Merge 4.4.225 into android-4.4-p

Changes in 4.4.225
	igb: use igb_adapter->io_addr instead of e1000_hw->hw_addr
	padata: Remove unused but set variables
	padata: get_next is never NULL
	padata: ensure the reorder timer callback runs on the correct CPU
	padata: ensure padata_do_serial() runs on the correct CPU
	evm: Check also if *tfm is an error pointer in init_desc()
	fix multiplication overflow in copy_fdtable()
	HID: multitouch: add eGalaxTouch P80H84 support
	ceph: fix double unlock in handle_cap_export()
	USB: core: Fix misleading driver bug report
	platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA
	ARM: futex: Address build warning
	media: Fix media_open() to clear filp->private_data in error leg
	drivers/media/media-devnode: clear private_data before put_device()
	media-devnode: add missing mutex lock in error handler
	media-devnode: fix namespace mess
	media-device: dynamically allocate struct media_devnode
	media: fix use-after-free in cdev_put() when app exits after driver unbind
	media: fix media devnode ioctl/syscall and unregister race
	i2c: dev: switch from register_chrdev to cdev API
	i2c: dev: don't start function name with 'return'
	i2c: dev: use after free in detach
	i2c-dev: don't get i2c adapter via i2c_dev
	i2c: dev: Fix the race between the release of i2c_dev and cdev
	padata: set cpu_index of unused CPUs to -1
	sched/fair, cpumask: Export for_each_cpu_wrap()
	padata: Replace delayed timer with immediate workqueue in padata_reorder
	padata: initialize pd->cpu with effective cpumask
	padata: purge get_cpu and reorder_via_wq from padata_do_serial
	ALSA: pcm: fix incorrect hw_base increase
	ext4: lock the xattr block before checksuming it
	platform/x86: alienware-wmi: fix kfree on potentially uninitialized pointer
	libnvdimm/btt: Remove unnecessary code in btt_freelist_init
	l2tp: lock socket before checking flags in connect()
	l2tp: fix racy socket lookup in l2tp_ip and l2tp_ip6 bind()
	l2tp: hold session while sending creation notifications
	l2tp: take a reference on sessions used in genetlink handlers
	l2tp: don't use l2tp_tunnel_find() in l2tp_ip and l2tp_ip6
	net: l2tp: export debug flags to UAPI
	net: l2tp: deprecate PPPOL2TP_MSG_* in favour of L2TP_MSG_*
	net: l2tp: ppp: change PPPOL2TP_MSG_* => L2TP_MSG_*
	New kernel function to get IP overhead on a socket.
	L2TP:Adjust intf MTU, add underlay L3, L2 hdrs.
	l2tp: remove useless duplicate session detection in l2tp_netlink
	l2tp: remove l2tp_session_find()
	l2tp: define parameters of l2tp_session_get*() as "const"
	l2tp: define parameters of l2tp_tunnel_find*() as "const"
	l2tp: initialise session's refcount before making it reachable
	l2tp: hold tunnel while looking up sessions in l2tp_netlink
	l2tp: hold tunnel while processing genl delete command
	l2tp: hold tunnel while handling genl tunnel updates
	l2tp: hold tunnel while handling genl TUNNEL_GET commands
	l2tp: hold tunnel used while creating sessions with netlink
	l2tp: prevent creation of sessions on terminated tunnels
	l2tp: pass tunnel pointer to ->session_create()
	l2tp: fix l2tp_eth module loading
	l2tp: don't register sessions in l2tp_session_create()
	l2tp: initialise l2tp_eth sessions before registering them
	l2tp: protect sock pointer of struct pppol2tp_session with RCU
	l2tp: initialise PPP sessions before registering them
	Revert "gfs2: Don't demote a glock until its revokes are written"
	staging: iio: ad2s1210: Fix SPI reading
	mei: release me_cl object reference
	iio: sca3000: Remove an erroneous 'get_device()'
	l2tp: device MTU setup, tunnel socket needs a lock
	cpumask: Make for_each_cpu_wrap() available on UP as well
	Linux 4.4.225

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I87dc4ca47f34d594fff7c1da28c7a4596659c029

1 files changed, 39 insertions, 43 deletions

diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
index 2a7aa16fcebc..25db99dc684f 100644
--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -134,6 +134,7 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
 	unsigned char *ptr, *optr;
 	struct l2tp_session *session;
 	struct l2tp_tunnel *tunnel = NULL;
+	struct ipv6hdr *iph;
 	int length;
 
 	if (!pskb_may_pull(skb, 4))
@@ -193,24 +194,16 @@ pass_up:
 		goto discard;
 
 	tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
-	tunnel = l2tp_tunnel_find(net, tunnel_id);
-	if (tunnel) {
-		sk = tunnel->sock;
-		sock_hold(sk);
-	} else {
-		struct ipv6hdr *iph = ipv6_hdr(skb);
-
-		read_lock_bh(&l2tp_ip6_lock);
-		sk = __l2tp_ip6_bind_lookup(net, &iph->daddr,
-					    0, tunnel_id);
-		if (!sk) {
-			read_unlock_bh(&l2tp_ip6_lock);
-			goto discard;
-		}
+	iph = ipv6_hdr(skb);
 
-		sock_hold(sk);
+	read_lock_bh(&l2tp_ip6_lock);
+	sk = __l2tp_ip6_bind_lookup(net, &iph->daddr, 0, tunnel_id);
+	if (!sk) {
 		read_unlock_bh(&l2tp_ip6_lock);
+		goto discard;
 	}
+	sock_hold(sk);
+	read_unlock_bh(&l2tp_ip6_lock);
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_put;
@@ -278,6 +271,7 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	struct sockaddr_l2tpip6 *addr = (struct sockaddr_l2tpip6 *) uaddr;
 	struct net *net = sock_net(sk);
 	__be32 v4addr = 0;
+	int bound_dev_if;
 	int addr_type;
 	int err;
 
@@ -296,13 +290,6 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (addr_type & IPV6_ADDR_MULTICAST)
 		return -EADDRNOTAVAIL;
 
-	err = -EADDRINUSE;
-	read_lock_bh(&l2tp_ip6_lock);
-	if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr,
-				   sk->sk_bound_dev_if, addr->l2tp_conn_id))
-		goto out_in_use;
-	read_unlock_bh(&l2tp_ip6_lock);
-
 	lock_sock(sk);
 
 	err = -EINVAL;
@@ -312,28 +299,25 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	if (sk->sk_state != TCP_CLOSE)
 		goto out_unlock;
 
+	bound_dev_if = sk->sk_bound_dev_if;
+
 	/* Check if the address belongs to the host. */
 	rcu_read_lock();
 	if (addr_type != IPV6_ADDR_ANY) {
 		struct net_device *dev = NULL;
 
 		if (addr_type & IPV6_ADDR_LINKLOCAL) {
-			if (addr_len >= sizeof(struct sockaddr_in6) &&
-			    addr->l2tp_scope_id) {
-				/* Override any existing binding, if another
-				 * one is supplied by user.
-				 */
-				sk->sk_bound_dev_if = addr->l2tp_scope_id;
-			}
+			if (addr->l2tp_scope_id)
+				bound_dev_if = addr->l2tp_scope_id;
 
 			/* Binding to link-local address requires an
-			   interface */
-			if (!sk->sk_bound_dev_if)
+			 * interface.
+			 */
+			if (!bound_dev_if)
 				goto out_unlock_rcu;
 
 			err = -ENODEV;
-			dev = dev_get_by_index_rcu(sock_net(sk),
-						   sk->sk_bound_dev_if);
+			dev = dev_get_by_index_rcu(sock_net(sk), bound_dev_if);
 			if (!dev)
 				goto out_unlock_rcu;
 		}
@@ -348,13 +332,22 @@ static int l2tp_ip6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	}
 	rcu_read_unlock();
 
-	inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
+	write_lock_bh(&l2tp_ip6_lock);
+	if (__l2tp_ip6_bind_lookup(net, &addr->l2tp_addr, bound_dev_if,
+				   addr->l2tp_conn_id)) {
+		write_unlock_bh(&l2tp_ip6_lock);
+		err = -EADDRINUSE;
+		goto out_unlock;
+	}
+
+	inet->inet_saddr = v4addr;
+	inet->inet_rcv_saddr = v4addr;
+	sk->sk_bound_dev_if = bound_dev_if;
 	sk->sk_v6_rcv_saddr = addr->l2tp_addr;
 	np->saddr = addr->l2tp_addr;
 
 	l2tp_ip6_sk(sk)->conn_id = addr->l2tp_conn_id;
 
-	write_lock_bh(&l2tp_ip6_lock);
 	sk_add_bind_node(sk, &l2tp_ip6_bind_table);
 	sk_del_node_init(sk);
 	write_unlock_bh(&l2tp_ip6_lock);
@@ -367,10 +360,7 @@ out_unlock_rcu:
 	rcu_read_unlock();
 out_unlock:
 	release_sock(sk);
-	return err;
 
-out_in_use:
-	read_unlock_bh(&l2tp_ip6_lock);
 	return err;
 }
 
@@ -383,9 +373,6 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
 	int	addr_type;
 	int rc;
 
-	if (sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-		return -EINVAL;
-
 	if (addr_len < sizeof(*lsa))
 		return -EINVAL;
 
@@ -402,10 +389,18 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
 			return -EINVAL;
 	}
 
-	rc = ip6_datagram_connect(sk, uaddr, addr_len);
-
 	lock_sock(sk);
 
+	 /* Must bind first - autobinding does not work */
+	if (sock_flag(sk, SOCK_ZAPPED)) {
+		rc = -EINVAL;
+		goto out_sk;
+	}
+
+	rc = __ip6_datagram_connect(sk, uaddr, addr_len);
+	if (rc < 0)
+		goto out_sk;
+
 	l2tp_ip6_sk(sk)->peer_conn_id = lsa->l2tp_conn_id;
 
 	write_lock_bh(&l2tp_ip6_lock);
@@ -413,6 +408,7 @@ static int l2tp_ip6_connect(struct sock *sk, struct sockaddr *uaddr,
 	sk_add_bind_node(sk, &l2tp_ip6_bind_table);
 	write_unlock_bh(&l2tp_ip6_lock);
 
+out_sk:
 	release_sock(sk);
 
 	return rc;