Merge android-4.4.181 (bd858d7) into msm-4.4

* refs/heads/tmp-bd858d7
  Linux 4.4.181
  ethtool: check the return value of get_regs_len
  ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled
  fuse: Add FOPEN_STREAM to use stream_open()
  fs: stream_open - opener for stream-like files so that read and write can run simultaneously without deadlock
  drm/gma500/cdv: Check vbt config bits when detecting lvds panels
  genwqe: Prevent an integer overflow in the ioctl
  MIPS: pistachio: Build uImage.gz by default
  fuse: fallocate: fix return with locked inode
  parisc: Use implicit space register selection for loading the coherence index of I/O pdirs
  rcu: locking and unlocking need to always be at least barriers
  pktgen: do not sleep with the thread lock held.
  net: rds: fix memory leak in rds_ib_flush_mr_pool
  net/mlx4_en: ethtool, Remove unsupported SFP EEPROM high pages query
  neighbor: Call __ipv4_neigh_lookup_noref in neigh_xmit
  ethtool: fix potential userspace buffer overflow
  media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
  usb: gadget: fix request length error for isoc transfer
  net: cdc_ncm: GetNtbFormat endian fix
  Revert "x86/build: Move _etext to actual end of .text"
  userfaultfd: don't pin the user memory in userfaultfd_file_create()
  brcmfmac: add subtype check for event handling in data path
  brcmfmac: add length checks in scheduled scan result handler
  brcmfmac: fix incorrect event channel deduction
  brcmfmac: revise handling events in receive path
  brcmfmac: screening firmware event packet
  brcmfmac: Add length checks on firmware events
  bnx2x: disable GSO where gso_size is too big for hardware
  net: create skb_gso_validate_mac_len()
  binder: replace "%p" with "%pK"
  binder: Replace "%p" with "%pK" for stable
  CIFS: cifs_read_allocate_pages: don't iterate through whole page array on ENOMEM
  kernel/signal.c: trace_signal_deliver when signal_group_exit
  memcg: make it work on sparse non-0-node systems
  tty: max310x: Fix external crystal register setup
  tty: serial: msm_serial: Fix XON/XOFF
  drm/nouveau/i2c: Disable i2c bus access after ->fini()
  ALSA: hda/realtek - Set default power save node to 0
  Btrfs: fix race updating log root item during fsync
  scsi: zfcp: fix to prevent port_remove with pure auto scan LUNs (only sdevs)
  scsi: zfcp: fix missing zfcp_port reference put on -EBUSY from port_remove
  media: smsusb: better handle optional alignment
  media: usb: siano: Fix false-positive "uninitialized variable" warning
  media: usb: siano: Fix general protection fault in smsusb
  USB: rio500: fix memory leak in close after disconnect
  USB: rio500: refuse more than one device at a time
  USB: Add LPM quirk for Surface Dock GigE adapter
  USB: sisusbvga: fix oops in error path of sisusb_probe
  USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
  usb: xhci: avoid null pointer deref when bos field is NULL
  xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()
  include/linux/bitops.h: sanitize rotate primitives
  sparc64: Fix regression in non-hypervisor TLB flush xcall
  tipc: fix modprobe tipc failed after switch order of device registration -v2
  Revert "tipc: fix modprobe tipc failed after switch order of device registration"
  xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
  crypto: vmx - ghash: do nosimd fallback manually
  net: mvpp2: fix bad MVPP2_TXQ_SCHED_TOKEN_CNTR_REG queue value
  bnxt_en: Fix aggregation buffer leak under OOM condition.
  tipc: Avoid copying bytes beyond the supplied data
  usbnet: fix kernel crash after disconnect
  net: stmmac: fix reset gpio free missing
  net-gro: fix use-after-free read in napi_gro_frags()
  llc: fix skb leak in llc_build_and_send_ui_pkt()
  ipv6: Consider sk_bound_dev_if when binding a raw socket to an address
  ASoC: davinci-mcasp: Fix clang warning without CONFIG_PM
  spi: Fix zero length xfer bug
  spi: rspi: Fix sequencer reset during initialization
  spi : spi-topcliff-pch: Fix to handle empty DMA buffers
  scsi: lpfc: Fix SLI3 commands being issued on SLI4 devices
  media: saa7146: avoid high stack usage with clang
  media: go7007: avoid clang frame overflow warning with KASAN
  media: m88ds3103: serialize reset messages in m88ds3103_set_frontend
  scsi: qla4xxx: avoid freeing unallocated dma memory
  usb: core: Add PM runtime calls to usb_hcd_platform_shutdown
  rcutorture: Fix cleanup path for invalid torture_type strings
  tty: ipwireless: fix missing checks for ioremap
  virtio_console: initialize vtermno value for ports
  media: wl128x: prevent two potential buffer overflows
  spi: tegra114: reset controller on probe
  cxgb3/l2t: Fix undefined behaviour
  ASoC: fsl_utils: fix a leaked reference by adding missing of_node_put
  ASoC: eukrea-tlv320: fix a leaked reference by adding missing of_node_put
  HID: core: move Usage Page concatenation to Main item
  chardev: add additional check for minor range overlap
  x86/ia32: Fix ia32_restore_sigcontext() AC leak
  arm64: cpu_ops: fix a leaked reference by adding missing of_node_put
  scsi: ufs: Avoid configuring regulator with undefined voltage range
  scsi: ufs: Fix regulator load and icc-level configuration
  brcmfmac: fix race during disconnect when USB completion is in progress
  brcmfmac: convert dev_init_lock mutex to completion
  b43: shut up clang -Wuninitialized variable warning
  brcmfmac: fix missing checks for kmemdup
  rtlwifi: fix a potential NULL pointer dereference
  iio: common: ssp_sensors: Initialize calculated_time in ssp_common_process_data
  iio: hmc5843: fix potential NULL pointer dereferences
  iio: ad_sigma_delta: Properly handle SPI bus locking vs CS assertion
  x86/build: Keep local relocations with ld.lld
  cpufreq: pmac32: fix possible object reference leak
  cpufreq/pasemi: fix possible object reference leak
  cpufreq: ppc_cbe: fix possible object reference leak
  s390: cio: fix cio_irb declaration
  extcon: arizona: Disable mic detect if running when driver is removed
  PM / core: Propagate dev->power.wakeup_path when no callbacks
  mmc: sdhci-of-esdhc: add erratum eSDHC-A001 and A-008358 support
  mmc: sdhci-of-esdhc: add erratum eSDHC5 support
  mmc_spi: add a status check for spi_sync_locked
  scsi: libsas: Do discovery on empty PHY to update PHY info
  hwmon: (f71805f) Use request_muxed_region for Super-IO accesses
  hwmon: (pc87427) Use request_muxed_region for Super-IO accesses
  hwmon: (smsc47b397) Use request_muxed_region for Super-IO accesses
  hwmon: (smsc47m1) Use request_muxed_region for Super-IO accesses
  hwmon: (vt1211) Use request_muxed_region for Super-IO accesses
  RDMA/cxgb4: Fix null pointer dereference on alloc_skb failure
  i40e: don't allow changes to HW VLAN stripping on active port VLANs
  x86/irq/64: Limit IST stack overflow check to #DB stack
  USB: core: Don't unbind interfaces following device reset failure
  sched/core: Handle overflow in cpu_shares_write_u64
  sched/core: Check quota and period overflow at usec to nsec conversion
  powerpc/numa: improve control of topology updates
  media: pvrusb2: Prevent a buffer overflow
  media: au0828: Fix NULL pointer dereference in au0828_analog_stream_enable()
  audit: fix a memory leak bug
  media: ov2659: make S_FMT succeed even if requested format doesn't match
  media: au0828: stop video streaming only when last user stops
  media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper
  media: coda: clear error return value before picture run
  dmaengine: at_xdmac: remove BUG_ON macro in tasklet
  pinctrl: pistachio: fix leaked of_node references
  HID: logitech-hidpp: use RAP instead of FAP to get the protocol version
  mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
  x86/mm: Remove in_nmi() warning from 64-bit implementation of vmalloc_fault()
  smpboot: Place the __percpu annotation correctly
  x86/build: Move _etext to actual end of .text
  bcache: avoid clang -Wunintialized warning
  bcache: add failure check to run_cache_set() for journal replay
  bcache: fix failure in journal relplay
  bcache: return error immediately in bch_journal_replay()
  net: cw1200: fix a NULL pointer dereference
  mwifiex: prevent an array overflow
  ASoC: fsl_sai: Update is_slave_mode with correct value
  mac80211/cfg80211: update bss channel on channel switch
  dmaengine: pl330: _stop: clear interrupt status
  w1: fix the resume command API
  rtc: 88pm860x: prevent use-after-free on device remove
  brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()
  spi: pxa2xx: fix SCR (divisor) calculation
  ASoC: imx: fix fiq dependencies
  powerpc/boot: Fix missing check of lseek() return value
  mmc: core: Verify SD bus width
  cxgb4: Fix error path in cxgb4_init_module
  gfs2: Fix lru_count going negative
  tools include: Adopt linux/bits.h
  perf tools: No need to include bitops.h in util.h
  at76c50x-usb: Don't register led_trigger if usb_register_driver failed
  ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
  media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
  media: cpia2: Fix use-after-free in cpia2_exit
  fbdev: fix WARNING in __alloc_pages_nodemask bug
  hugetlb: use same fault hash key for shared and private mappings
  fbdev: fix divide error in fb_var_to_videomode
  btrfs: sysfs: don't leak memory when failing add fsid
  Btrfs: fix race between ranged fsync and writeback of adjacent ranges
  gfs2: Fix sign extension bug in gfs2_update_stats
  crypto: vmx - CTR: always increment IV as quadword
  Revert "scsi: sd: Keep disk read-only when re-reading partition"
  bio: fix improper use of smp_mb__before_atomic()
  KVM: x86: fix return value for reserved EFER
  ext4: do not delete unlinked inode from orphan list on failed truncate
  fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough
  btrfs: Honour FITRIM range constraints during free space trim
  md/raid: raid5 preserve the writeback action after the parity check
  Revert "Don't jump to compute_result state from check_result state"
  perf bench numa: Add define for RUSAGE_THREAD if not present
  ufs: fix braino in ufs_get_inode_gid() for solaris UFS flavour
  power: supply: sysfs: prevent endless uevent loop with CONFIG_POWER_SUPPLY_DEBUG
  KVM: arm/arm64: Ensure vcpu target is unset on reset failure
  xfrm4: Fix uninitialized memory read in _decode_session4
  vti4: ipip tunnel deregistration fixes.
  xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module
  xfrm: policy: Fix out-of-bound array accesses in __xfrm_policy_unlink
  dm delay: fix a crash when invalid device is specified
  PCI: Mark Atheros AR9462 to avoid bus reset
  fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting
  fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display
  fbdev: sm712fb: fix support for 1024x768-16 mode
  fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM
  fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA
  fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F
  fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75
  fbdev: sm712fb: fix brightness control on reboot, don't set SR30
  perf intel-pt: Fix sample timestamp wrt non-taken branches
  perf intel-pt: Fix improved sample timestamp
  perf intel-pt: Fix instructions sampling rate
  memory: tegra: Fix integer overflow on tick value calculation
  tracing: Fix partial reading of trace event's id file
  ceph: flush dirty inodes before proceeding with remount
  iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
  fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
  fuse: fix writepages on 32bit
  clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
  NFS4: Fix v4.0 client state corruption when mount
  media: ov6650: Fix sensor possibly not detected on probe
  cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
  of: fix clang -Wunsequenced for be32_to_cpu()
  intel_th: msu: Fix single mode with IOMMU
  md: add mddev->pers to avoid potential NULL pointer dereference
  stm class: Fix channel free in stm output free path
  tipc: fix modprobe tipc failed after switch order of device registration
  tipc: switch order of device registration to fix a crash
  ppp: deflate: Fix possible crash in deflate_init
  net/mlx4_core: Change the error print to info print
  net: avoid weird emergency message
  KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
  ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug
  ext4: zero out the unused memory region in the extent tree block
  fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount
  writeback: synchronize sync(2) against cgroup writeback membership switches
  crypto: arm/aes-neonbs - don't access already-freed walk.iv
  crypto: salsa20 - don't access already-freed walk.iv
  crypto: chacha20poly1305 - set cra_name correctly
  crypto: gcm - fix incompatibility between "gcm" and "gcm_base"
  crypto: gcm - Fix error return code in crypto_gcm_create_common()
  ipmi:ssif: compare block number correctly for multi-part return messages
  bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim()
  bcache: fix a race between cache register and cacheset unregister
  Btrfs: do not start a transaction at iterate_extent_inodes()
  ext4: fix ext4_show_options for file systems w/o journal
  ext4: actually request zeroing of inode table after grow
  tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
  mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L
  ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
  mm/mincore.c: make mincore() more conservative
  ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
  ASoC: max98090: Fix restore of DAPM Muxes
  ALSA: hda/realtek - EAPD turn on later
  ALSA: hda/hdmi - Consider eld_valid when reporting jack event
  ALSA: usb-audio: Fix a memory leak bug
  crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest()
  crypto: crct10dif-generic - fix use via crypto_shash_digest()
  crypto: vmx - fix copy-paste error in CTR mode
  ARM: exynos: Fix a leaked reference by adding missing of_node_put
  x86/speculation/mds: Improve CPU buffer clear documentation
  x86/speculation/mds: Revert CPU buffer clear on double fault exit
  f2fs: link f2fs quota ops for sysfile
  fs: sdcardfs: Add missing option to show_options

Conflicts:
	drivers/scsi/sd.c
	drivers/scsi/ufs/ufshcd.c

Change-Id: If6679c7cc8c3fee323c749ac359353fbebfd12d9
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

5 files changed, 55 insertions, 15 deletions

diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index e2f659dc5745..81c5d07a2af1 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1685,13 +1685,19 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info,
 			extent_item_objectid);
 
 	if (!search_commit_root) {
-		trans = btrfs_join_transaction(fs_info->extent_root);
-		if (IS_ERR(trans))
-			return PTR_ERR(trans);
+		trans = btrfs_attach_transaction(fs_info->extent_root);
+		if (IS_ERR(trans)) {
+			if (PTR_ERR(trans) != -ENOENT &&
+			    PTR_ERR(trans) != -EROFS)
+				return PTR_ERR(trans);
+			trans = NULL;
+		}
+	}
+
+	if (trans)
 		btrfs_get_tree_mod_seq(fs_info, &tree_mod_seq_elem);
-	} else {
+	else
 		down_read(&fs_info->commit_root_sem);
-	}
 
 	ret = btrfs_find_all_leafs(trans, fs_info, extent_item_objectid,
 				   tree_mod_seq_elem.seq, &refs,
@@ -1721,7 +1727,7 @@ int iterate_extent_inodes(struct btrfs_fs_info *fs_info,
 
 	free_leaf_list(refs);
 out:
-	if (!search_commit_root) {
+	if (trans) {
 		btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem);
 		btrfs_end_transaction(trans, fs_info->extent_root);
 	} else {
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 978bbfed5a2c..df2bb4b61a00 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -10730,9 +10730,9 @@ int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
  * transaction.
  */
 static int btrfs_trim_free_extents(struct btrfs_device *device,
-				   u64 minlen, u64 *trimmed)
+				   struct fstrim_range *range, u64 *trimmed)
 {
-	u64 start = 0, len = 0;
+	u64 start = range->start, len = 0;
 	int ret;
 
 	*trimmed = 0;
@@ -10768,8 +10768,8 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
 			atomic_inc(&trans->use_count);
 		spin_unlock(&fs_info->trans_lock);
 
-		ret = find_free_dev_extent_start(trans, device, minlen, start,
-						 &start, &len);
+		ret = find_free_dev_extent_start(trans, device, range->minlen,
+						 start, &start, &len);
 		if (trans)
 			btrfs_put_transaction(trans);
 
@@ -10781,6 +10781,16 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
 			break;
 		}
 
+		/* If we are out of the passed range break */
+		if (start > range->start + range->len - 1) {
+			mutex_unlock(&fs_info->chunk_mutex);
+			ret = 0;
+			break;
+		}
+
+		start = max(range->start, start);
+		len = min(range->len, len);
+
 		ret = btrfs_issue_discard(device->bdev, start, len, &bytes);
 		up_read(&fs_info->commit_root_sem);
 		mutex_unlock(&fs_info->chunk_mutex);
@@ -10791,6 +10801,10 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
 		start += len;
 		*trimmed += bytes;
 
+		/* We've trimmed enough */
+		if (*trimmed >= range->len)
+			break;
+
 		if (fatal_signal_pending(current)) {
 			ret = -ERESTARTSYS;
 			break;
@@ -10857,8 +10871,7 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range)
 	mutex_lock(&root->fs_info->fs_devices->device_list_mutex);
 	devices = &root->fs_info->fs_devices->devices;
 	list_for_each_entry(device, devices, dev_list) {
-		ret = btrfs_trim_free_extents(device, range->minlen,
-					      &group_trimmed);
+		ret = btrfs_trim_free_extents(device, range, &group_trimmed);
 		if (ret)
 			break;
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 052973620595..d056060529f8 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1901,6 +1901,18 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
 	u64 len;
 
 	/*
+	 * If the inode needs a full sync, make sure we use a full range to
+	 * avoid log tree corruption, due to hole detection racing with ordered
+	 * extent completion for adjacent ranges, and assertion failures during
+	 * hole detection.
+	 */
+	if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+		     &BTRFS_I(inode)->runtime_flags)) {
+		start = 0;
+		end = LLONG_MAX;
+	}
+
+	/*
 	 * The range length can be represented by u64, we have to do the typecasts
 	 * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
 	 */
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index e0ac85949067..e6aaa15505c5 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -733,7 +733,12 @@ int btrfs_sysfs_add_fsid(struct btrfs_fs_devices *fs_devs,
 	fs_devs->fsid_kobj.kset = btrfs_kset;
 	error = kobject_init_and_add(&fs_devs->fsid_kobj,
 				&btrfs_ktype, parent, "%pU", fs_devs->fsid);
-	return error;
+	if (error) {
+		kobject_put(&fs_devs->fsid_kobj);
+		return error;
+	}
+
+	return 0;
 }
 
 int btrfs_sysfs_add_mounted(struct btrfs_fs_info *fs_info)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c7190f322576..57a46093656a 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2809,6 +2809,12 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 	log->log_transid = root->log_transid;
 	root->log_start_pid = 0;
 	/*
+	 * Update or create log root item under the root's log_mutex to prevent
+	 * races with concurrent log syncs that can lead to failure to update
+	 * log root item because it was not created yet.
+	 */
+	ret = update_log_root(trans, log);
+	/*
 	 * IO has been started, blocks of the log tree have WRITTEN flag set
 	 * in their headers. new modifications of the log will be written to
 	 * new positions. so it's safe to allow log writers to go in.
@@ -2827,8 +2833,6 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
 	mutex_unlock(&log_root_tree->log_mutex);
 
-	ret = update_log_root(trans, log);
-
 	mutex_lock(&log_root_tree->log_mutex);
 	if (atomic_dec_and_test(&log_root_tree->log_writers)) {
 		/*