Merge android-4.4.190 (ac7fbca) into msm-4.4

* refs/heads/tmp-ac7fbca
  Linux 4.4.190
  bonding: Add vlan tx offload to hw_enc_features
  sctp: fix the transport error_count check
  net/mlx5e: Only support tx/rx pause setting for port owner
  xen/netback: Reset nr_frags before freeing skb
  net/packet: fix race in tpacket_snd()
  x86/boot: Disable the address-of-packed-member compiler warning
  iommu/amd: Move iommu_init_pci() to .init section
  x86/vdso: Remove direct HPET access through the vDSO
  IB/mlx5: Make coding style more consistent
  RDMA: Directly cast the sockaddr union to sockaddr
  scsi: fcoe: Embed fc_rport_priv in fcoe_rport structure
  asm-generic: default BUG_ON(x) to if(x)BUG()
  Input: psmouse - fix build error of multiple definition
  arm64: compat: Allow single-byte watchpoints on all addresses
  include/linux/module.h: copy __init/__exit attrs to init/cleanup_module
  Backport minimal compiler_attributes.h to support GCC 9
  USB: serial: option: Add Motorola modem UARTs
  USB: serial: option: add the BroadMobi BM818 card
  USB: serial: option: Add support for ZTE MF871A
  USB: serial: option: add D-Link DWM-222 device ID
  usb: cdc-acm: make sure a refcount is taken early enough
  USB: core: Fix races in character device registration and deregistraion
  staging: comedi: dt3000: Fix rounding up of timer divisor
  staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
  asm-generic: fix -Wtype-limits compiler warnings
  ocfs2: remove set but not used variable 'last_hash'
  IB/core: Add mitigation for Spectre V1
  kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules
  ata: libahci: do not complain in case of deferred probe
  scsi: hpsa: correct scsi command status issue after reset
  libata: zpodd: Fix small read overflow in zpodd_get_mech_type()
  perf header: Fix use of unitialized value warning
  perf header: Fix divide by zero error if f_header.attr_size==0
  irqchip/irq-imx-gpcv2: Forward irq type to parent
  xen/pciback: remove set but not used variable 'old_state'
  net: usb: pegasus: fix improper read if get_registers() fail
  Input: iforce - add sanity checks
  Input: kbtab - sanity check for endpoint type
  HID: hiddev: do cleanup in failure of opening a device
  HID: hiddev: avoid opening a disconnected device
  HID: holtek: test for sanity of intfdata
  ALSA: hda - Fix a memory leak bug
  mm/memcontrol.c: fix use after free in mem_cgroup_iter()
  USB: gadget: f_midi: fixing a possible double-free in f_midi
  usb: gadget: f_midi: fail if set_alt fails to allocate requests
  sh: kernel: hw_breakpoint: Fix missing break in switch statement
  scsi: mpt3sas: Use 63-bit DMA addressing on SAS35 HBA
  mwifiex: fix 802.11n/WPA detection
  smb3: send CAP_DFS capability during session setup
  SMB3: Fix deadlock in validate negotiate hits reconnect
  mac80211: don't WARN on short WMM parameters from AP
  ALSA: firewire: fix a memory leak bug
  hwmon: (nct7802) Fix wrong detection of in4 presence
  can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices
  can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices
  perf/core: Fix creating kernel counters for PMUs that override event->cpu
  tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
  scsi: ibmvfc: fix WARN_ON during event pool release
  scsi: megaraid_sas: fix panic on loading firmware crashdump
  ARM: davinci: fix sleep.S build error on ARMv4
  perf probe: Avoid calling freeing routine multiple times for same pointer
  ALSA: compress: Be more restrictive about when a drain is allowed
  ALSA: compress: Prevent bypasses of set_params
  ALSA: compress: Fix regression on compressed capture streams
  s390/qdio: add sanity checks to the fast-requeue path
  cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init()
  hwmon: (nct6775) Fix register address and added missed tolerance for nct6106
  mac80211: don't warn about CW params when not using them
  iscsi_ibft: make ISCSI_IBFT dependson ACPI instead of ISCSI_IBFT_FIND
  netfilter: nfnetlink: avoid deadlock due to synchronous request_module
  can: peak_usb: fix potential double kfree_skb()
  usb: yurex: Fix use-after-free in yurex_delete
  perf db-export: Fix thread__exec_comm()
  mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
  x86/mm: Sync also unmappings in vmalloc_sync_all()
  x86/mm: Check for pfn instead of page in vmalloc_sync_one()
  sound: fix a memory leak bug
  usb: iowarrior: fix deadlock on disconnect
  ANDROID: fix binder change in merge of 4.4.183

Conflicts:
	sound/core/compress_offload.c

Change-Id: I30e498c36dc295fbfa0e1d455e31f192fd99479e
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

2 files changed, 39 insertions, 11 deletions

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 9a8e688724b1..a84eb0f8c5db 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -988,28 +988,47 @@ void mem_cgroup_iter_break(struct mem_cgroup *root,
 		css_put(&prev->css);
 }
 
-static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+static void __invalidate_reclaim_iterators(struct mem_cgroup *from,
+					struct mem_cgroup *dead_memcg)
 {
-	struct mem_cgroup *memcg = dead_memcg;
 	struct mem_cgroup_reclaim_iter *iter;
 	struct mem_cgroup_per_zone *mz;
 	int nid, zid;
 	int i;
 
-	for (; memcg; memcg = parent_mem_cgroup(memcg)) {
-		for_each_node(nid) {
-			for (zid = 0; zid < MAX_NR_ZONES; zid++) {
-				mz = &memcg->nodeinfo[nid]->zoneinfo[zid];
-				for (i = 0; i <= DEF_PRIORITY; i++) {
-					iter = &mz->iter[i];
-					cmpxchg(&iter->position,
-						dead_memcg, NULL);
-				}
+	for_each_node(nid) {
+		for (zid = 0; zid < MAX_NR_ZONES; zid++) {
+			mz = &from->nodeinfo[nid]->zoneinfo[zid];
+			for (i = 0; i <= DEF_PRIORITY; i++) {
+				iter = &mz->iter[i];
+				cmpxchg(&iter->position,
+					dead_memcg, NULL);
 			}
 		}
 	}
 }
 
+static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg)
+{
+	struct mem_cgroup *memcg = dead_memcg;
+	struct mem_cgroup *last;
+
+	do {
+		__invalidate_reclaim_iterators(memcg, dead_memcg);
+		last = memcg;
+	} while ((memcg = parent_mem_cgroup(memcg)));
+
+	/*
+	 * When cgruop1 non-hierarchy mode is used,
+	 * parent_mem_cgroup() does not walk all the way up to the
+	 * cgroup root (root_mem_cgroup). So we have to handle
+	 * dead_memcg from cgroup root separately.
+	 */
+	if (last != root_mem_cgroup)
+		__invalidate_reclaim_iterators(root_mem_cgroup,
+						dead_memcg);
+}
+
 /*
  * Iteration constructs for visiting all cgroups (under a tree).  If
  * loops are exited prematurely (break), mem_cgroup_iter_break() must
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 20fcc89746e0..87b8c253238a 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1784,6 +1784,12 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
 		return NULL;
 
 	/*
+	 * First make sure the mappings are removed from all page-tables
+	 * before they are freed.
+	 */
+	vmalloc_sync_all();
+
+	/*
 	 * In this function, newly allocated vm_struct has VM_UNINITIALIZED
 	 * flag. It means that vm_struct is not fully initialized.
 	 * Now, it is fully initialized, so remove this flag here.
@@ -2320,6 +2326,9 @@ EXPORT_SYMBOL(remap_vmalloc_range);
 /*
  * Implement a stub for vmalloc_sync_all() if the architecture chose not to
  * have one.
+ *
+ * The purpose of this function is to make sure the vmalloc area
+ * mappings are identical in all page-tables in the system.
  */
 void __weak vmalloc_sync_all(void)
 {