Merge 4.4.157 into android-4.4-p

Changes in 4.4.157
	i2c: xiic: Make the start and the byte count write atomic
	i2c: i801: fix DNV's SMBCTRL register offset
	ALSA: hda - Fix cancel_work_sync() stall from jackpoll work
	cfq: Give a chance for arming slice idle timer in case of group_idle
	kthread: Fix use-after-free if kthread fork fails
	kthread: fix boot hang (regression) on MIPS/OpenRISC
	staging: rt5208: Fix a sleep-in-atomic bug in xd_copy_page
	staging/rts5208: Fix read overflow in memcpy
	block,blkcg: use __GFP_NOWARN for best-effort allocations in blkcg
	locking/rwsem-xadd: Fix missed wakeup due to reordering of load
	selinux: use GFP_NOWAIT in the AVC kmem_caches
	locking/osq_lock: Fix osq_lock queue corruption
	ARC: [plat-axs*]: Enable SWAP
	misc: mic: SCIF Fix scif_get_new_port() error handling
	ethtool: Remove trailing semicolon for static inline
	Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV
	gpio: tegra: Move driver registration to subsys_init level
	scsi: target: fix __transport_register_session locking
	md/raid5: fix data corruption of replacements after originals dropped
	misc: ti-st: Fix memory leak in the error path of probe()
	uio: potential double frees if __uio_register_device() fails
	tty: rocket: Fix possible buffer overwrite on register_PCI
	f2fs: do not set free of current section
	perf tools: Allow overriding MAX_NR_CPUS at compile time
	NFSv4.0 fix client reference leak in callback
	macintosh/via-pmu: Add missing mmio accessors
	ath10k: prevent active scans on potential unusable channels
	MIPS: Fix ISA virt/bus conversion for non-zero PHYS_OFFSET
	ata: libahci: Correct setting of DEVSLP register
	scsi: 3ware: fix return 0 on the error path of probe
	ath10k: disable bundle mgmt tx completion event support
	Bluetooth: hidp: Fix handling of strncpy for hid->name information
	x86/mm: Remove in_nmi() warning from vmalloc_fault()
	gpio: ml-ioh: Fix buffer underwrite on probe error path
	net: mvneta: fix mtu change on port without link
	MIPS: Octeon: add missing of_node_put()
	net: dcb: For wild-card lookups, use priority -1, not 0
	Input: atmel_mxt_ts - only use first T9 instance
	partitions/aix: append null character to print data from disk
	partitions/aix: fix usage of uninitialized lv_info and lvname structures
	iommu/ipmmu-vmsa: Fix allocation in atomic context
	mfd: ti_am335x_tscadc: Fix struct clk memory leak
	f2fs: fix to do sanity check with {sit,nat}_ver_bitmap_bytesize
	MIPS: WARN_ON invalid DMA cache maintenance, not BUG_ON
	RDMA/cma: Do not ignore net namespace for unbound cm_id
	xhci: Fix use-after-free in xhci_free_virt_device
	vmw_balloon: include asm/io.h
	netfilter: x_tables: avoid stack-out-of-bounds read in xt_copy_counters_from_user
	drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config
	net: ethernet: ti: cpsw: fix mdio device reference leak
	ethernet: ti: davinci_emac: add missing of_node_put after calling of_parse_phandle
	crypto: vmx - Fix sleep-in-atomic bugs
	mtd: ubi: wl: Fix error return code in ubi_wl_init()
	autofs: fix autofs_sbi() does not check super block type
	x86/speculation/l1tf: Increase l1tf memory limit for Nehalem+
	mm: get rid of vmacache_flush_all() entirely
	Linux 4.4.157

Change-Id: I08e4c24c1a22ef0e97f9185bc9da72f4a651ca73
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 12 insertions, 5 deletions

diff --git a/kernel/fork.c b/kernel/fork.c
index eb30711e7d44..5a90b0f6d668 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1366,6 +1366,18 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 
 	cpufreq_task_times_init(p);
 
+	/*
+	 * This _must_ happen before we call free_task(), i.e. before we jump
+	 * to any of the bad_fork_* labels. This is to avoid freeing
+	 * p->set_child_tid which is (ab)used as a kthread's data pointer for
+	 * kernel threads (PF_KTHREAD).
+	 */
+	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+	/*
+	 * Clear TID on mm_release()?
+	 */
+	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
+
 	ftrace_graph_init_task(p);
 
 	rt_mutex_init_task(p);
@@ -1527,11 +1539,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 		}
 	}
 
-	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
-	/*
-	 * Clear TID on mm_release()?
-	 */
-	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
 #ifdef CONFIG_BLOCK
 	p->plug = NULL;
 #endif