Merge 4.4.277 into android-4.4-p

Changes in 4.4.277
	ARM: brcmstb: dts: fix NAND nodes names
	ARM: dts: BCM63xx: Fix NAND nodes names
	ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
	ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
	thermal/core: Correct function name thermal_zone_device_unregister()
	kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
	scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
	sched/fair: Fix CFS bandwidth hrtimer expiry type
	Revert "memory: fsl_ifc: fix leak of IO mapping on probe failure"
	x86/fpu: Make init_fpstate correct with optimized XSAVE
	net: ipv6: fix return value of ip6_skb_dst_mtu
	net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
	net: moxa: fix UAF in moxart_mac_probe
	net: ti: fix UAF in tlan_remove_one
	net: validate lwtstate->data before returning from skb_tunnel_info()
	tcp: annotate data races around tp->mtu_info
	ipv6: tcp: drop silly ICMPv6 packet too big messages
	iavf: Fix an error handling path in 'iavf_probe()'
	igb: Check if num of q_vectors is smaller than max before array access
	perf test bpf: Free obj_buf
	perf probe-file: Delete namelist in del_events() on the error path
	s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
	net: fix uninit-value in caif_seqpkt_sendmsg
	net: decnet: Fix sleeping inside in af_decnet
	netrom: Decrease sock refcount when sock timers expire
	scsi: iscsi: Fix iface sysfs attr detection
	scsi: target: Fix protect handling in WRITE SAME(32)
	Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
	proc: Avoid mixing integer types in mem_rw()
	s390/ftrace: fix ftrace_update_ftrace_func implementation
	ALSA: sb: Fix potential ABBA deadlock in CSP driver
	xhci: Fix lost USB 2 remote wake
	KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
	usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
	USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
	usb: max-3421: Prevent corruption of freed memory
	usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
	USB: serial: option: add support for u-blox LARA-R6 family
	USB: serial: cp210x: fix comments for GE CS1000
	USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
	tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
	media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
	net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
	iio: accel: bma180: Use explicit member assignment
	iio: accel: bma180: Fix BMA25x bandwidth register values
	btrfs: compression: don't try to compress if we don't have enough pages
	Linux 4.4.277

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7159a9fb5545e504222fcee566c6661c1070c8f7

1 files changed, 17 insertions, 2 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2102604b7a37..728c5ac4d2b3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -309,11 +309,20 @@ failure:
 static void tcp_v6_mtu_reduced(struct sock *sk)
 {
 	struct dst_entry *dst;
+	u32 mtu;
 
 	if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
 		return;
 
-	dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
+	mtu = READ_ONCE(tcp_sk(sk)->mtu_info);
+
+	/* Drop requests trying to increase our current mss.
+	 * Check done in __ip6_rt_update_pmtu() is too late.
+	 */
+	if (tcp_mtu_to_mss(sk, mtu) >= tcp_sk(sk)->mss_cache)
+		return;
+
+	dst = inet6_csk_update_pmtu(sk, mtu);
 	if (!dst)
 		return;
 
@@ -392,6 +401,8 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	}
 
 	if (type == ICMPV6_PKT_TOOBIG) {
+		u32 mtu = ntohl(info);
+
 		/* We are not interested in TCP_LISTEN and open_requests
 		 * (SYN-ACKs send out by Linux are always <576bytes so
 		 * they should go through unfragmented).
@@ -402,7 +413,11 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		if (!ip6_sk_accept_pmtu(sk))
 			goto out;
 
-		tp->mtu_info = ntohl(info);
+		if (mtu < IPV6_MIN_MTU)
+			goto out;
+
+		WRITE_ONCE(tp->mtu_info, mtu);
+
 		if (!sock_owned_by_user(sk))
 			tcp_v6_mtu_reduced(sk);
 		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,