Merge android-4.4.183 (94fd428) into msm-4.4

* refs/heads/tmp-94fd428
  Linux 4.4.183
  Abort file_remove_privs() for non-reg. files
  coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
  Revert "crypto: crypto4xx - properly set IV after de- and encrypt"
  scsi: libsas: delete sas port if expander discover failed
  scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route()
  net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and RZ/A1 SoCs
  KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token list
  ia64: fix build errors by exporting paddr_to_nid()
  configfs: Fix use-after-free when accessing sd->s_dentry
  i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr
  net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE()
  gpio: fix gpio-adp5588 build errors
  perf/ring_buffer: Add ordering to rb->nest increment
  perf/ring_buffer: Fix exposing a temporarily decreased data_head
  x86/CPU/AMD: Don't force the CPB cap when running under a hypervisor
  mISDN: make sure device name is NUL terminated
  sunhv: Fix device naming inconsistency between sunhv_console and sunhv_reg
  neigh: fix use-after-free read in pneigh_get_next
  lapb: fixed leak of control-blocks.
  ipv6: flowlabel: fl6_sock_lookup() must use atomic_inc_not_zero
  be2net: Fix number of Rx queues used for flow hashing
  ax25: fix inconsistent lock state in ax25_destroy_timer
  USB: serial: option: add Telit 0x1260 and 0x1261 compositions
  USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
  USB: serial: pl2303: add Allied Telesis VT-Kit3
  USB: usb-storage: Add new ID to ums-realtek
  USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
  drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
  drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
  KVM: s390: fix memory slot handling for KVM_SET_USER_MEMORY_REGION
  KVM: x86/pmu: do not mask the value that is written to fixed PMUs
  usbnet: ipheth: fix racing condition
  scsi: bnx2fc: fix incorrect cast to u64 on shift operation
  scsi: lpfc: add check for loss of ndlp when sending RRQ
  Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
  ASoC: cs42xx8: Add regcache mask dirty
  cgroup: Use css_tryget() instead of css_tryget_online() in task_get_css()
  bcache: fix stack corruption by PRECEDING_KEY()
  i2c: acorn: fix i2c warning
  ptrace: restore smp_rmb() in __ptrace_may_access()
  signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
  fs/ocfs2: fix race in ocfs2_dentry_attach_lock()
  mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node
  libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
  ALSA: seq: Cover unsubscribe_port() in list_mutex
  Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"
  futex: Fix futex lock the wrong page
  ARM: exynos: Fix undefined instruction during Exynos5422 resume
  pwm: Fix deadlock warning when removing PWM device
  ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa
  pwm: tiehrpwm: Update shadow register for disabling PWMs
  dmaengine: idma64: Use actual device for DMA transfers
  gpio: gpio-omap: add check for off wake capable gpios
  PCI: xilinx: Check for __get_free_pages() failure
  video: imsttfb: fix potential NULL pointer dereferences
  video: hgafb: fix potential NULL pointer dereference
  PCI: rcar: Fix a potential NULL pointer dereference
  PCI: rpadlpar: Fix leaked device_node references in add/remove paths
  ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA
  ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA
  clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
  soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher
  platform/chrome: cros_ec_proto: check for NULL transfer function
  x86/PCI: Fix PCI IRQ routing table memory leak
  nfsd: allow fh_want_write to be called twice
  fuse: retrieve: cap requested size to negotiated max_write
  nvmem: core: fix read buffer in place
  ALSA: hda - Register irq handler after the chip initialization
  iommu/vt-d: Set intel_iommu_gfx_mapped correctly
  f2fs: fix to do sanity check on valid block count of segment
  f2fs: fix to avoid panic in do_recover_data()
  ntp: Allow TAI-UTC offset to be set to zero
  drm/bridge: adv7511: Fix low refresh rate selection
  perf/x86/intel: Allow PEBS multi-entry in watermark mode
  mfd: twl6040: Fix device init errors for ACCCTL register
  mfd: intel-lpss: Set the device in reset state when init
  kernel/sys.c: prctl: fix false positive in validate_prctl_map()
  mm/cma_debug.c: fix the break condition in cma_maxchunk_get()
  mm/cma.c: fix crash on CMA allocation if bitmap allocation fails
  hugetlbfs: on restore reserve error path retain subpool reservation
  ipc: prevent lockup on alloc_msg and free_msg
  sysctl: return -EINVAL if val violates minmax
  fs/fat/file.c: issue flush after the writeback of FAT
  ANDROID: kernel: cgroup: cpuset: Clear cpus_requested for empty buf
  ANDROID: kernel: cgroup: cpuset: Add missing allocation of cpus_requested in alloc_trial_cpuset

Change-Id: I5b33449bd21ec21d91b1030d53df3658a305bded
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

5 files changed, 14 insertions, 11 deletions

diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index 149f82bd83fd..6ba56f215229 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -443,9 +443,11 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
 	}
 
 	if (ax25->sk != NULL) {
+		local_bh_disable();
 		bh_lock_sock(ax25->sk);
 		sock_reset_flag(ax25->sk, SOCK_ZAPPED);
 		bh_unlock_sock(ax25->sk);
+		local_bh_enable();
 	}
 
 put:
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index ccddf348924b..1588d913c7a0 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1177,14 +1177,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
 	    !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
 		return 0;
 
-	/* The minimum encryption key size needs to be enforced by the
-	 * host stack before establishing any L2CAP connections. The
-	 * specification in theory allows a minimum of 1, but to align
-	 * BR/EDR and LE transports, a minimum of 7 is chosen.
-	 */
-	if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE)
-		return 0;
-
 	return 1;
 }
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 7dbd49551d0b..2572b51e86f4 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2705,6 +2705,7 @@ static void *neigh_get_idx_any(struct seq_file *seq, loff_t *pos)
 }
 
 void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl, unsigned int neigh_seq_flags)
+	__acquires(tbl->lock)
 	__acquires(rcu_bh)
 {
 	struct neigh_seq_state *state = seq->private;
@@ -2715,6 +2716,7 @@ void *neigh_seq_start(struct seq_file *seq, loff_t *pos, struct neigh_table *tbl
 
 	rcu_read_lock_bh();
 	state->nht = rcu_dereference_bh(tbl->nht);
+	read_lock(&tbl->lock);
 
 	return *pos ? neigh_get_idx_any(seq, pos) : SEQ_START_TOKEN;
 }
@@ -2748,8 +2750,13 @@ out:
 EXPORT_SYMBOL(neigh_seq_next);
 
 void neigh_seq_stop(struct seq_file *seq, void *v)
+	__releases(tbl->lock)
 	__releases(rcu_bh)
 {
+	struct neigh_seq_state *state = seq->private;
+	struct neigh_table *tbl = state->tbl;
+
+	read_unlock(&tbl->lock);
 	rcu_read_unlock_bh();
 }
 EXPORT_SYMBOL(neigh_seq_stop);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c6061f7343f1..8a6c682bfc22 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -254,9 +254,9 @@ struct ip6_flowlabel *fl6_sock_lookup(struct sock *sk, __be32 label)
 	rcu_read_lock_bh();
 	for_each_sk_fl_rcu(np, sfl) {
 		struct ip6_flowlabel *fl = sfl->fl;
-		if (fl->label == label) {
+
+		if (fl->label == label && atomic_inc_not_zero(&fl->users)) {
 			fl->lastuse = jiffies;
-			atomic_inc(&fl->users);
 			rcu_read_unlock_bh();
 			return fl;
 		}
@@ -622,7 +622,8 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
 						goto done;
 					}
 					fl1 = sfl->fl;
-					atomic_inc(&fl1->users);
+					if (!atomic_inc_not_zero(&fl1->users))
+						fl1 = NULL;
 					break;
 				}
 			}
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index fc60d9d738b5..cdb913e7627e 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -182,6 +182,7 @@ int lapb_unregister(struct net_device *dev)
 	lapb = __lapb_devtostruct(dev);
 	if (!lapb)
 		goto out;
+	lapb_put(lapb);
 
 	lapb_stop_t1timer(lapb);
 	lapb_stop_t2timer(lapb);