Merge 4.4.204 into android-4.4-p

Changes in 4.4.204
	net/mlx4_en: fix mlx4 ethtool -N insertion
	sfc: Only cancel the PPS workqueue if it exists
	net/sched: act_pedit: fix WARN() in the traffic path
	net: rtnetlink: prevent underflows in do_setvfinfo()
	Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()"
	mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
	asus-wmi: Create quirk for airplane_mode LED
	asus-wmi: Add quirk_no_rfkill_wapf4 for the Asus X456UF
	asus-wmi: Add quirk_no_rfkill for the Asus N552VW
	asus-wmi: Add quirk_no_rfkill for the Asus U303LB
	asus-wmi: Add quirk_no_rfkill for the Asus Z550MA
	platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A
	platform/x86: asus-wmi: fix asus ux303ub brightness issue
	platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB
	asus-wmi: provide access to ALS control
	platform/x86: asus-wmi: try to set als by default
	platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ
	platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
	platform/x86: asus-wmi: add SERIO_I8042 dependency
	mwifiex: Fix NL80211_TX_POWER_LIMITED
	ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback
	printk: fix integer overflow in setup_log_buf()
	gfs2: Fix marking bitmaps non-full
	synclink_gt(): fix compat_ioctl()
	powerpc: Fix signedness bug in update_flash_db()
	powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field
	brcmsmac: AP mode: update beacon when TIM changes
	spi: sh-msiof: fix deferred probing
	mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail
	btrfs: handle error of get_old_root
	gsmi: Fix bug in append_to_eventlog sysfs handler
	misc: mic: fix a DMA pool free failure
	amiflop: clean up on errors during setup
	scsi: ips: fix missing break in switch
	KVM/x86: Fix invvpid and invept register operand size in 64-bit mode
	scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler
	scsi: isci: Change sci_controller_start_task's return type to sci_status
	scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param
	clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk
	scsi: dc395x: fix dma API usage in srb_done
	scsi: dc395x: fix DMA API usage in sg_update_list
	net: fix warning in af_unix
	kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack
	ALSA: i2c/cs8427: Fix int to char conversion
	macintosh/windfarm_smu_sat: Fix debug output
	USB: misc: appledisplay: fix backlight update_status return code
	SUNRPC: Fix a compile warning for cmpxchg64()
	atm: zatm: Fix empty body Clang warnings
	s390/perf: Return error when debug_register fails
	spi: omap2-mcspi: Set FIFO DMA trigger level to word length
	sparc: Fix parport build warnings.
	ceph: fix dentry leak in ceph_readdir_prepopulate
	rtc: s35390a: Change buf's type to u8 in s35390a_init
	mISDN: Fix type of switch control variable in ctrl_teimanager
	qlcnic: fix a return in qlcnic_dcb_get_capability()
	mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values
	mfd: max8997: Enale irq-wakeup unconditionally
	selftests/ftrace: Fix to test kprobe $comm arg only if available
	thermal: rcar_thermal: Prevent hardware access during system suspend
	sparc64: Rework xchg() definition to avoid warnings.
	fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle()
	mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock
	um: Make line/tty semantics use true write IRQ
	linux/bitmap.h: handle constant zero-size bitmaps correctly
	linux/bitmap.h: fix type of nbits in bitmap_shift_right()
	hfsplus: fix BUG on bnode parent update
	hfs: fix BUG on bnode parent update
	hfsplus: prevent btree data loss on ENOSPC
	hfs: prevent btree data loss on ENOSPC
	hfsplus: fix return value of hfsplus_get_block()
	hfs: fix return value of hfs_get_block()
	fs/hfs/extent.c: fix array out of bounds read of array extent
	igb: shorten maximum PHC timecounter update interval
	ntb_netdev: fix sleep time mismatch
	ntb: intel: fix return value for ndev_vec_mask()
	ocfs2: don't put and assigning null to bh allocated outside
	ocfs2: fix clusters leak in ocfs2_defrag_extent()
	net: do not abort bulk send on BQL status
	sched/fair: Don't increase sd->balance_interval on newidle balance
	audit: print empty EXECVE args
	wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()'
	rtl8xxxu: Fix missing break in switch
	brcmsmac: never log "tid x is not agg'able" by default
	wireless: airo: potential buffer overflow in sprintf()
	rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information
	scsi: mpt3sas: Fix Sync cache command failure during driver unload
	scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11
	scsi: megaraid_sas: Fix msleep granularity
	scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces
	dlm: fix invalid free
	dlm: don't leak kernel pointer to userspace
	net: bcmgenet: return correct value 'ret' from bcmgenet_power_down
	sock: Reset dst when changing sk_mark via setsockopt
	pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues
	pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD
	PCI: keystone: Use quirk to limit MRRS for K2G
	spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
	IB/hfi1: Ensure full Gen3 speed in a Gen4 system
	Bluetooth: Fix invalid-free in bcsp_close()
	ath9k_hw: fix uninitialized variable data
	dm: use blk_set_queue_dying() in __dm_destroy()
	arm64: fix for bad_mode() handler to always result in panic
	cpufreq: Skip cpufreq resume if it's not suspended
	ocfs2: remove ocfs2_is_o2cb_active()
	mmc: block: Fix tag condition with packed writes
	ARC: perf: Accommodate big-endian CPU
	x86/insn: Fix awk regexp warnings
	x86/speculation: Fix incorrect MDS/TAA mitigation status
	x86/speculation: Fix redundant MDS mitigation message
	media: vivid: Set vid_cap_streaming and vid_out_streaming to true
	media: vivid: Fix wrong locking that causes race conditions on streaming stop
	cpufreq: Add NULL checks to show() and store() methods of cpufreq
	media: b2c2-flexcop-usb: add sanity checking
	media: cxusb: detect cxusb_ctrl_msg error in query
	media: imon: invalid dereference in imon_touch_event
	virtio_console: reset on out of memory
	virtio_console: don't tie bufs to a vq
	virtio_console: allocate inbufs in add_port() only if it is needed
	virtio_console: fix uninitialized variable use
	virtio_console: drop custom control queue cleanup
	virtio_console: move removal code
	usb-serial: cp201x: support Mark-10 digital force gauge
	appledisplay: fix error handling in the scheduled work
	USB: serial: mos7840: add USB ID to support Moxa UPort 2210
	USB: serial: mos7720: fix remote wakeup
	USB: serial: mos7840: fix remote wakeup
	USB: serial: option: add support for DW5821e with eSIM support
	USB: serial: option: add support for Foxconn T77W968 LTE modules
	staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
	powerpc/64s: support nospectre_v2 cmdline option
	powerpc/book3s64: Fix link stack flush on context switch
	KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel
	Linux 4.4.204

Change-Id: I63f64a109a8797f479bc7226be23ca591fa01b1c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

6 files changed, 27 insertions, 5 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index f443398dbb80..ce5f5694e4b7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2801,7 +2801,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *first, struct net_device *de
 		}
 
 		skb = next;
-		if (netif_xmit_stopped(txq) && skb) {
+		if (netif_tx_queue_stopped(txq) && skb) {
 			rc = NETDEV_TX_BUSY;
 			break;
 		}
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index d52b633164c9..a9da58204afa 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1549,6 +1549,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 	if (tb[IFLA_VF_MAC]) {
 		struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
 
+		if (ivm->vf >= INT_MAX)
+			return -EINVAL;
 		err = -EOPNOTSUPP;
 		if (ops->ndo_set_vf_mac)
 			err = ops->ndo_set_vf_mac(dev, ivm->vf,
@@ -1560,6 +1562,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 	if (tb[IFLA_VF_VLAN]) {
 		struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
 
+		if (ivv->vf >= INT_MAX)
+			return -EINVAL;
 		err = -EOPNOTSUPP;
 		if (ops->ndo_set_vf_vlan)
 			err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
@@ -1572,6 +1576,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 		struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
 		struct ifla_vf_info ivf;
 
+		if (ivt->vf >= INT_MAX)
+			return -EINVAL;
 		err = -EOPNOTSUPP;
 		if (ops->ndo_get_vf_config)
 			err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf);
@@ -1590,6 +1596,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 	if (tb[IFLA_VF_RATE]) {
 		struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]);
 
+		if (ivt->vf >= INT_MAX)
+			return -EINVAL;
 		err = -EOPNOTSUPP;
 		if (ops->ndo_set_vf_rate)
 			err = ops->ndo_set_vf_rate(dev, ivt->vf,
@@ -1602,6 +1610,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 	if (tb[IFLA_VF_SPOOFCHK]) {
 		struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
 
+		if (ivs->vf >= INT_MAX)
+			return -EINVAL;
 		err = -EOPNOTSUPP;
 		if (ops->ndo_set_vf_spoofchk)
 			err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
@@ -1613,6 +1623,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 	if (tb[IFLA_VF_LINK_STATE]) {
 		struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]);
 
+		if (ivl->vf >= INT_MAX)
+			return -EINVAL;
 		err = -EOPNOTSUPP;
 		if (ops->ndo_set_vf_link_state)
 			err = ops->ndo_set_vf_link_state(dev, ivl->vf,
@@ -1626,6 +1638,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 
 		err = -EOPNOTSUPP;
 		ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]);
+		if (ivrssq_en->vf >= INT_MAX)
+			return -EINVAL;
 		if (ops->ndo_set_vf_rss_query_en)
 			err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf,
 							   ivrssq_en->setting);
@@ -1636,6 +1650,8 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
 	if (tb[IFLA_VF_TRUST]) {
 		struct ifla_vf_trust *ivt = nla_data(tb[IFLA_VF_TRUST]);
 
+		if (ivt->vf >= INT_MAX)
+			return -EINVAL;
 		err = -EOPNOTSUPP;
 		if (ops->ndo_set_vf_trust)
 			err = ops->ndo_set_vf_trust(dev, ivt->vf, ivt->setting);
diff --git a/net/core/sock.c b/net/core/sock.c
index 8f2f5d497dc7..72f54ca95ccd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -951,10 +951,12 @@ set_rcvbuf:
 			clear_bit(SOCK_PASSSEC, &sock->flags);
 		break;
 	case SO_MARK:
-		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
 			ret = -EPERM;
-		else
+		} else if (val != sk->sk_mark) {
 			sk->sk_mark = val;
+			sk_dst_reset(sk);
+		}
 		break;
 
 	case SO_RXQ_OVFL:
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index c3434e902445..63d3b0ac43fb 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -50,13 +50,14 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
 	if (tb[TCA_PEDIT_PARMS] == NULL)
 		return -EINVAL;
 	parm = nla_data(tb[TCA_PEDIT_PARMS]);
+	if (!parm->nkeys)
+		return -EINVAL;
+
 	ksize = parm->nkeys * sizeof(struct tc_pedit_key);
 	if (nla_len(tb[TCA_PEDIT_PARMS]) < sizeof(*parm) + ksize)
 		return -EINVAL;
 
 	if (!tcf_hash_check(parm->index, a, bind)) {
-		if (!parm->nkeys)
-			return -EINVAL;
 		ret = tcf_hash_create(parm->index, est, a, sizeof(*p),
 				      bind, false);
 		if (ret)
diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c
index 1d74d653e6c0..ad0dcb69395d 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seal.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seal.c
@@ -63,6 +63,7 @@
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/random.h>
 #include <linux/crypto.h>
+#include <linux/atomic.h>
 
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 # define RPCDBG_FACILITY        RPCDBG_AUTH
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index b1a72615fdc3..b5e2ef242efe 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -224,6 +224,8 @@ static inline void unix_release_addr(struct unix_address *addr)
 
 static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp)
 {
+	*hashp = 0;
+
 	if (len <= sizeof(short) || len > sizeof(*sunaddr))
 		return -EINVAL;
 	if (!sunaddr || sunaddr->sun_family != AF_UNIX)