Merge branch 'android-4.4@e4528dd' into branch 'msm-4.4'

* refs/heads/tmp-e4528dd:
  Linux 4.4.65
  perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race
  ping: implement proper locking
  staging/android/ion : fix a race condition in the ion driver
  vfio/pci: Fix integer overflows, bitmask check
  tipc: check minimum bearer MTU
  netfilter: nfnetlink: correctly validate length of batch messages
  xc2028: avoid use after free
  mnt: Add a per mount namespace limit on the number of mounts
  tipc: fix socket timer deadlock
  tipc: fix random link resets while adding a second bearer
  gfs2: avoid uninitialized variable warning
  hostap: avoid uninitialized variable use in hfa384x_get_rid
  tty: nozomi: avoid a harmless gcc warning
  tipc: correct error in node fsm
  tipc: re-enable compensation for socket receive buffer double counting
  tipc: make dist queue pernet
  tipc: make sure IPv6 header fits in skb headroom
  ANDROID: uid_sys_stats: fix access of task_uid(task)
  BACKPORT: f2fs: sanity check log_blocks_per_seg
  Linux 4.4.64
  tipc: fix crash during node removal
  block: fix del_gendisk() vs blkdev_ioctl crash
  x86, pmem: fix broken __copy_user_nocache cache-bypass assumptions
  hv: don't reset hv_context.tsc_page on crash
  Drivers: hv: balloon: account for gaps in hot add regions
  Drivers: hv: balloon: keep track of where ha_region starts
  Tools: hv: kvp: ensure kvp device fd is closed on exec
  kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd
  x86/mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs
  powerpc/kprobe: Fix oops when kprobed on 'stdu' instruction
  ubi/upd: Always flush after prepared for an update
  mac80211: reject ToDS broadcast data frames
  mmc: sdhci-esdhc-imx: increase the pad I/O drive strength for DDR50 card
  ACPI / power: Avoid maybe-uninitialized warning
  Input: elantech - add Fujitsu Lifebook E547 to force crc_enabled
  VSOCK: Detach QP check should filter out non matching QPs.
  Drivers: hv: vmbus: Reduce the delay between retries in vmbus_post_msg()
  Drivers: hv: get rid of timeout in vmbus_open()
  Drivers: hv: don't leak memory in vmbus_establish_gpadl()
  s390/mm: fix CMMA vs KSM vs others
  CIFS: remove bad_network_name flag
  cifs: Do not send echoes before Negotiate is complete
  ring-buffer: Have ring_buffer_iter_empty() return true when empty
  tracing: Allocate the snapshot buffer before enabling probe
  KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
  KEYS: Change the name of the dead type to ".dead" to prevent user access
  KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings
  ANDROID: sdcardfs: Call lower fs's revalidate
  ANDROID: sdcardfs: Avoid setting GIDs outside of valid ranges
  ANDROID: sdcardfs: Copy meta-data from lower inode
  Revert "Revert "Android: sdcardfs: Don't do d_add for lower fs""
  ANDROID: sdcardfs: Use filesystem specific hash
  ANDROID: AVB error handler to invalidate vbmeta partition.
  ANDROID: Update init/do_mounts_dm.c to the latest ChromiumOS version.
  Revert "[RFC]cgroup: Change from CAP_SYS_NICE to CAP_SYS_RESOURCE for cgroup migration permissions"

Conflicts:
	drivers/md/Makefile

Change-Id: I8f5ed53cb8b6cc66914f10c6ac820003b87b8759
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

1 files changed, 13 insertions, 15 deletions

diff --git a/net/tipc/node.c b/net/tipc/node.c
index 3926b561f873..2df0b98d4a32 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -102,9 +102,10 @@ static unsigned int tipc_hashfn(u32 addr)
 
 static void tipc_node_kref_release(struct kref *kref)
 {
-	struct tipc_node *node = container_of(kref, struct tipc_node, kref);
+	struct tipc_node *n = container_of(kref, struct tipc_node, kref);
 
-	tipc_node_delete(node);
+	kfree(n->bc_entry.link);
+	kfree_rcu(n, rcu);
 }
 
 void tipc_node_put(struct tipc_node *node)
@@ -216,21 +217,20 @@ static void tipc_node_delete(struct tipc_node *node)
 {
 	list_del_rcu(&node->list);
 	hlist_del_rcu(&node->hash);
-	kfree(node->bc_entry.link);
-	kfree_rcu(node, rcu);
+	tipc_node_put(node);
+
+	del_timer_sync(&node->timer);
+	tipc_node_put(node);
 }
 
 void tipc_node_stop(struct net *net)
 {
-	struct tipc_net *tn = net_generic(net, tipc_net_id);
+	struct tipc_net *tn = tipc_net(net);
 	struct tipc_node *node, *t_node;
 
 	spin_lock_bh(&tn->node_list_lock);
-	list_for_each_entry_safe(node, t_node, &tn->node_list, list) {
-		if (del_timer(&node->timer))
-			tipc_node_put(node);
-		tipc_node_put(node);
-	}
+	list_for_each_entry_safe(node, t_node, &tn->node_list, list)
+		tipc_node_delete(node);
 	spin_unlock_bh(&tn->node_list_lock);
 }
 
@@ -313,9 +313,7 @@ static void tipc_node_timeout(unsigned long data)
 		if (rc & TIPC_LINK_DOWN_EVT)
 			tipc_node_link_down(n, bearer_id, false);
 	}
-	if (!mod_timer(&n->timer, jiffies + n->keepalive_intv))
-		tipc_node_get(n);
-	tipc_node_put(n);
+	mod_timer(&n->timer, jiffies + n->keepalive_intv);
 }
 
 /**
@@ -730,7 +728,7 @@ static void tipc_node_fsm_evt(struct tipc_node *n, int evt)
 			state = SELF_UP_PEER_UP;
 			break;
 		case SELF_LOST_CONTACT_EVT:
-			state = SELF_DOWN_PEER_LEAVING;
+			state = SELF_DOWN_PEER_DOWN;
 			break;
 		case SELF_ESTABL_CONTACT_EVT:
 		case PEER_LOST_CONTACT_EVT:
@@ -749,7 +747,7 @@ static void tipc_node_fsm_evt(struct tipc_node *n, int evt)
 			state = SELF_UP_PEER_UP;
 			break;
 		case PEER_LOST_CONTACT_EVT:
-			state = SELF_LEAVING_PEER_DOWN;
+			state = SELF_DOWN_PEER_DOWN;
 			break;
 		case SELF_LOST_CONTACT_EVT:
 		case PEER_ESTABL_CONTACT_EVT: