Merge 4.4.162 into android-4.4-p

Changes in 4.4.162
	ASoC: wm8804: Add ACPI support
	ASoC: sigmadsp: safeload should not have lower byte limit
	selftests/efivarfs: add required kernel configs
	mfd: omap-usb-host: Fix dts probe of children
	sound: enable interrupt after dma buffer initialization
	stmmac: fix valid numbers of unicast filter entries
	net: macb: disable scatter-gather for macb on sama5d3
	ARM: dts: at91: add new compatibility string for macb on sama5d3
	drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7
	ext4: add corruption check in ext4_xattr_set_entry()
	mm/vmstat.c: fix outdated vmstat_text
	mach64: detect the dot clock divider correctly on sparc
	perf script python: Fix export-to-postgresql.py occasional failure
	i2c: i2c-scmi: fix for i2c_smbus_write_block_data
	xhci: Don't print a warning when setting link state for disabled ports
	jffs2: return -ERANGE when xattr buffer is too small
	bnxt_en: Fix TX timeout during netpoll.
	bonding: avoid possible dead-lock
	ip6_tunnel: be careful when accessing the inner header
	ip_tunnel: be careful when accessing the inner header
	ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
	net: ipv4: update fnhe_pmtu when first hop's MTU changes
	net/ipv6: Display all addresses in output of /proc/net/if_inet6
	netlabel: check for IPV4MASK in addrinfo_get
	net/usb: cancel pending work when unbinding smsc75xx
	qlcnic: fix Tx descriptor corruption on 82xx devices
	team: Forbid enslaving team device to itself
	net: mvpp2: Extract the correct ethtype from the skb for tx csum offload
	net: systemport: Fix wake-up interrupt race during resume
	rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096
	KVM: x86: remove eager_fpu field of struct kvm_vcpu_arch
	x86/fpu: Remove use_eager_fpu()
	x86/fpu: Remove struct fpu::counter
	x86/fpu: Finish excising 'eagerfpu'
	media: af9035: prevent buffer overflow on write
	clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs
	Input: atakbd - fix Atari keymap
	Input: atakbd - fix Atari CapsLock behaviour
	net/mlx4: Use cpumask_available for eq->affinity_mask
	powerpc/tm: Fix userspace r13 corruption
	powerpc/tm: Avoid possible userspace r1 corruption on reclaim
	ARC: build: Get rid of toolchain check
	usb: gadget: serial: fix oops when data rx'd after close
	Drivers: hv: utils: Invoke the poll function after handshake
	Drivers: hv: util: Pass the channel information during the init call
	Drivers: hv: kvp: fix IP Failover
	HV: properly delay KVP packets when negotiation is in progress
	Linux 4.4.162

Change-Id: I70efa929e8fd08d28228e251d276847cfdfb0bac
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

2 files changed, 12 insertions, 5 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index bbc6abf17f91..4436d4165f35 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3841,7 +3841,6 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
 				p++;
 				continue;
 			}
-			state->offset++;
 			return ifa;
 		}
 
@@ -3865,13 +3864,12 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
 		return ifa;
 	}
 
+	state->offset = 0;
 	while (++state->bucket < IN6_ADDR_HSIZE) {
-		state->offset = 0;
 		hlist_for_each_entry_rcu_bh(ifa,
 				     &inet6_addr_lst[state->bucket], addr_lst) {
 			if (!net_eq(dev_net(ifa->idev->dev), net))
 				continue;
-			state->offset++;
 			return ifa;
 		}
 	}
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 3c2468bd0b7c..8d55abb1a689 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1096,7 +1096,7 @@ static inline int
 ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ip6_tnl *t = netdev_priv(dev);
-	const struct iphdr  *iph = ip_hdr(skb);
+	const struct iphdr  *iph;
 	int encap_limit = -1;
 	struct flowi6 fl6;
 	__u8 dsfield;
@@ -1104,6 +1104,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 	u8 tproto;
 	int err;
 
+	/* ensure we can access the full inner ip header */
+	if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+		return -1;
+
+	iph = ip_hdr(skb);
 	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 
 	tproto = ACCESS_ONCE(t->parms.proto);
@@ -1142,7 +1147,7 @@ static inline int
 ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
 	struct ip6_tnl *t = netdev_priv(dev);
-	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+	struct ipv6hdr *ipv6h;
 	int encap_limit = -1;
 	__u16 offset;
 	struct flowi6 fl6;
@@ -1151,6 +1156,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 	u8 tproto;
 	int err;
 
+	if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+		return -1;
+
+	ipv6h = ipv6_hdr(skb);
 	tproto = ACCESS_ONCE(t->parms.proto);
 	if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
 	    ip6_tnl_addr_conflict(t, ipv6h))