Merge 4.4.159 into android-4.4

Changes in 4.4.159
	NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
	NFC: Fix the number of pipes
	ASoC: cs4265: fix MMTLR Data switch control
	ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
	ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
	platform/x86: alienware-wmi: Correct a memory leak
	xen/netfront: don't bug in case of too many frags
	xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code
	ring-buffer: Allow for rescheduling when removing pages
	mm: shmem.c: Correctly annotate new inodes for lockdep
	gso_segment: Reset skb->mac_len after modifying network header
	ipv6: fix possible use-after-free in ip6_xmit()
	net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
	net: hp100: fix always-true check for link up state
	neighbour: confirm neigh entries when ARP packet is received
	scsi: target: iscsi: Use hex2bin instead of a re-implementation
	ocfs2: fix ocfs2 read block panic
	drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
	tty: vt_ioctl: fix potential Spectre v1
	ext4: avoid divide by zero fault when deleting corrupted inline directories
	ext4: recalucate superblock checksum after updating free blocks/inodes
	ext4: fix online resize's handling of a too-small final block group
	ext4: fix online resizing for bigalloc file systems with a 1k block size
	ext4: don't mark mmp buffer head dirty
	arm64: Add trace_hardirqs_off annotation in ret_to_user
	HID: sony: Update device ids
	HID: sony: Support DS4 dongle
	iw_cxgb4: only allow 1 flush on user qps
	Linux 4.4.159

Change-Id: I98239ca60783ca69147f2f11034138fc22e2af65
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

4 files changed, 12 insertions, 9 deletions

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f60b93627876..78dc184072e8 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1140,6 +1140,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 		lladdr = neigh->ha;
 	}
 
+	/* Update confirmed timestamp for neighbour entry after we
+	 * received ARP packet even if it doesn't change IP to MAC binding.
+	 */
+	if (new & NUD_CONNECTED)
+		neigh->confirmed = jiffies;
+
 	/* If entry was valid and address is not changed,
 	   do not change entry state, if new one is STALE.
 	 */
@@ -1163,15 +1169,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 		}
 	}
 
-	/* Update timestamps only once we know we will make a change to the
+	/* Update timestamp only once we know we will make a change to the
 	 * neighbour entry. Otherwise we risk to move the locktime window with
 	 * noop updates and ignore relevant ARP updates.
 	 */
-	if (new != old || lladdr != neigh->ha) {
-		if (new & NUD_CONNECTED)
-			neigh->confirmed = jiffies;
+	if (new != old || lladdr != neigh->ha)
 		neigh->updated = jiffies;
-	}
 
 	if (new != old) {
 		neigh_del_timer(neigh);
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index c31e5fa8f1a8..9a2c36fd3d2f 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1299,6 +1299,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
 		if (encap)
 			skb_reset_inner_headers(skb);
 		skb->network_header = (u8 *)iph - skb->head;
+		skb_reset_mac_len(skb);
 	} while ((skb = skb->next));
 
 out:
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 9e2ea4ae840d..244b9fec9d4d 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -118,6 +118,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 		ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
 		ipv6h->payload_len = htons(skb->len - nhoff - sizeof(*ipv6h));
 		skb->network_header = (u8 *)ipv6h - skb->head;
+		skb_reset_mac_len(skb);
 
 		if (udpfrag) {
 			int err = ip6_find_1stfragopt(skb, &prevhdr);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0feede45bd28..530b62fd6b64 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -193,12 +193,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 				kfree_skb(skb);
 				return -ENOBUFS;
 			}
+			if (skb->sk)
+				skb_set_owner_w(skb2, skb->sk);
 			consume_skb(skb);
 			skb = skb2;
-			/* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
-			 * it is safe to call in our context (socket lock not held)
-			 */
-			skb_set_owner_w(skb, (struct sock *)sk);
 		}
 		if (opt->opt_flen)
 			ipv6_push_frag_opts(skb, opt, &proto);