Merge 4.4.217 into android-4.4-p

Changes in 4.4.217
	NFS: Remove superfluous kmap in nfs_readdir_xdr_to_array
	r8152: check disconnect status after long sleep
	net: nfc: fix bounds checking bugs on "pipe"
	bnxt_en: reinitialize IRQs when MTU is modified
	fib: add missing attribute validation for tun_id
	nl802154: add missing attribute validation
	nl802154: add missing attribute validation for dev_type
	team: add missing attribute validation for port ifindex
	team: add missing attribute validation for array index
	nfc: add missing attribute validation for SE API
	nfc: add missing attribute validation for vendor subcommand
	ipvlan: add cond_resched_rcu() while processing muticast backlog
	ipvlan: do not add hardware address of master to its unicast filter list
	ipvlan: egress mcast packets are not exceptional
	ipvlan: do not use cond_resched_rcu() in ipvlan_process_multicast()
	ipvlan: don't deref eth hdr before checking it's set
	macvlan: add cond_resched() during multicast processing
	net: fec: validate the new settings in fec_enet_set_coalesce()
	slip: make slhc_compress() more robust against malicious packets
	bonding/alb: make sure arp header is pulled before accessing it
	net: fq: add missing attribute validation for orphan mask
	iommu/vt-d: quirk_ioat_snb_local_iommu: replace WARN_TAINT with pr_warn + add_taint
	drm/amd/display: remove duplicated assignment to grph_obj_type
	gfs2_atomic_open(): fix O_EXCL|O_CREAT handling on cold dcache
	KVM: x86: clear stale x86_emulate_ctxt->intercept value
	ARC: define __ALIGN_STR and __ALIGN symbols for ARC
	efi: Fix a race and a buffer overflow while reading efivars via sysfs
	iommu/vt-d: dmar: replace WARN_TAINT with pr_warn + add_taint
	iommu/vt-d: Fix a bug in intel_iommu_iova_to_phys() for huge page
	nl80211: add missing attribute validation for critical protocol indication
	nl80211: add missing attribute validation for channel switch
	netfilter: cthelper: add missing attribute validation for cthelper
	iommu/vt-d: Fix the wrong printing in RHSA parsing
	iommu/vt-d: Ignore devices with out-of-spec domain number
	mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()
	ipv6: restrict IPV6_ADDRFORM operation
	efi: Add a sanity check to efivar_store_raw()
	batman-adv: Fix invalid read while copying bat_iv.bcast_own
	batman-adv: Only put gw_node list reference when removed
	batman-adv: Only put orig_node_vlan list reference when removed
	batman-adv: Avoid endless loop in bat-on-bat netdevice check
	batman-adv: Fix unexpected free of bcast_own on add_if error
	batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
	batman-adv: init neigh node last seen field
	batman-adv: Deactivate TO_BE_ACTIVATED hardif on shutdown
	batman-adv: Drop reference to netdevice on last reference
	batman-adv: Fix reference counting of vlan object for tt_local_entry
	batman-adv: Avoid duplicate neigh_node additions
	batman-adv: fix skb deref after free
	batman-adv: Fix use-after-free/double-free of tt_req_node
	batman-adv: Fix ICMP RR ethernet access after skb_linearize
	batman-adv: Clean up untagged vlan when destroying via rtnl-link
	batman-adv: Avoid nullptr dereference in bla after vlan_insert_tag
	batman-adv: Avoid nullptr dereference in dat after vlan_insert_tag
	batman-adv: Fix orig_node_vlan leak on orig_node_release
	batman-adv: lock crc access in bridge loop avoidance
	batman-adv: Fix non-atomic bla_claim::backbone_gw access
	batman-adv: Fix reference leak in batadv_find_router
	batman-adv: Free last_bonding_candidate on release of orig_node
	batman-adv: Fix speedy join in gateway client mode
	batman-adv: Add missing refcnt for last_candidate
	batman-adv: Fix double free during fragment merge error
	batman-adv: Fix transmission of final, 16th fragment
	batman-adv: Fix rx packet/bytes stats on local ARP reply
	batman-adv: fix TT sync flag inconsistencies
	batman-adv: Fix lock for ogm cnt access in batadv_iv_ogm_calc_tq
	batman-adv: Fix internal interface indices types
	batman-adv: update data pointers after skb_cow()
	batman-adv: Fix skbuff rcsum on packet reroute
	batman-adv: Avoid race in TT TVLV allocator helper
	batman-adv: Fix TT sync flags for intermediate TT responses
	batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs
	batman-adv: Fix debugfs path for renamed hardif
	batman-adv: Fix debugfs path for renamed softif
	batman-adv: Avoid storing non-TT-sync flags on singular entries too
	batman-adv: Prevent duplicated gateway_node entry
	batman-adv: Prevent duplicated nc_node entry
	batman-adv: Prevent duplicated global TT entry
	batman-adv: Prevent duplicated tvlv handler
	batman-adv: Reduce claim hash refcnt only for removed entry
	batman-adv: Reduce tt_local hash refcnt only for removed entry
	batman-adv: Reduce tt_global hash refcnt only for removed entry
	batman-adv: Only read OGM tvlv_len after buffer len check
	batman-adv: Avoid free/alloc race when handling OGM buffer
	batman-adv: Don't schedule OGM for disabled interface
	perf/amd/uncore: Replace manual sampling check with CAP_NO_INTERRUPT flag
	net: ks8851-ml: Fix IRQ handling and locking
	signal: avoid double atomic counter increments for user accounting
	jbd2: fix data races at struct journal_head
	ARM: 8957/1: VDSO: Match ARMv8 timer in cntvct_functional()
	ARM: 8958/1: rename missed uaccess .fixup section
	mm: slub: add missing TID bump in kmem_cache_alloc_bulk()
	ipv4: ensure rcu_read_lock() in cipso_v4_error()
	Linux 4.4.217

Change-Id: Ic8c9ec91c66a9a0bb0b6291ad0a5101d18889a67
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 9 insertions, 0 deletions

diff --git a/mm/slub.c b/mm/slub.c
index 04f8561c19e0..42cb9b3891bd 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3001,6 +3001,15 @@ int kmem_cache_alloc_bulk(struct kmem_cache *s, gfp_t flags, size_t size,
 
 		if (unlikely(!object)) {
 			/*
+			 * We may have removed an object from c->freelist using
+			 * the fastpath in the previous iteration; in that case,
+			 * c->tid has not been bumped yet.
+			 * Since ___slab_alloc() may reenable interrupts while
+			 * allocating memory, we should bump c->tid now.
+			 */
+			c->tid = next_tid(c->tid);
+
+			/*
 			 * Invoking slow path likely have side-effect
 			 * of re-populating per CPU c->freelist
 			 */