Merge android-4.4-p.204 (583bdda) into msm-4.4

* refs/heads/tmp-583bdda
  Linux 4.4.204
  KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel
  powerpc/book3s64: Fix link stack flush on context switch
  powerpc/64s: support nospectre_v2 cmdline option
  staging: comedi: usbduxfast: usbduxfast_ai_cmdtest rounding error
  USB: serial: option: add support for Foxconn T77W968 LTE modules
  USB: serial: option: add support for DW5821e with eSIM support
  USB: serial: mos7840: fix remote wakeup
  USB: serial: mos7720: fix remote wakeup
  USB: serial: mos7840: add USB ID to support Moxa UPort 2210
  appledisplay: fix error handling in the scheduled work
  usb-serial: cp201x: support Mark-10 digital force gauge
  virtio_console: move removal code
  virtio_console: drop custom control queue cleanup
  virtio_console: fix uninitialized variable use
  virtio_console: allocate inbufs in add_port() only if it is needed
  virtio_console: don't tie bufs to a vq
  virtio_console: reset on out of memory
  media: imon: invalid dereference in imon_touch_event
  media: cxusb: detect cxusb_ctrl_msg error in query
  media: b2c2-flexcop-usb: add sanity checking
  cpufreq: Add NULL checks to show() and store() methods of cpufreq
  media: vivid: Fix wrong locking that causes race conditions on streaming stop
  media: vivid: Set vid_cap_streaming and vid_out_streaming to true
  x86/speculation: Fix redundant MDS mitigation message
  x86/speculation: Fix incorrect MDS/TAA mitigation status
  x86/insn: Fix awk regexp warnings
  ARC: perf: Accommodate big-endian CPU
  mmc: block: Fix tag condition with packed writes
  ocfs2: remove ocfs2_is_o2cb_active()
  cpufreq: Skip cpufreq resume if it's not suspended
  arm64: fix for bad_mode() handler to always result in panic
  dm: use blk_set_queue_dying() in __dm_destroy()
  ath9k_hw: fix uninitialized variable data
  Bluetooth: Fix invalid-free in bcsp_close()
  IB/hfi1: Ensure full Gen3 speed in a Gen4 system
  spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch
  PCI: keystone: Use quirk to limit MRRS for K2G
  pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD
  pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues
  sock: Reset dst when changing sk_mark via setsockopt
  net: bcmgenet: return correct value 'ret' from bcmgenet_power_down
  dlm: don't leak kernel pointer to userspace
  dlm: fix invalid free
  scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces
  scsi: megaraid_sas: Fix msleep granularity
  scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing page11
  scsi: mpt3sas: Fix Sync cache command failure during driver unload
  rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information
  wireless: airo: potential buffer overflow in sprintf()
  brcmsmac: never log "tid x is not agg'able" by default
  rtl8xxxu: Fix missing break in switch
  wlcore: Fix the return value in case of error in 'wlcore_vendor_cmd_smart_config_start()'
  audit: print empty EXECVE args
  sched/fair: Don't increase sd->balance_interval on newidle balance
  net: do not abort bulk send on BQL status
  ocfs2: fix clusters leak in ocfs2_defrag_extent()
  ocfs2: don't put and assigning null to bh allocated outside
  ntb: intel: fix return value for ndev_vec_mask()
  ntb_netdev: fix sleep time mismatch
  igb: shorten maximum PHC timecounter update interval
  fs/hfs/extent.c: fix array out of bounds read of array extent
  hfs: fix return value of hfs_get_block()
  hfsplus: fix return value of hfsplus_get_block()
  hfs: prevent btree data loss on ENOSPC
  hfsplus: prevent btree data loss on ENOSPC
  hfs: fix BUG on bnode parent update
  hfsplus: fix BUG on bnode parent update
  linux/bitmap.h: fix type of nbits in bitmap_shift_right()
  linux/bitmap.h: handle constant zero-size bitmaps correctly
  um: Make line/tty semantics use true write IRQ
  mm/page-writeback.c: fix range_cyclic writeback vs writepages deadlock
  fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in dlm_print_one_mle()
  sparc64: Rework xchg() definition to avoid warnings.
  thermal: rcar_thermal: Prevent hardware access during system suspend
  selftests/ftrace: Fix to test kprobe $comm arg only if available
  mfd: max8997: Enale irq-wakeup unconditionally
  mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values
  qlcnic: fix a return in qlcnic_dcb_get_capability()
  mISDN: Fix type of switch control variable in ctrl_teimanager
  rtc: s35390a: Change buf's type to u8 in s35390a_init
  ceph: fix dentry leak in ceph_readdir_prepopulate
  sparc: Fix parport build warnings.
  spi: omap2-mcspi: Set FIFO DMA trigger level to word length
  s390/perf: Return error when debug_register fails
  atm: zatm: Fix empty body Clang warnings
  SUNRPC: Fix a compile warning for cmpxchg64()
  USB: misc: appledisplay: fix backlight update_status return code
  macintosh/windfarm_smu_sat: Fix debug output
  ALSA: i2c/cs8427: Fix int to char conversion
  kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on bad stack
  net: fix warning in af_unix
  scsi: dc395x: fix DMA API usage in sg_update_list
  scsi: dc395x: fix dma API usage in srb_done
  clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk
  scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param
  scsi: isci: Change sci_controller_start_task's return type to sci_status
  scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler
  KVM/x86: Fix invvpid and invept register operand size in 64-bit mode
  scsi: ips: fix missing break in switch
  amiflop: clean up on errors during setup
  misc: mic: fix a DMA pool free failure
  gsmi: Fix bug in append_to_eventlog sysfs handler
  btrfs: handle error of get_old_root
  mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready fail
  spi: sh-msiof: fix deferred probing
  brcmsmac: AP mode: update beacon when TIM changes
  powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field
  powerpc: Fix signedness bug in update_flash_db()
  synclink_gt(): fix compat_ioctl()
  gfs2: Fix marking bitmaps non-full
  printk: fix integer overflow in setup_log_buf()
  ALSA: isight: fix leak of reference to firewire unit in error path of .probe callback
  mwifiex: Fix NL80211_TX_POWER_LIMITED
  platform/x86: asus-wmi: add SERIO_I8042 dependency
  platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
  platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ
  platform/x86: asus-wmi: try to set als by default
  asus-wmi: provide access to ALS control
  platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB
  platform/x86: asus-wmi: fix asus ux303ub brightness issue
  platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A
  asus-wmi: Add quirk_no_rfkill for the Asus Z550MA
  asus-wmi: Add quirk_no_rfkill for the Asus U303LB
  asus-wmi: Add quirk_no_rfkill for the Asus N552VW
  asus-wmi: Add quirk_no_rfkill_wapf4 for the Asus X456UF
  asus-wmi: Create quirk for airplane_mode LED
  mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
  Revert "fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry()"
  net: rtnetlink: prevent underflows in do_setvfinfo()
  net/sched: act_pedit: fix WARN() in the traffic path
  sfc: Only cancel the PPS workqueue if it exists
  net/mlx4_en: fix mlx4 ethtool -N insertion

Conflicts:
	arch/arm64/kernel/traps.c

Change-Id: Ie8f88d491b2d80c031e81346687624d7b5a770f1
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

2 files changed, 22 insertions, 25 deletions

diff --git a/mm/ksm.c b/mm/ksm.c
index 5766229a3507..3cd071cdfbb3 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -732,13 +732,13 @@ static int remove_stable_node(struct stable_node *stable_node)
 		return 0;
 	}
 
-	if (WARN_ON_ONCE(page_mapped(page))) {
-		/*
-		 * This should not happen: but if it does, just refuse to let
-		 * merge_across_nodes be switched - there is no need to panic.
-		 */
-		err = -EBUSY;
-	} else {
+	/*
+	 * Page could be still mapped if this races with __mmput() running in
+	 * between ksm_exit() and exit_mmap(). Just refuse to let
+	 * merge_across_nodes/max_page_sharing be switched.
+	 */
+	err = -EBUSY;
+	if (!page_mapped(page)) {
 		/*
 		 * The stable node did not yet appear stale to get_ksm_page(),
 		 * since that allows for an unmapped ksm page to be recognized
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 4087e77cd033..d4492df0ea81 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -2160,6 +2160,13 @@ EXPORT_SYMBOL(tag_pages_for_writeback);
  * not miss some pages (e.g., because some other process has cleared TOWRITE
  * tag we set). The rule we follow is that TOWRITE tag can be cleared only
  * by the process clearing the DIRTY tag (and submitting the page for IO).
+ *
+ * To avoid deadlocks between range_cyclic writeback and callers that hold
+ * pages in PageWriteback to aggregate IO until write_cache_pages() returns,
+ * we do not loop back to the start of the file. Doing so causes a page
+ * lock/page writeback access order inversion - we should only ever lock
+ * multiple pages in ascending page->index order, and looping back to the start
+ * of the file violates that rule and causes deadlocks.
  */
 int write_cache_pages(struct address_space *mapping,
 		      struct writeback_control *wbc, writepage_t writepage,
@@ -2174,7 +2181,6 @@ int write_cache_pages(struct address_space *mapping,
 	pgoff_t index;
 	pgoff_t end;		/* Inclusive */
 	pgoff_t done_index;
-	int cycled;
 	int range_whole = 0;
 	int tag;
 
@@ -2182,23 +2188,17 @@ int write_cache_pages(struct address_space *mapping,
 	if (wbc->range_cyclic) {
 		writeback_index = mapping->writeback_index; /* prev offset */
 		index = writeback_index;
-		if (index == 0)
-			cycled = 1;
-		else
-			cycled = 0;
 		end = -1;
 	} else {
 		index = wbc->range_start >> PAGE_CACHE_SHIFT;
 		end = wbc->range_end >> PAGE_CACHE_SHIFT;
 		if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
 			range_whole = 1;
-		cycled = 1; /* ignore range_cyclic tests */
 	}
 	if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
 		tag = PAGECACHE_TAG_TOWRITE;
 	else
 		tag = PAGECACHE_TAG_DIRTY;
-retry:
 	if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
 		tag_pages_for_writeback(mapping, index, end);
 	done_index = index;
@@ -2290,17 +2290,14 @@ continue_unlock:
 		pagevec_release(&pvec);
 		cond_resched();
 	}
-	if (!cycled && !done) {
-		/*
-		 * range_cyclic:
-		 * We hit the last page and there is more work to be done: wrap
-		 * back to the start of the file
-		 */
-		cycled = 1;
-		index = 0;
-		end = writeback_index - 1;
-		goto retry;
-	}
+
+	/*
+	 * If we hit the last page and there is more work to be done: wrap
+	 * back the index back to the start of the file for the next
+	 * time we are called.
+	 */
+	if (wbc->range_cyclic && !done)
+		done_index = 0;
 	if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0))
 		mapping->writeback_index = done_index;