Merge android-4.4@89074de (v4.4.94) into msm-4.4

* refs/heads/tmp-89074de
  Linux 4.4.94
  Revert "tty: goldfish: Fix a parameter of a call to free_irq"
  cpufreq: CPPC: add ACPI_PROCESSOR dependency
  nfsd/callback: Cleanup callback cred on shutdown
  target/iscsi: Fix unsolicited data seq_end_offset calculation
  uapi: fix linux/mroute6.h userspace compilation errors
  uapi: fix linux/rds.h userspace compilation errors
  ceph: clean up unsafe d_parent accesses in build_dentry_path
  i2c: at91: ensure state is restored after suspending
  net: mvpp2: release reference to txq_cpu[] entry after unmapping
  scsi: scsi_dh_emc: return success in clariion_std_inquiry()
  slub: do not merge cache if slub_debug contains a never-merge flag
  ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock
  crypto: xts - Add ECB dependency
  net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs
  sparc64: Migrate hvcons irq to panicked cpu
  md/linear: shutup lockdep warnning
  f2fs: do not wait for writeback in write_begin
  Btrfs: send, fix failure to rename top level inode due to name collision
  iio: adc: xilinx: Fix error handling
  netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.
  net/mlx4_en: fix overflow in mlx4_en_init_timestamp()
  mac80211: fix power saving clients handling in iwlwifi
  mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length
  irqchip/crossbar: Fix incorrect type of local variables
  watchdog: kempld: fix gcc-4.3 build
  locking/lockdep: Add nest_lock integrity test
  Revert "bsg-lib: don't free job in bsg_prepare_job"
  tipc: use only positive error codes in messages
  net: Set sk_prot_creator when cloning sockets to the right proto
  packet: only test po->has_vnet_hdr once in packet_snd
  packet: in packet_do_bind, test fanout with bind_lock held
  tun: bail out from tun_get_user() if the skb is empty
  l2tp: fix race condition in l2tp_tunnel_delete
  l2tp: Avoid schedule while atomic in exit_net
  vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
  isdn/i4l: fetch the ppp_write buffer in one shot
  bpf: one perf event close won't free bpf program attached by another perf event
  packet: hold bind lock when rebinding to fanout hook
  net: emac: Fix napi poll list corruption
  ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
  udpv6: Fix the checksum computation when HW checksum does not apply
  bpf/verifier: reject BPF_ALU64|BPF_END
  sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
  MIPS: Fix minimum alignment requirement of IRQ stack
  drm/dp/mst: save vcpi with payloads
  percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
  trace: sched: Fix util_avg_walt in sched_load_avg_cpu trace
  sched/fair: remove erroneous RCU_LOCKDEP_WARN from start_cpu()
  sched: EAS/WALT: finish accounting prior to task_tick
  cpufreq: sched: update capacity request upon tick always
  sched/fair: prevent meaningless active migration
  sched: walt: Leverage existing helper APIs to apply invariance

Conflicts:
	kernel/sched/core.c
	kernel/sched/fair.c
	kernel/sched/sched.h

Change-Id: I0effac90fb6a4db559479bfa2fefa31c41200ce9
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

1 files changed, 19 insertions, 9 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index b70055fc30cb..241f69039a72 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1652,10 +1652,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 
 	mutex_lock(&fanout_mutex);
 
-	err = -EINVAL;
-	if (!po->running)
-		goto out;
-
 	err = -EALREADY;
 	if (po->fanout)
 		goto out;
@@ -1704,7 +1700,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 		list_add(&match->list, &fanout_list);
 	}
 	err = -EINVAL;
-	if (match->type == type &&
+
+	spin_lock(&po->bind_lock);
+	if (po->running &&
+	    match->type == type &&
 	    match->prot_hook.type == po->prot_hook.type &&
 	    match->prot_hook.dev == po->prot_hook.dev) {
 		err = -ENOSPC;
@@ -1716,6 +1715,13 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
 			err = 0;
 		}
 	}
+	spin_unlock(&po->bind_lock);
+
+	if (err && !atomic_read(&match->sk_ref)) {
+		list_del(&match->list);
+		kfree(match);
+	}
+
 out:
 	if (err && rollover) {
 		kfree(rollover);
@@ -2650,6 +2656,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 	int vnet_hdr_len;
 	struct packet_sock *po = pkt_sk(sk);
 	unsigned short gso_type = 0;
+	bool has_vnet_hdr = false;
 	int hlen, tlen, linear;
 	int extra_len = 0;
 	ssize_t n;
@@ -2737,6 +2744,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 				goto out_unlock;
 
 		}
+		has_vnet_hdr = true;
 	}
 
 	if (unlikely(sock_flag(sk, SOCK_NOFCS))) {
@@ -2796,7 +2804,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
 
 	packet_pick_tx_queue(dev, skb);
 
-	if (po->has_vnet_hdr) {
+	if (has_vnet_hdr) {
 		if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
 			u16 s = __virtio16_to_cpu(vio_le(), vnet_hdr.csum_start);
 			u16 o = __virtio16_to_cpu(vio_le(), vnet_hdr.csum_offset);
@@ -2938,13 +2946,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
 	int ret = 0;
 	bool unlisted = false;
 
-	if (po->fanout)
-		return -EINVAL;
-
 	lock_sock(sk);
 	spin_lock(&po->bind_lock);
 	rcu_read_lock();
 
+	if (po->fanout) {
+		ret = -EINVAL;
+		goto out_unlock;
+	}
+
 	if (name) {
 		dev = dev_get_by_name_rcu(sock_net(sk), name);
 		if (!dev) {