Merge 4.4.271 into android-4.4-p

Changes in 4.4.271
	mm, vmstat: drop zone->lock in /proc/pagetypeinfo
	netfilter: x_tables: Use correct memory barriers.
	NFC: nci: fix memory leak in nci_allocate_device
	proc: Check /proc/$pid/attr/ writes against file opener
	net: hso: fix control-request directions
	mac80211: assure all fragments are encrypted
	mac80211: prevent mixed key and fragment cache attacks
	mac80211: properly handle A-MSDUs that start with an RFC 1042 header
	cfg80211: mitigate A-MSDU aggregation attacks
	mac80211: drop A-MSDUs on old ciphers
	mac80211: add fragment cache to sta_info
	mac80211: check defrag PN against current frame
	mac80211: prevent attacks on TKIP/WEP as well
	mac80211: do not accept/forward invalid EAPOL frames
	mac80211: extend protection against mixed key and fragment cache attacks
	dm snapshot: properly fix a crash when an origin has no snapshots
	kgdb: fix gcc-11 warnings harder
	misc/uss720: fix memory leak in uss720_probe
	mei: request autosuspend after sending rx flow control
	staging: iio: cdc: ad7746: avoid overwrite of num_channels
	iio: adc: ad7793: Add missing error code in ad7793_setup()
	USB: trancevibrator: fix control-request direction
	serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
	USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
	USB: serial: ftdi_sio: add IDs for IDS GmbH Products
	USB: serial: pl2303: add device id for ADLINK ND-6530 GC
	net: usb: fix memory leak in smsc75xx_bind
	spi: Fix use-after-free with devm_spi_alloc_*
	spi: spi-sh: Fix use-after-free on unbind
	Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
	NFS: fix an incorrect limit in filelayout_decode_layout()
	NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
	NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
	net/mlx4: Fix EEPROM dump support
	Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
	tipc: skb_linearize the head skb when reassembling msgs
	i2c: s3c2410: fix possible NULL pointer deref on read message after write
	i2c: i801: Don't generate an interrupt on bus reset
	platform/x86: hp_accel: Avoid invoking _INI to speed up resume
	net: fujitsu: fix potential null-ptr-deref
	net: caif: remove BUG_ON(dev == NULL) in caif_xmit
	char: hpet: add checks after calling ioremap
	isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
	libertas: register sysfs groups properly
	media: dvb: Add check on sp8870_readreg return
	media: gspca: properly check for errors in po1030_probe()
	scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
	openrisc: Define memory barrier mb
	btrfs: do not BUG_ON in link_to_fixup_dir
	drm/amdgpu: Fix a use-after-free
	net: netcp: Fix an error message
	net: bnx2: Fix error return code in bnx2_init_board()
	mld: fix panic in mld_newpack()
	staging: emxx_udc: fix loop in _nbu2ss_nuke()
	scsi: libsas: Use _safe() loop in sas_resume_port()
	sch_dsmark: fix a NULL deref in qdisc_reset()
	MIPS: alchemy: xxs1500: add gpio-au1000.h header file
	MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c
	hugetlbfs: hugetlb_fault_mutex_hash() cleanup
	bluetooth: eliminate the potential race condition when removing the HCI controller
	usb: core: reduce power-on-good delay time of root hub
	x86, asm: change the GEN_*_RMWcc() macros to not quote the condition
	x86/asm: Add instruction suffixes to bitops
	x86/entry/64: Add instruction suffix
	Linux 4.4.271

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4d2a335d92f357364741f729648d8946007ba04c

2 files changed, 7 insertions, 4 deletions

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e933cae307bf..86a5c9852acf 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3771,7 +3771,7 @@ backout_unlocked:
 
 #ifdef CONFIG_SMP
 u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
-			    pgoff_t idx, unsigned long address)
+			    pgoff_t idx)
 {
 	unsigned long key[2];
 	u32 hash;
@@ -3779,7 +3779,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
 	key[0] = (unsigned long) mapping;
 	key[1] = idx;
 
-	hash = jhash2((u32 *)&key, sizeof(key)/sizeof(u32), 0);
+	hash = jhash2((u32 *)&key, sizeof(key)/(sizeof(u32)), 0);
 
 	return hash & (num_fault_mutexes - 1);
 }
@@ -3789,7 +3789,7 @@ u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
  * return 0 and avoid the hashing overhead.
  */
 u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
-			    pgoff_t idx, unsigned long address)
+			    pgoff_t idx)
 {
 	return 0;
 }
@@ -3834,7 +3834,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 	 * get spurious allocation failures if two CPUs race to instantiate
 	 * the same page in the page cache.
 	 */
-	hash = hugetlb_fault_mutex_hash(h, mapping, idx, address);
+	hash = hugetlb_fault_mutex_hash(h, mapping, idx);
 	mutex_lock(&hugetlb_fault_mutex_table[hash]);
 
 	entry = huge_ptep_get(ptep);
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 9d8936c7b40d..d491a9a0fed9 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -973,6 +973,9 @@ static void pagetypeinfo_showfree_print(struct seq_file *m,
 			list_for_each(curr, &area->free_list[mtype])
 				freecount++;
 			seq_printf(m, "%6lu ", freecount);
+			spin_unlock_irq(&zone->lock);
+			cond_resched();
+			spin_lock_irq(&zone->lock);
 		}
 		seq_putc(m, '\n');
 	}