Merge 4.4.176 into android-4.4-p

Changes in 4.4.176
	net: fix IPv6 prefix route residue
	vsock: cope with memory allocation failure at socket creation time
	hwmon: (lm80) Fix missing unlock on error in set_fan_div()
	net: Fix for_each_netdev_feature on Big endian
	sky2: Increase D3 delay again
	net: Add header for usage of fls64()
	tcp: tcp_v4_err() should be more careful
	net: Do not allocate page fragments that are not skb aligned
	tcp: clear icsk_backoff in tcp_write_queue_purge()
	vxlan: test dev->flags & IFF_UP before calling netif_rx()
	net: stmmac: Fix a race in EEE enable callback
	net: ipv4: use a dedicated counter for icmp_v4 redirect packets
	x86: livepatch: Treat R_X86_64_PLT32 as R_X86_64_PC32
	kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
	mfd: as3722: Handle interrupts on suspend
	mfd: as3722: Mark PM functions as __maybe_unused
	net/x25: do not hold the cpu too long in x25_new_lci()
	mISDN: fix a race in dev_expire_timer()
	ax25: fix possible use-after-free
	KVM: VMX: Fix x2apic check in vmx_msr_bitmap_mode()
	Linux 4.4.176

Change-Id: I82b10bb7d9692d4fe0386744934f09557d65ffe6
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index e4be695eb789..fce48d11ae07 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2711,14 +2711,15 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
 		return ret;
 	}
 
+	kvm_get_kvm(kvm);
 	ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
 	if (ret < 0) {
+		kvm_put_kvm(kvm);
 		ops->destroy(dev);
 		return ret;
 	}
 
 	list_add(&dev->vm_node, &kvm->devices);
-	kvm_get_kvm(kvm);
 	cd->fd = ret;
 	return 0;
 }