc.
	parisc: Fix kernel panic in mem_init()
	x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
	xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
	xfrm: fix a warning in xfrm_policy_insert_list
	xfrm: fix a NULL-ptr deref in xfrm_local_error
	vti4: eliminated some duplicate code.
	ip_vti: receive ipip packet by calling ip_tunnel_rcv
	netfilter: nft_reject_bridge: enable reject with bridge vlan
	netfilter: ipset: Fix subcounter update skip
	netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
	qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
	bonding: Fix reference count leak in bond_sysfs_slave_add.
	netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
	mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
	drm/fb-helper: Use proper plane mask for fb cleanup
	genirq/generic_pending: Do not lose pending affinity update
	usb: renesas_usbhs: gadget: fix spin_lock_init() for &uep->lock
	mac80211: fix memory leak
	net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
	mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
	asm-prototypes: Clear any CPP defines before declaring the functions
	sc16is7xx: move label 'err_spi' to correct section
	drm/msm: Fix possible null dereference on failure of get_pages()
	printk: help pr_debug and pr_devel to optimize out arguments
	scsi: zfcp: fix request object use-after-free in send path causing wrong traces
	Linux 4.4.226

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia5473e84bcdec9d8a045a80a1c683fc1072f8c4f

1 files changed, 6 insertions, 8 deletions

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 9d45f30d4d8b..2fcb524cd75b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -477,18 +477,16 @@ u32 ip_idents_reserve(u32 hash, int segs)
 	atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
 	u32 old = ACCESS_ONCE(*p_tstamp);
 	u32 now = (u32)jiffies;
-	u32 new, delta = 0;
+	u32 delta = 0;
 
 	if (old != now && cmpxchg(p_tstamp, old, now) == old)
 		delta = prandom_u32_max(now - old);
 
-	/* Do not use atomic_add_return() as it makes UBSAN unhappy */
-	do {
-		old = (u32)atomic_read(p_id);
-		new = old + delta + segs;
-	} while (atomic_cmpxchg(p_id, old, new) != old);
-
-	return new - segs;
+	/* If UBSAN reports an error there, please make sure your compiler
+	 * supports -fno-strict-overflow before reporting it that was a bug
+	 * in UBSAN, and it has been fixed in GCC-8.
+	 */
+	return atomic_add_return(segs + delta, p_id) - segs;
 }
 EXPORT_SYMBOL(ip_idents_reserve);