Merge 4.4.278 into android-4.4-p

Changes in 4.4.278
	net: split out functions related to registering inflight socket files
	af_unix: fix garbage collect vs MSG_PEEK
	workqueue: fix UAF in pwq_unbound_release_workfn()
	net/802/mrp: fix memleak in mrp_request_join()
	net/802/garp: fix memleak in garp_request_join()
	sctp: move 198 addresses from unusable to private scope
	hfs: add missing clean-up in hfs_fill_super
	hfs: fix high memory mapping in hfs_bnode_read
	hfs: add lock nesting notation to hfs_find_init
	ARM: dts: versatile: Fix up interrupt controller node names
	lib/string.c: add multibyte memset functions
	ARM: ensure the signal page contains defined contents
	ocfs2: fix zero out valid data
	ocfs2: issue zeroout to EOF blocks
	can: usb_8dev: fix memory leak
	can: ems_usb: fix memory leak
	can: esd_usb2: fix memory leak
	NIU: fix incorrect error return, missed in previous revert
	x86/asm: Ensure asm/proto.h can be included stand-alone
	cfg80211: Fix possible memory leak in function cfg80211_bss_update
	netfilter: nft_nat: allow to specify layer 4 protocol NAT only
	tipc: fix sleeping in tipc accept routine
	mlx4: Fix missing error code in mlx4_load_one()
	net: llc: fix skb_over_panic
	tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
	sis900: Fix missing pci_disable_device() in probe and remove
	Linux 4.4.278

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I51e4e7e9cc9db03de57626e25e3785c400ced81f

1 files changed, 2 insertions, 66 deletions

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index c36757e72844..8bbe1b8e4ff7 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -86,77 +86,13 @@
 #include <net/scm.h>
 #include <net/tcp_states.h>
 
+#include "scm.h"
+
 /* Internal data structures and random procedures: */
 
-static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
-static DEFINE_SPINLOCK(unix_gc_lock);
 static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 
-unsigned int unix_tot_inflight;
-
-struct sock *unix_get_socket(struct file *filp)
-{
-	struct sock *u_sock = NULL;
-	struct inode *inode = file_inode(filp);
-
-	/* Socket ? */
-	if (S_ISSOCK(inode->i_mode) && !(filp->f_mode & FMODE_PATH)) {
-		struct socket *sock = SOCKET_I(inode);
-		struct sock *s = sock->sk;
-
-		/* PF_UNIX ? */
-		if (s && sock->ops && sock->ops->family == PF_UNIX)
-			u_sock = s;
-	}
-	return u_sock;
-}
-
-/* Keep the number of times in flight count for the file
- * descriptor if it is for an AF_UNIX socket.
- */
-
-void unix_inflight(struct user_struct *user, struct file *fp)
-{
-	struct sock *s = unix_get_socket(fp);
-
-	spin_lock(&unix_gc_lock);
-
-	if (s) {
-		struct unix_sock *u = unix_sk(s);
-
-		if (atomic_long_inc_return(&u->inflight) == 1) {
-			BUG_ON(!list_empty(&u->link));
-			list_add_tail(&u->link, &gc_inflight_list);
-		} else {
-			BUG_ON(list_empty(&u->link));
-		}
-		unix_tot_inflight++;
-	}
-	user->unix_inflight++;
-	spin_unlock(&unix_gc_lock);
-}
-
-void unix_notinflight(struct user_struct *user, struct file *fp)
-{
-	struct sock *s = unix_get_socket(fp);
-
-	spin_lock(&unix_gc_lock);
-
-	if (s) {
-		struct unix_sock *u = unix_sk(s);
-
-		BUG_ON(!atomic_long_read(&u->inflight));
-		BUG_ON(list_empty(&u->link));
-
-		if (atomic_long_dec_and_test(&u->inflight))
-			list_del_init(&u->link);
-		unix_tot_inflight--;
-	}
-	user->unix_inflight--;
-	spin_unlock(&unix_gc_lock);
-}
-
 static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
 			  struct sk_buff_head *hitlist)
 {