Merge 4.4.231 into android-4.4-p

Changes in 4.4.231
	KVM: s390: reduce number of IO pins to 1
	spi: spidev: fix a race between spidev_release and spidev_remove
	spi: spidev: fix a potential use-after-free in spidev_release()
	scsi: mptscsih: Fix read sense data size
	net: cxgb4: fix return error value in t4_prep_fw
	smsc95xx: check return value of smsc95xx_reset
	smsc95xx: avoid memory leak in smsc95xx_bind
	ALSA: compress: fix partial_drain completion state
	arm64: kgdb: Fix single-step exception handling oops
	ALSA: opl3: fix infoleak in opl3
	ALSA: hda - let hs_mic be picked ahead of hp_mic
	ALSA: usb-audio: add quirk for MacroSilicon MS2109
	KVM: x86: bit 8 of non-leaf PDPEs is not reserved
	Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
	btrfs: fix fatal extent_buffer readahead vs releasepage race
	drm/radeon: fix double free
	ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE
	ARC: elf: use right ELF_ARCH
	bnxt_en: fix NULL dereference in case SR-IOV configuration fails
	ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
	l2tp: remove skb_dst_set() from l2tp_xmit_skb()
	llc: make sure applications use ARPHRD_ETHER
	net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
	genetlink: remove genl_bind
	tcp: make sure listeners don't initialize congestion-control state
	tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
	tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
	tcp: md5: allow changing MD5 keys in all socket states
	i2c: eg20t: Load module automatically if ID matches
	Revert "usb/ehci-platform: Set PM runtime as active on resume"
	Revert "usb/xhci-plat: Set PM runtime as active on resume"
	Revert "usb/ohci-platform: Fix a warning when hibernating"
	usb: gadget: udc: atmel: fix uninitialized read in debug printk
	staging: comedi: verify array index is correct before using it
	perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode
	mtd: rawnand: brcmnand: fix CS0 layout
	HID: magicmouse: do not set up autorepeat
	usb: core: Add a helper function to check the validity of EP type in URB
	ALSA: line6: Perform sanity check for each URB creation
	ALSA: usb-audio: Fix race against the error recovery URB submission
	USB: c67x00: fix use after free in c67x00_giveback_urb
	usb: chipidea: core: add wakeup support for extcon
	usb: gadget: function: fix missing spinlock in f_uac1_legacy
	USB: serial: iuu_phoenix: fix memory corruption
	USB: serial: cypress_m8: enable Simply Automated UPB PIM
	USB: serial: ch341: add new Product ID for CH340
	USB: serial: option: add GosunCn GM500 series
	USB: serial: option: add Quectel EG95 LTE modem
	virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
	fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
	mei: bus: don't clean driver pointer
	Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
	uio_pdrv_genirq: fix use without device tree and no interrupt
	MIPS: Fix build for LTS kernel caused by backporting lpj adjustment
	hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
	dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
	misc: atmel-ssc: lock with mutex instead of spinlock
	sched/fair: handle case of task_h_load() returning 0
	Linux 4.4.231

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibbd0a09b0d8d49101c674cf304c3df711e940b77

1 files changed, 8 insertions, 5 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f84abab24d71..081537596ea7 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2259,6 +2259,9 @@ int tcp_disconnect(struct sock *sk, int flags)
 	tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
 	tp->snd_cwnd_cnt = 0;
 	tp->window_clamp = 0;
+	if (icsk->icsk_ca_ops->release)
+		icsk->icsk_ca_ops->release(sk);
+	memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
 	tcp_set_ca_state(sk, TCP_CA_Open);
 	tcp_clear_retrans(tp);
 	tp->total_retrans = 0;
@@ -2593,10 +2596,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 
 #ifdef CONFIG_TCP_MD5SIG
 	case TCP_MD5SIG:
-		if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
-			err = tp->af_specific->md5_parse(sk, optval, optlen);
-		else
-			err = -EINVAL;
+		err = tp->af_specific->md5_parse(sk, optval, optlen);
 		break;
 #endif
 	case TCP_USER_TIMEOUT:
@@ -3085,9 +3085,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);
 
 int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
 {
+	u8 keylen = READ_ONCE(key->keylen); /* paired with WRITE_ONCE() in tcp_md5_do_add */
 	struct scatterlist sg;
 
-	sg_init_one(&sg, key->key, key->keylen);
+	sg_init_one(&sg, key->key, keylen);
+
+	/* tcp_md5_do_add() might change key->key under us */
 	return crypto_hash_update(&hp->md5_desc, &sg, key->keylen);
 }
 EXPORT_SYMBOL(tcp_md5_hash_key);