Merge 4.4.248 into android-4.4-p

Changes in 4.4.248
	net/af_iucv: set correct sk_protocol for child sockets
	rose: Fix Null pointer dereference in rose_send_frame()
	usbnet: ipheth: fix connectivity with iOS 14
	bonding: wait for sysfs kobject destruction before freeing struct slave
	netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal
	net/x25: prevent a couple of overflows
	cxgb3: fix error return code in t3_sge_alloc_qset()
	net: pasemi: fix error return code in pasemi_mac_open()
	dt-bindings: net: correct interrupt flags in examples
	Input: xpad - support Ardwiino Controllers
	Input: i8042 - add ByteSpeed touchpad to noloop table
	powerpc: Stop exporting __clear_user which is now inlined.
	btrfs: sysfs: init devices outside of the chunk_mutex
	vlan: consolidate VLAN parsing code and limit max parsing depth
	usb: gadget: f_fs: Use local copy of descriptors for userspace copy
	USB: serial: kl5kusb105: fix memleak on open
	USB: serial: ch341: add new Product ID for CH341A
	USB: serial: ch341: sort device-id entries
	USB: serial: option: add Fibocom NL668 variants
	USB: serial: option: add support for Thales Cinterion EXS82
	tty: Fix ->pgrp locking in tiocspgrp()
	ALSA: hda/realtek - Add new codec supported for ALC897
	ALSA: hda/generic: Add option to enforce preferred_dacs pairs
	tty: Fix ->session locking
	cifs: fix potential use-after-free in cifs_echo_request()
	i2c: imx: Fix reset of I2SR_IAL flag
	i2c: imx: Check for I2SR_IAL after every byte
	arm64: assembler: make adr_l work in modules under KASLR
	iommu/amd: Set DTE[IntTabLen] to represent 512 IRTEs
	spi: Introduce device-managed SPI controller allocation
	spi: bcm2835: Fix use-after-free on unbind
	spi: bcm2835: Release the DMA channel if probe fails after dma_init
	tracing: Fix userstacktrace option for instances
	btrfs: cleanup cow block on error
	mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
	gfs2: check for empty rgrp tree in gfs2_ri_update
	Input: i8042 - fix error return code in i8042_setup_aux()
	x86/uprobes: Do not use prefixes.nbytes when looping over prefixes.bytes
	Linux 4.4.248

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibe14a8d4e51b79235bf3afec20d773a593625c53

5 files changed, 37 insertions, 7 deletions

diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index dd676ba758ee..40429b818b45 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -30,6 +30,8 @@
 #define VLAN_ETH_DATA_LEN	1500	/* Max. octets in payload	 */
 #define VLAN_ETH_FRAME_LEN	1518	/* Max. octets in frame sans FCS */
 
+#define VLAN_MAX_DEPTH	8		/* Max. number of nested VLAN tags parsed */
+
 /*
  * 	struct vlan_hdr - vlan header
  * 	@h_vlan_TCI: priority and VLAN ID
@@ -478,10 +480,10 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
  * Returns the EtherType of the packet, regardless of whether it is
  * vlan encapsulated (normal or hardware accelerated) or not.
  */
-static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,
 					 int *depth)
 {
-	unsigned int vlan_depth = skb->mac_len;
+	unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
 
 	/* if type is 802.1Q/AD then the header should already be
 	 * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
@@ -496,13 +498,12 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
 			vlan_depth = ETH_HLEN;
 		}
 		do {
-			struct vlan_hdr *vh;
+			struct vlan_hdr vhdr, *vh;
 
-			if (unlikely(!pskb_may_pull(skb,
-						    vlan_depth + VLAN_HLEN)))
+			vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr);
+			if (unlikely(!vh || !--parse_depth))
 				return 0;
 
-			vh = (struct vlan_hdr *)(skb->data + vlan_depth);
 			type = vh->h_vlan_encapsulated_proto;
 			vlan_depth += VLAN_HLEN;
 		} while (type == htons(ETH_P_8021Q) ||
@@ -522,11 +523,25 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
  * Returns the EtherType of the packet, regardless of whether it is
  * vlan encapsulated (normal or hardware accelerated) or not.
  */
-static inline __be16 vlan_get_protocol(struct sk_buff *skb)
+static inline __be16 vlan_get_protocol(const struct sk_buff *skb)
 {
 	return __vlan_get_protocol(skb, skb->protocol, NULL);
 }
 
+/* A getter for the SKB protocol field which will handle VLAN tags consistently
+ * whether VLAN acceleration is enabled or not.
+ */
+static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
+{
+	if (!skip_vlan)
+		/* VLAN acceleration strips the VLAN header from the skb and
+		 * moves it to skb->vlan_proto
+		 */
+		return skb_vlan_tag_present(skb) ? skb->vlan_proto : skb->protocol;
+
+	return vlan_get_protocol(skb);
+}
+
 static inline void vlan_set_encap_proto(struct sk_buff *skb,
 					struct vlan_hdr *vhdr)
 {
diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
index cce80e6dc7d1..f5d387140c46 100644
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -568,6 +568,8 @@ extern void spi_finalize_current_transfer(struct spi_master *master);
 /* the spi driver core manages memory for the spi_master classdev */
 extern struct spi_master *
 spi_alloc_master(struct device *host, unsigned size);
+extern struct spi_master *
+devm_spi_alloc_master(struct device *dev, unsigned int size);
 
 extern int spi_register_master(struct spi_master *master);
 extern int devm_spi_register_master(struct device *dev,
diff --git a/include/linux/tty.h b/include/linux/tty.h
index e5b15a83c8d7..5d4f5806da46 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -280,6 +280,10 @@ struct tty_struct {
 	struct termiox *termiox;	/* May be NULL for unsupported */
 	char name[64];
 	struct pid *pgrp;		/* Protected by ctrl lock */
+	/*
+	 * Writes protected by both ctrl lock and legacy mutex, readers must use
+	 * at least one of them.
+	 */
 	struct pid *session;
 	unsigned long flags;
 	int count;
diff --git a/include/net/bonding.h b/include/net/bonding.h
index 6fbfc21b27b1..1d85c5179fa8 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -181,6 +181,11 @@ struct slave {
 	struct rtnl_link_stats64 slave_stats;
 };
 
+static inline struct slave *to_slave(struct kobject *kobj)
+{
+	return container_of(kobj, struct slave, kobj);
+}
+
 struct bond_up_slave {
 	unsigned int	count;
 	struct rcu_head rcu;
@@ -667,6 +672,9 @@ extern struct bond_parm_tbl ad_select_tbl[];
 /* exported from bond_netlink.c */
 extern struct rtnl_link_ops bond_link_ops;
 
+/* exported from bond_sysfs_slave.c */
+extern const struct sysfs_ops slave_sysfs_ops;
+
 static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
 {
 	atomic_long_inc(&dev->tx_dropped);
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index dce2d586d9ce..245d999c0eac 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -3,6 +3,7 @@
 
 #include <linux/ip.h>
 #include <linux/skbuff.h>
+#include <linux/if_vlan.h>
 
 #include <net/inet_sock.h>
 #include <net/dsfield.h>