Merge 4.4.216 into android-4.4-p

Changes in 4.4.216
	iwlwifi: pcie: fix rb_allocator workqueue allocation
	ext4: fix potential race between online resizing and write operations
	ext4: fix potential race between s_flex_groups online resizing and access
	ext4: fix potential race between s_group_info online resizing and access
	ipmi:ssif: Handle a possible NULL pointer reference
	mac80211: consider more elements in parsing CRC
	cfg80211: check wiphy driver existence for drvinfo report
	cifs: Fix mode output in debugging statements
	cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
	sysrq: Restore original console_loglevel when sysrq disabled
	sysrq: Remove duplicated sysrq message
	net: fib_rules: Correctly set table field when table number exceeds 8 bits
	net: phy: restore mdio regs in the iproc mdio driver
	ipv6: Fix nlmsg_flags when splitting a multipath route
	ipv6: Fix route replacement with dev-only route
	sctp: move the format error check out of __sctp_sf_do_9_1_abort
	nfc: pn544: Fix occasional HW initialization failure
	net: sched: correct flower port blocking
	ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
	audit: fix error handling in audit_data_to_entry()
	HID: core: fix off-by-one memset in hid_report_raw_event()
	HID: core: increase HID report buffer size to 8KiB
	HID: hiddev: Fix race in in hiddev_disconnect()
	MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
	i2c: jz4780: silence log flood on txabrt
	ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
	include/linux/bitops.h: introduce BITS_PER_TYPE
	net: netlink: cap max groups which will be considered in netlink_bind()
	namei: only return -ECHILD from follow_dotdot_rcu()
	KVM: Check for a bad hva before dropping into the ghc slow path
	slip: stop double free sl->dev in slip_open
	mm: make page ref count overflow check tighter and more explicit
	mm: add 'try_get_page()' helper function
	mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages
	mm, gup: ensure real head page is ref-counted when using hugepages
	mm: prevent get_user_pages() from overflowing page refcount
	pipe: add pipe_buf_get() helper
	fs: prevent page refcount overflow in pipe_buf_get
	audit: always check the netlink payload length in audit_receive_msg()
	serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
	usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
	usb: gadget: serial: fix Tx stall after buffer overflow
	drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
	drm/msm/dsi: save pll state before dsi host is powered off
	net: ks8851-ml: Remove 8-bit bus accessors
	net: ks8851-ml: Fix 16-bit data access
	net: ks8851-ml: Fix 16-bit IO operation
	watchdog: da9062: do not ping the hw during stop()
	s390/cio: cio_ignore_proc_seq_next should increase position index
	cifs: don't leak -EAGAIN for stat() during reconnect
	usb: storage: Add quirk for Samsung Fit flash
	usb: quirks: add NO_LPM quirk for Logitech Screen Share
	usb: core: hub: do error out if usb_autopm_get_interface() fails
	usb: core: port: do error out if usb_autopm_get_interface() fails
	vgacon: Fix a UAF in vgacon_invert_region
	fat: fix uninit-memory access for partial initialized inode
	vt: selection, close sel_buffer race
	vt: selection, push console lock down
	vt: selection, push sel_lock up
	dmaengine: tegra-apb: Fix use-after-free
	dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
	ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
	ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
	ASoC: dapm: Correct DAPM handling of active widgets during shutdown
	RDMA/iwcm: Fix iwcm work deallocation
	RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
	ARM: imx: build v7_cpu_resume() unconditionally
	hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
	dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
	powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
	dm cache: fix a crash due to incorrect work item cancelling
	crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async
	Linux 4.4.216

Change-Id: I9b747fb2a39b1137ee4ec9c5bb2c1aac2419e97b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 22 insertions, 1 deletions

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 6fc30c9d9985..a24043be7991 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -503,6 +503,15 @@ static inline void get_huge_page_tail(struct page *page)
 
 extern bool __get_page_tail(struct page *page);
 
+static inline int page_ref_count(struct page *page)
+{
+	return atomic_read(&page->_count);
+}
+
+/* 127: arbitrary random number, small enough to assemble well */
+#define page_ref_zero_or_close_to_overflow(page) \
+	((unsigned int) atomic_read(&page->_count) + 127u <= 127u)
+
 static inline void get_page(struct page *page)
 {
 	if (unlikely(PageTail(page)))
@@ -512,10 +521,22 @@ static inline void get_page(struct page *page)
 	 * Getting a normal page or the head of a compound page
 	 * requires to already have an elevated page->_count.
 	 */
-	VM_BUG_ON_PAGE(atomic_read(&page->_count) <= 0, page);
+	VM_BUG_ON_PAGE(page_ref_zero_or_close_to_overflow(page), page);
 	atomic_inc(&page->_count);
 }
 
+static inline __must_check bool try_get_page(struct page *page)
+{
+	if (unlikely(PageTail(page)))
+		if (likely(__get_page_tail(page)))
+			return true;
+
+	if (WARN_ON_ONCE(atomic_read(&page->_count) <= 0))
+		return false;
+	atomic_inc(&page->_count);
+	return true;
+}
+
 static inline struct page *virt_to_head_page(const void *x)
 {
 	struct page *page = virt_to_page(x);