Merge 4.4.274 into android-4.4-p

Changes in 4.4.274
	HID: hid-sensor-hub: Return error for hid_set_field() failure
	HID: Add BUS_VIRTUAL to hid_connect logging
	HID: usbhid: fix info leak in hid_submit_ctrl
	ARM: OMAP2+: Fix build warning when mmc_omap is not built
	HID: gt683r: add missing MODULE_DEVICE_TABLE
	gfs2: Fix use-after-free in gfs2_glock_shrink_scan
	scsi: target: core: Fix warning on realtime kernels
	ethernet: myri10ge: Fix missing error code in myri10ge_probe()
	net: ipconfig: Don't override command-line hostnames or domains
	rtnetlink: Fix missing error code in rtnl_bridge_notify()
	net/x25: Return the correct errno code
	net: Return the correct errno code
	fib: Return the correct errno code
	dmaengine: stedma40: add missing iounmap() on error in d40_probe()
	net: ipv4: fix memory leak in netlbl_cipsov4_add_std
	net: rds: fix memory leak in rds_recvmsg
	rtnetlink: Fix regression in bridge VLAN configuration
	netfilter: synproxy: Fix out of bounds when parsing TCP options
	net: stmmac: dwmac1000: Fix extended MAC address registers definition
	qlcnic: Fix an error handling path in 'qlcnic_probe()'
	netxen_nic: Fix an error handling path in 'netxen_nic_probe()'
	net: cdc_ncm: switch to eth%d interface naming
	net: usb: fix possible use-after-free in smsc75xx_bind
	net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
	be2net: Fix an error handling path in 'be_probe()'
	net: hamradio: fix memory leak in mkiss_close
	net: cdc_eem: fix tx fixup skb leak
	net: ethernet: fix potential use-after-free in ec_bhf_remove
	scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
	radeon: use memcpy_to/fromio for UVD fw upload
	can: bcm: fix infoleak in struct bcm_msg_head
	tracing: Do no increment trace_clock_global() by one
	PCI: Mark TI C667X to avoid bus reset
	PCI: Mark some NVIDIA GPUs to avoid bus reset
	dmaengine: pl330: fix wrong usage of spinlock flags in dma_cyclc
	net: fec_ptp: add clock rate zero check
	can: bcm/raw/isotp: use per module netdevice notifier
	tracing: Do not stop recording cmdlines when tracing is off
	tracing: Do not stop recording comms if the trace file is being read
	x86/fpu: Reset state for all signal restore failures
	inet: use bigger hash table for IP ID generation
	ARM: 9081/1: fix gcc-10 thumb2-kernel regression
	Makefile: Move -Wno-unused-but-set-variable out of GCC only block
	Revert "PCI: PM: Do not read power state in pci_enable_device_flags()"
	cfg80211: call cfg80211_leave_ocb when switching away from OCB
	mac80211: drop multicast fragments
	ping: Check return value of function 'ping_queue_rcv_skb'
	inet: annotate date races around sk->sk_txhash
	net: caif: fix memory leak in ldisc_open
	r8152: Avoid memcpy() over-reading of ETH_SS_STATS
	sh_eth: Avoid memcpy() over-reading of ETH_SS_STATS
	r8169: Avoid memcpy() over-reading of ETH_SS_STATS
	net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY
	nilfs2: fix memory leak in nilfs_sysfs_delete_device_group
	i2c: robotfuzz-osif: fix control-request directions
	Linux 4.4.274

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8ed74ec47e5cd175c4234738949286b4e1b7760a

4 files changed, 45 insertions, 23 deletions

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 0e83c5b08e0e..e798e27b3c7d 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -557,6 +557,7 @@ void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
 		kfree(doi_def->map.std->lvl.local);
 		kfree(doi_def->map.std->cat.cipso);
 		kfree(doi_def->map.std->cat.local);
+		kfree(doi_def->map.std);
 		break;
 	}
 	kfree(doi_def);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 60f564db25a3..173777aa5add 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -890,7 +890,7 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
 
 
 /*
- *  Copy BOOTP-supplied string if not already set.
+ *  Copy BOOTP-supplied string
  */
 static int __init ic_bootp_string(char *dest, char *src, int len, int max)
 {
@@ -941,12 +941,15 @@ static void __init ic_do_bootp_ext(u8 *ext)
 		}
 		break;
 	case 12:	/* Host name */
-		ic_bootp_string(utsname()->nodename, ext+1, *ext,
-				__NEW_UTS_LEN);
-		ic_host_name_set = 1;
+		if (!ic_host_name_set) {
+			ic_bootp_string(utsname()->nodename, ext+1, *ext,
+					__NEW_UTS_LEN);
+			ic_host_name_set = 1;
+		}
 		break;
 	case 15:	/* Domain name (DNS) */
-		ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
+		if (!ic_domain[0])
+			ic_bootp_string(ic_domain, ext+1, *ext, sizeof(ic_domain));
 		break;
 	case 17:	/* Root path */
 		if (!root_server_path[0])
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 76d89724f27d..012a18052c8d 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -979,6 +979,7 @@ bool ping_rcv(struct sk_buff *skb)
 	struct sock *sk;
 	struct net *net = dev_net(skb->dev);
 	struct icmphdr *icmph = icmp_hdr(skb);
+	bool rc = false;
 
 	/* We assume the packet has already been checked by icmp_rcv */
 
@@ -993,14 +994,15 @@ bool ping_rcv(struct sk_buff *skb)
 		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 
 		pr_debug("rcv on socket %p\n", sk);
-		if (skb2)
-			ping_queue_rcv_skb(sk, skb2);
+		if (skb2 && !ping_queue_rcv_skb(sk, skb2))
+			rc = true;
 		sock_put(sk);
-		return true;
 	}
-	pr_debug("no socket, dropping\n");
 
-	return false;
+	if (!rc)
+		pr_debug("no socket, dropping\n");
+
+	return rc;
 }
 EXPORT_SYMBOL_GPL(ping_rcv);
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a9df7487c929..83e1914693f3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -70,6 +70,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/bootmem.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -463,8 +464,10 @@ static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
 	return neigh_create(&arp_tbl, pkey, dev);
 }
 
-#define IP_IDENTS_SZ 2048u
-
+/* Hash tables of size 2048..262144 depending on RAM size.
+ * Each bucket uses 8 bytes.
+ */
+static u32 ip_idents_mask __read_mostly;
 static atomic_t *ip_idents __read_mostly;
 static u32 *ip_tstamps __read_mostly;
 
@@ -474,12 +477,16 @@ static u32 *ip_tstamps __read_mostly;
  */
 u32 ip_idents_reserve(u32 hash, int segs)
 {
-	u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
-	atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
-	u32 old = ACCESS_ONCE(*p_tstamp);
-	u32 now = (u32)jiffies;
+	u32 bucket, old, now = (u32)jiffies;
+	atomic_t *p_id;
+	u32 *p_tstamp;
 	u32 delta = 0;
 
+	bucket = hash & ip_idents_mask;
+	p_tstamp = ip_tstamps + bucket;
+	p_id = ip_idents + bucket;
+	old = ACCESS_ONCE(*p_tstamp);
+
 	if (old != now && cmpxchg(p_tstamp, old, now) == old)
 		delta = prandom_u32_max(now - old);
 
@@ -2953,18 +2960,27 @@ struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 
 int __init ip_rt_init(void)
 {
+	void *idents_hash;
 	int rc = 0;
 	int cpu;
 
-	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
-	if (!ip_idents)
-		panic("IP: failed to allocate ip_idents\n");
+	/* For modern hosts, this will use 2 MB of memory */
+	idents_hash = alloc_large_system_hash("IP idents",
+					      sizeof(*ip_idents) + sizeof(*ip_tstamps),
+					      0,
+					      16, /* one bucket per 64 KB */
+					      0,
+					      NULL,
+					      &ip_idents_mask,
+					      2048,
+					      256*1024);
+
+	ip_idents = idents_hash;
 
-	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
+	prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents));
 
-	ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
-	if (!ip_tstamps)
-		panic("IP: failed to allocate ip_tstamps\n");
+	ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents);
+	memset(ip_tstamps, 0, (ip_idents_mask + 1) * sizeof(*ip_tstamps));
 
 	for_each_possible_cpu(cpu) {
 		struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);