Merge android-4.4-p.198 (dbd0162) into msm-4.4

* refs/heads/tmp-dbd0162
  Linux 4.4.198
  RDMA/cxgb4: Do not dma memory off of the stack
  net: sched: Fix memory exposure from short TCA_U32_SEL
  PCI: PM: Fix pci_power_up()
  xen/netback: fix error path of xenvif_connect_data()
  cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown
  memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
  btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group()
  CIFS: avoid using MID 0xFFFF
  parisc: Fix vmap memory leak in ioremap()/iounmap()
  xtensa: drop EXPORT_SYMBOL for outs*/ins*
  mm/slub: fix a deadlock in show_slab_objects()
  scsi: zfcp: fix reaction on bit error threshold notification
  drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50
  mac80211: Reject malformed SSID elements
  cfg80211: wext: avoid copying malformed SSIDs
  ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting
  scsi: core: try to get module before removing device
  USB: ldusb: fix read info leaks
  USB: usblp: fix use-after-free on disconnect
  USB: ldusb: fix memleak on disconnect
  USB: serial: ti_usb_3410_5052: fix port-close races
  usb: udc: lpc32xx: fix bad bit shift operation
  USB: legousbtower: fix memleak on disconnect
  memfd: Fix locking when tagging pins
  ipv4: Return -ENETUNREACH if we can't create route but saddr is valid
  net: avoid potential infinite loop in tc_ctl_action()
  sctp: change sctp_prot .no_autobind with true
  net: bcmgenet: Set phydev->dev_flags only for internal PHYs
  net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3
  loop: Add LOOP_SET_DIRECT_IO to compat ioctl
  namespace: fix namespace.pl script to support relative paths
  net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write()
  mips: Loongson: Fix the link time qualifier of 'serial_exit()'
  nl80211: fix null pointer dereference
  ARM: dts: am4372: Set memory bandwidth limit for DISPC
  ARM: OMAP2+: Fix missing reset done flag for am3 and am43
  scsi: qla2xxx: Fix unbound sleep in fcport delete path.
  scsi: megaraid: disable device when probe failed after enabled device
  scsi: ufs: skip shutdown if hba is not powered
  rtlwifi: Fix potential overflow on P2P code
  ANDROID: clang: update to 9.0.8 based on r365631c
  ANDROID: move up spin_unlock_bh() ahead of remove_proc_entry()
  ANDROID: refactor build.config files to remove duplication

Conflicts:
	drivers/block/loop.c

Change-Id: I68d2106c6480b9a2573f31302b0c75922f427732
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

2 files changed, 22 insertions, 11 deletions

diff --git a/mm/shmem.c b/mm/shmem.c
index f64a55543f3f..75e1d682370c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1854,11 +1854,12 @@ static void shmem_tag_pins(struct address_space *mapping)
 	void **slot;
 	pgoff_t start;
 	struct page *page;
+	unsigned int tagged = 0;
 
 	lru_add_drain();
 	start = 0;
-	rcu_read_lock();
 
+	spin_lock_irq(&mapping->tree_lock);
 restart:
 	radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) {
 		page = radix_tree_deref_slot(slot);
@@ -1866,19 +1867,20 @@ restart:
 			if (radix_tree_deref_retry(page))
 				goto restart;
 		} else if (page_count(page) - page_mapcount(page) > 1) {
-			spin_lock_irq(&mapping->tree_lock);
 			radix_tree_tag_set(&mapping->page_tree, iter.index,
 					   SHMEM_TAG_PINNED);
-			spin_unlock_irq(&mapping->tree_lock);
 		}
 
-		if (need_resched()) {
-			cond_resched_rcu();
-			start = iter.index + 1;
-			goto restart;
-		}
+		if (++tagged % 1024)
+			continue;
+
+		spin_unlock_irq(&mapping->tree_lock);
+		cond_resched();
+		start = iter.index + 1;
+		spin_lock_irq(&mapping->tree_lock);
+		goto restart;
 	}
-	rcu_read_unlock();
+	spin_unlock_irq(&mapping->tree_lock);
 }
 
 /*
diff --git a/mm/slub.c b/mm/slub.c
index 716b794f3679..7c821c5a30b6 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4655,7 +4655,17 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
 		}
 	}
 
-	get_online_mems();
+	/*
+	 * It is impossible to take "mem_hotplug_lock" here with "kernfs_mutex"
+	 * already held which will conflict with an existing lock order:
+	 *
+	 * mem_hotplug_lock->slab_mutex->kernfs_mutex
+	 *
+	 * We don't really need mem_hotplug_lock (to hold off
+	 * slab_mem_going_offline_callback) here because slab's memory hot
+	 * unplug code doesn't destroy the kmem_cache->node[] data.
+	 */
+
 #ifdef CONFIG_SLUB_DEBUG
 	if (flags & SO_ALL) {
 		struct kmem_cache_node *n;
@@ -4696,7 +4706,6 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
 			x += sprintf(buf + x, " N%d=%lu",
 					node, nodes[node]);
 #endif
-	put_online_mems();
 	kfree(nodes);
 	return x + sprintf(buf + x, "\n");
 }