Merge 4.4.216 into android-4.4-p

Changes in 4.4.216
	iwlwifi: pcie: fix rb_allocator workqueue allocation
	ext4: fix potential race between online resizing and write operations
	ext4: fix potential race between s_flex_groups online resizing and access
	ext4: fix potential race between s_group_info online resizing and access
	ipmi:ssif: Handle a possible NULL pointer reference
	mac80211: consider more elements in parsing CRC
	cfg80211: check wiphy driver existence for drvinfo report
	cifs: Fix mode output in debugging statements
	cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
	sysrq: Restore original console_loglevel when sysrq disabled
	sysrq: Remove duplicated sysrq message
	net: fib_rules: Correctly set table field when table number exceeds 8 bits
	net: phy: restore mdio regs in the iproc mdio driver
	ipv6: Fix nlmsg_flags when splitting a multipath route
	ipv6: Fix route replacement with dev-only route
	sctp: move the format error check out of __sctp_sf_do_9_1_abort
	nfc: pn544: Fix occasional HW initialization failure
	net: sched: correct flower port blocking
	ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
	audit: fix error handling in audit_data_to_entry()
	HID: core: fix off-by-one memset in hid_report_raw_event()
	HID: core: increase HID report buffer size to 8KiB
	HID: hiddev: Fix race in in hiddev_disconnect()
	MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
	i2c: jz4780: silence log flood on txabrt
	ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
	include/linux/bitops.h: introduce BITS_PER_TYPE
	net: netlink: cap max groups which will be considered in netlink_bind()
	namei: only return -ECHILD from follow_dotdot_rcu()
	KVM: Check for a bad hva before dropping into the ghc slow path
	slip: stop double free sl->dev in slip_open
	mm: make page ref count overflow check tighter and more explicit
	mm: add 'try_get_page()' helper function
	mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages
	mm, gup: ensure real head page is ref-counted when using hugepages
	mm: prevent get_user_pages() from overflowing page refcount
	pipe: add pipe_buf_get() helper
	fs: prevent page refcount overflow in pipe_buf_get
	audit: always check the netlink payload length in audit_receive_msg()
	serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
	usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
	usb: gadget: serial: fix Tx stall after buffer overflow
	drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
	drm/msm/dsi: save pll state before dsi host is powered off
	net: ks8851-ml: Remove 8-bit bus accessors
	net: ks8851-ml: Fix 16-bit data access
	net: ks8851-ml: Fix 16-bit IO operation
	watchdog: da9062: do not ping the hw during stop()
	s390/cio: cio_ignore_proc_seq_next should increase position index
	cifs: don't leak -EAGAIN for stat() during reconnect
	usb: storage: Add quirk for Samsung Fit flash
	usb: quirks: add NO_LPM quirk for Logitech Screen Share
	usb: core: hub: do error out if usb_autopm_get_interface() fails
	usb: core: port: do error out if usb_autopm_get_interface() fails
	vgacon: Fix a UAF in vgacon_invert_region
	fat: fix uninit-memory access for partial initialized inode
	vt: selection, close sel_buffer race
	vt: selection, push console lock down
	vt: selection, push sel_lock up
	dmaengine: tegra-apb: Fix use-after-free
	dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
	ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
	ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
	ASoC: dapm: Correct DAPM handling of active widgets during shutdown
	RDMA/iwcm: Fix iwcm work deallocation
	RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
	ARM: imx: build v7_cpu_resume() unconditionally
	hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
	dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
	powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
	dm cache: fix a crash due to incorrect work item cancelling
	crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async
	Linux 4.4.216

Change-Id: I9b747fb2a39b1137ee4ec9c5bb2c1aac2419e97b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 24 insertions, 6 deletions

diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index 683eb0ae1e93..1157a3587d71 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1306,7 +1306,7 @@ struct ext4_sb_info {
 	loff_t s_bitmap_maxbytes;	/* max bytes for bitmap files */
 	struct buffer_head * s_sbh;	/* Buffer containing the super block */
 	struct ext4_super_block *s_es;	/* Pointer to the super block in the buffer */
-	struct buffer_head **s_group_desc;
+	struct buffer_head * __rcu *s_group_desc;
 	unsigned int s_mount_opt;
 	unsigned int s_mount_opt2;
 	unsigned int s_mount_flags;
@@ -1366,7 +1366,7 @@ struct ext4_sb_info {
 #endif
 
 	/* for buddy allocator */
-	struct ext4_group_info ***s_group_info;
+	struct ext4_group_info ** __rcu *s_group_info;
 	struct inode *s_buddy_cache;
 	spinlock_t s_md_lock;
 	unsigned short *s_mb_offsets;
@@ -1413,7 +1413,7 @@ struct ext4_sb_info {
 	unsigned int s_extent_max_zeroout_kb;
 
 	unsigned int s_log_groups_per_flex;
-	struct flex_groups *s_flex_groups;
+	struct flex_groups * __rcu *s_flex_groups;
 	ext4_group_t s_flex_groups_allocated;
 
 	/* workqueue for reserved extent conversions (buffered io) */
@@ -1495,6 +1495,23 @@ static inline void ext4_inode_aio_set(struct inode *inode, ext4_io_end_t *io)
 }
 
 /*
+ * Returns: sbi->field[index]
+ * Used to access an array element from the following sbi fields which require
+ * rcu protection to avoid dereferencing an invalid pointer due to reassignment
+ * - s_group_desc
+ * - s_group_info
+ * - s_flex_group
+ */
+#define sbi_array_rcu_deref(sbi, field, index)				   \
+({									   \
+	typeof(*((sbi)->field)) _v;					   \
+	rcu_read_lock();						   \
+	_v = ((typeof(_v)*)rcu_dereference((sbi)->field))[index];	   \
+	rcu_read_unlock();						   \
+	_v;								   \
+})
+
+/*
  * Inode dynamic state flags
  */
 enum {
@@ -2558,6 +2575,7 @@ extern int ext4_generic_delete_entry(handle_t *handle,
 extern int ext4_empty_dir(struct inode *inode);
 
 /* resize.c */
+extern void ext4_kvfree_array_rcu(void *to_free);
 extern int ext4_group_add(struct super_block *sb,
 				struct ext4_new_group_data *input);
 extern int ext4_group_extend(struct super_block *sb,
@@ -2798,13 +2816,13 @@ static inline
 struct ext4_group_info *ext4_get_group_info(struct super_block *sb,
 					    ext4_group_t group)
 {
-	 struct ext4_group_info ***grp_info;
+	 struct ext4_group_info **grp_info;
 	 long indexv, indexh;
 	 BUG_ON(group >= EXT4_SB(sb)->s_groups_count);
-	 grp_info = EXT4_SB(sb)->s_group_info;
 	 indexv = group >> (EXT4_DESC_PER_BLOCK_BITS(sb));
 	 indexh = group & ((EXT4_DESC_PER_BLOCK(sb)) - 1);
-	 return grp_info[indexv][indexh];
+	 grp_info = sbi_array_rcu_deref(EXT4_SB(sb), s_group_info, indexv);
+	 return grp_info[indexh];
 }
 
 /*