Merge android-4.4.163 (0ca3fca) into msm-4.4

* refs/heads/tmp-0ca3fca
  Linux 4.4.163
  x86/time: Correct the attribute on jiffies' definition
  l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6
  cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE
  x86/percpu: Fix this_cpu_read()
  sched/fair: Fix throttle_list starvation with low CFS quota
  Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM
  USB: fix the usbfs flag sanitization for control transfers
  usb: gadget: storage: Fix Spectre v1 vulnerability
  cdc-acm: correct counting of UART states in serial state notification
  IB/ucm: Fix Spectre v1 vulnerability
  RDMA/ucma: Fix Spectre v1 vulnerability
  ptp: fix Spectre v1 vulnerability
  cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)
  ahci: don't ignore result code of ahci_reset_controller()
  crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned
  mremap: properly flush TLB before releasing the page
  rtnetlink: Disallow FDB configuration for non-Ethernet device
  vhost: Fix Spectre V1 vulnerability
  net: drop skb on failure in ip_check_defrag()
  sctp: fix race on sctp_id2asoc
  r8169: fix NAPI handling under high load
  net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules
  net: socket: fix a missing-check bug
  net: sched: gred: pass the right attribute to gred_change_table_def()
  net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs
  ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called
  ipv6: mcast: fix a use-after-free in inet6_mc_check
  net: bridge: remove ipv6 zero address check in mcast queries
  bridge: do not add port to router list when receives query with source 0.0.0.0
  perf tools: Disable parallelism for 'make clean'
  mtd: spi-nor: Add support for is25wp series chips
  fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()
  ARM: dts: imx53-qsb: disable 1.2GHz OPP
  MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression
  igb: Remove superfluous reset to PHY and page 0 selection
  MIPS: microMIPS: Fix decoding of swsp16 instruction
  scsi: aacraid: Fix typo in blink status
  bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal
  PM / devfreq: tegra: fix error return code in tegra_devfreq_probe()
  ASoC: spear: fix error return code in spdif_in_probe()
  spi: xlp: fix error return code in xlp_spi_probe()
  spi/bcm63xx: fix error return code in bcm63xx_spi_probe()
  MIPS: Handle non word sized instructions when examining frame
  spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe()
  usb: dwc3: omap: fix error return code in dwc3_omap_probe()
  usb: ehci-omap: fix error return code in ehci_hcd_omap_probe()
  usb: imx21-hcd: fix error return code in imx21_probe()
  gpio: msic: fix error return code in platform_msic_gpio_probe()
  sparc64: Fix exception handling in UltraSPARC-III memcpy.
  gpu: host1x: fix error return code in host1x_probe()
  sparc64 mm: Fix more TSB sizing issues
  video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe()
  tty: serial: sprd: fix error return code in sprd_probe()
  l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()
  brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
  gro: Allow tunnel stacking in the case of FOU/GUE
  vti6: flush x-netns xfrm cache when vti interface is removed
  ALSA: timer: Fix zero-division by continue of uninitialized instance
  ixgbe: Correct X550EM_x revision check
  ixgbe: fix RSS limit for X550
  net/mlx5e: Correctly handle RSS indirection table when changing number of channels
  net/mlx5e: Fix LRO modify
  ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector
  fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio
  drm/nouveau/fbcon: fix oops without fbdev emulation
  bpf: generally move prog destruction to RCU deferral
  usb-storage: fix bogus hardware error messages for ATA pass-thru devices
  sch_red: update backlog as well
  sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata
  scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
  xfrm: Clear sk_dst_cache when applying per-socket policy.
  arm64: Fix potential race with hardware DBM in ptep_set_access_flags()
  CIFS: handle guest access errors to Windows shares
  ASoC: wm8940: Enable cache usage to fix crashes on resume
  ASoC: ak4613: Enable cache usage to fix crashes on resume
  MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue
  usbvision: revert commit 588afcc1
  perf/core: Don't leak event in the syscall error path
  aacraid: Start adapter after updating number of MSIX vectors
  x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
  tpm: fix: return rc when devm_add_action() fails
  thermal: allow u8500-thermal driver to be a module
  thermal: allow spear-thermal driver to be a module
  btrfs: don't create or leak aliased root while cleaning up orphans
  sched/cgroup: Fix cgroup entity load tracking tear-down
  um: Avoid longjmp/setjmp symbol clashes with libpthread.a
  ipv6: orphan skbs in reassembly unit
  net/mlx4_en: Resolve dividing by zero in 32-bit system
  af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers
  radix-tree: fix radix_tree_iter_retry() for tagged iterators.
  x86/mm/pat: Prevent hang during boot when mapping pages
  ARM: dts: apq8064: add ahci ports-implemented mask
  tracing: Skip more functions when doing stack tracing of events
  ser_gigaset: use container_of() instead of detour
  net: drop write-only stack variable
  ipv6: suppress sparse warnings in IP6_ECN_set_ce()
  KEYS: put keyring if install_session_keyring_to_cred() fails
  net: cxgb3_main: fix a missing-check bug
  perf/ring_buffer: Prevent concurent ring buffer access
  smsc95xx: Check for Wake-on-LAN modes
  smsc75xx: Check for Wake-on-LAN modes
  r8152: Check for supported Wake-on-LAN Modes
  sr9800: Check for supported Wake-on-LAN modes
  lan78xx: Check for supported Wake-on-LAN modes
  ax88179_178a: Check for supported Wake-on-LAN modes
  asix: Check for supported Wake-on-LAN modes
  pxa168fb: prepare the clock
  Bluetooth: SMP: fix crash in unpairing
  mac80211_hwsim: do not omit multicast announce of first added radio
  xfrm: validate template mode
  ARM: 8799/1: mm: fix pci_ioremap_io() offset check
  cfg80211: reg: Init wiphy_idx in regulatory_hint_core()
  mac80211: Always report TX status
  xfrm6: call kfree_skb when skb is toobig
  xfrm: Validate address prefix lengths in the xfrm selector.
  BACKPORT: xfrm: Allow Output Mark to be Updated Using UPDSA
  ANDROID: sdcardfs: Add option to drop unused dentries
  f2fs: guarantee journalled quota data by checkpoint
  f2fs: cleanup dirty pages if recover failed
  f2fs: fix data corruption issue with hardware encryption
  f2fs: fix to recover inode->i_flags of inode block during POR
  f2fs: spread f2fs_set_inode_flags()
  f2fs: fix to spread clear_cold_data()
  Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()"
  f2fs: account read IOs and use IO counts for is_idle
  f2fs: fix to account IO correctly for cgroup writeback
  f2fs: fix to account IO correctly
  f2fs: remove request_list check in is_idle()
  f2fs: allow to mount, if quota is failed
  f2fs: update REQ_TIME in f2fs_cross_rename()
  f2fs: do not update REQ_TIME in case of error conditions
  f2fs: remove unneeded disable_nat_bits()
  f2fs: remove unused sbi->trigger_ssr_threshold
  f2fs: shrink sbi->sb_lock coverage in set_file_temperature()
  f2fs: fix to recover cold bit of inode block during POR
  f2fs: submit cached bio to avoid endless PageWriteback
  f2fs: checkpoint disabling
  f2fs: clear PageError on the read path
  f2fs: allow out-place-update for direct IO in LFS mode
  f2fs: refactor ->page_mkwrite() flow
  Revert: "f2fs: check last page index in cached bio to decide submission"
  f2fs: support superblock checksum
  f2fs: add to account skip count of background GC
  f2fs: add to account meta IO
  f2fs: keep lazytime on remount
  f2fs: fix missing up_read
  f2fs: return correct errno in f2fs_gc
  f2fs: avoid f2fs_bug_on if f2fs_get_meta_page_nofail got EIO
  f2fs: mark inode dirty explicitly in recover_inode()
  f2fs: fix to recover inode's crtime during POR
  f2fs: fix to recover inode's i_gc_failures during POR
  f2fs: fix to recover inode's i_flags during POR
  f2fs: fix to recover inode's project id during POR
  f2fs: update i_size after DIO completion
  f2fs: report ENOENT correctly in f2fs_rename
  f2fs: fix remount problem of option io_bits
  f2fs: fix to recover inode's uid/gid during POR
  f2fs: avoid infinite loop in f2fs_alloc_nid
  f2fs: add new idle interval timing for discard and gc paths
  f2fs: split IO error injection according to RW
  f2fs: add SPDX license identifiers
  f2fs: surround fault_injection related option parsing using CONFIG_F2FS_FAULT_INJECTION
  f2fs: avoid sleeping under spin_lock
  f2fs: plug readahead IO in readdir()
  f2fs: fix to do sanity check with current segment number
  f2fs: fix memory leak of percpu counter in fill_super()
  f2fs: fix memory leak of write_io in fill_super()
  f2fs: cache NULL when both default_acl and acl are NULL
  f2fs: fix to flush all dirty inodes recovered in readonly fs
  f2fs: report error if quota off error during umount
  f2fs: submit bio after shutdown
  f2fs: avoid wrong decrypted data from disk
  Revert "f2fs: use printk_ratelimited for f2fs_msg"
  f2fs: fix unnecessary periodic wakeup of discard thread when dev is busy
  f2fs: fix to avoid NULL pointer dereference on se->discard_map
  f2fs: add additional sanity check in f2fs_acl_from_disk()
  Revert "BACKPORT, FROMLIST: fscrypt: add Speck128/256 support"
  Build fix for 076c36fce1ea0.
  Revert "BACKPORT, FROMGIT: crypto: speck - add support for the Speck block cipher"
  Revert "FROMGIT: crypto: speck - export common helpers"
  Revert "BACKPORT, FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS"
  Revert "BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck128-XTS"
  Revert "BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck64-XTS"
  Revert "BACKPORT, FROMLIST: crypto: arm64/speck - add NEON-accelerated implementation of Speck-XTS"
  Revert "fscrypt: add Speck128/256 support"
  UPSTREAM: loop: Add LOOP_SET_BLOCK_SIZE in compat ioctl
  BACKPORT: block/loop: set hw_sectors
  UPSTREAM: loop: add ioctl for changing logical block size

Conflicts:
	fs/ext4/crypto.c
	fs/ext4/ext4.h

Change-Id: I8cb2f70b27906879f8e8fdd90e67f438e39701b8
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

6 files changed, 47 insertions, 12 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2e478a4ad4c5..d0a1c54a1634 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4511,8 +4511,8 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
 
 		/* unicast address incl. temp addr */
 		list_for_each_entry(ifa, &idev->addr_list, if_list) {
-			if (++ip_idx < s_ip_idx)
-				continue;
+			if (ip_idx < s_ip_idx)
+				goto next;
 			err = inet6_fill_ifaddr(skb, ifa,
 						NETLINK_CB(cb->skb).portid,
 						cb->nlh->nlmsg_seq,
@@ -4521,6 +4521,8 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
 			if (err < 0)
 				break;
 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+next:
+			ip_idx++;
 		}
 		break;
 	}
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index ca697f16d2ea..5dd544c5cfe2 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1141,6 +1141,33 @@ static struct xfrm6_protocol vti_ipcomp6_protocol __read_mostly = {
 	.priority	=	100,
 };
 
+static bool is_vti6_tunnel(const struct net_device *dev)
+{
+	return dev->netdev_ops == &vti6_netdev_ops;
+}
+
+static int vti6_device_event(struct notifier_block *unused,
+			     unsigned long event, void *ptr)
+{
+	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct ip6_tnl *t = netdev_priv(dev);
+
+	if (!is_vti6_tunnel(dev))
+		return NOTIFY_DONE;
+
+	switch (event) {
+	case NETDEV_DOWN:
+		if (!net_eq(t->net, dev_net(dev)))
+			xfrm_garbage_collect(t->net);
+		break;
+	}
+	return NOTIFY_DONE;
+}
+
+static struct notifier_block vti6_notifier_block __read_mostly = {
+	.notifier_call = vti6_device_event,
+};
+
 /**
  * vti6_tunnel_init - register protocol and reserve needed resources
  *
@@ -1151,6 +1178,8 @@ static int __init vti6_tunnel_init(void)
 	const char *msg;
 	int err;
 
+	register_netdevice_notifier(&vti6_notifier_block);
+
 	msg = "tunnel device";
 	err = register_pernet_device(&vti6_net_ops);
 	if (err < 0)
@@ -1183,6 +1212,7 @@ xfrm_proto_ah_failed:
 xfrm_proto_esp_failed:
 	unregister_pernet_device(&vti6_net_ops);
 pernet_dev_failed:
+	unregister_netdevice_notifier(&vti6_notifier_block);
 	pr_err("vti6 init: failed to register %s\n", msg);
 	return err;
 }
@@ -1197,6 +1227,7 @@ static void __exit vti6_tunnel_cleanup(void)
 	xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH);
 	xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
 	unregister_pernet_device(&vti6_net_ops);
+	unregister_netdevice_notifier(&vti6_notifier_block);
 }
 
 module_init(vti6_tunnel_init);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 091cee551cd9..a5ec9a0cbb80 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2390,17 +2390,17 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
 {
 	int err;
 
-	/* callers have the socket lock and rtnl lock
-	 * so no other readers or writers of iml or its sflist
-	 */
+	write_lock_bh(&iml->sflock);
 	if (!iml->sflist) {
 		/* any-source empty exclude case */
-		return ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
+		err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
+	} else {
+		err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
+				iml->sflist->sl_count, iml->sflist->sl_addr, 0);
+		sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
+		iml->sflist = NULL;
 	}
-	err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
-		iml->sflist->sl_count, iml->sflist->sl_addr, 0);
-	sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
-	iml->sflist = NULL;
+	write_unlock_bh(&iml->sflock);
 	return err;
 }
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index dfe55e7ef07d..e03bb5a6b8d4 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1651,10 +1651,9 @@ int ndisc_rcv(struct sk_buff *skb)
 		return 0;
 	}
 
-	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
-
 	switch (msg->icmph.icmp6_type) {
 	case NDISC_NEIGHBOUR_SOLICITATION:
+		memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
 		ndisc_recv_ns(skb);
 		break;
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 838b65a59a73..5a9ae56e7868 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -601,6 +601,7 @@ struct sk_buff *nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 use
 	hdr = ipv6_hdr(clone);
 	fhdr = (struct frag_hdr *)skb_transport_header(clone);
 
+	skb_orphan(skb);
 	fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr,
 		     skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
 	if (fq == NULL) {
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 4d09ce6fa90e..64862c5084ee 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -165,9 +165,11 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 
 	if (toobig && xfrm6_local_dontfrag(skb)) {
 		xfrm6_local_rxpmtu(skb, mtu);
+		kfree_skb(skb);
 		return -EMSGSIZE;
 	} else if (!skb->ignore_df && toobig && skb->sk) {
 		xfrm_local_error(skb, mtu);
+		kfree_skb(skb);
 		return -EMSGSIZE;
 	}