Merge branch 'android-4.4@b834e92' into branch 'msm-4.4'

* refs/heads/tmp-b834e92
  Revert "USB: gadget: u_ether: Fix data stall issue in RNDIS tethering mode"
  Linux 4.4.63
  MIPS: fix Select HAVE_IRQ_EXIT_ON_IRQ_STACK patch.
  sctp: deny peeloff operation on asocs with threads sleeping on it
  net: ipv6: check route protocol when deleting routes
  tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done
  SUNRPC: fix refcounting problems with auth_gss messages.
  ibmveth: calculate gso_segs for large packets
  catc: Use heap buffer for memory size test
  catc: Combine failure cleanup code in catc_probe()
  rtl8150: Use heap buffers for all register access
  pegasus: Use heap buffers for all register access
  virtio-console: avoid DMA from stack
  dvb-usb-firmware: don't do DMA on stack
  dvb-usb: don't use stack for firmware load
  mm: Tighten x86 /dev/mem with zeroing reads
  rtc: tegra: Implement clock handling
  platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event
  ext4: fix inode checksum calculation problem if i_extra_size is small
  dvb-usb-v2: avoid use-after-free
  ath9k: fix NULL pointer dereference
  crypto: ahash - Fix EINPROGRESS notification callback
  powerpc: Disable HFSCR[TM] if TM is not supported
  zram: do not use copy_page with non-page aligned address
  kvm: fix page struct leak in handle_vmon
  Revert "MIPS: Lantiq: Fix cascaded IRQ setup"
  char: lack of bool string made CONFIG_DEVPORT always on
  char: Drop bogus dependency of DEVPORT on !M68K
  ftrace: Fix removing of second function probe
  irqchip/irq-imx-gpcv2: Fix spinlock initialization
  libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat
  xen, fbfront: fix connecting to backend
  scsi: sd: Fix capacity calculation with 32-bit sector_t
  scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
  scsi: sr: Sanity check returned mode data
  iscsi-target: Drop work-around for legacy GlobalSAN initiator
  iscsi-target: Fix TMR reference leak during session shutdown
  acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)
  x86/vdso: Plug race between mapping and ELF header setup
  x86/vdso: Ensure vdso32_enabled gets set to valid values only
  perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()
  Input: xpad - add support for Razer Wildcat gamepad
  CIFS: store results of cifs_reopen_file to avoid infinite wait
  drm/nouveau/mmu/nv4a: use nv04 mmu rather than the nv44 one
  drm/nouveau/mpeg: mthd returns true on success now
  thp: fix MADV_DONTNEED vs clear soft dirty race
  cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups
  ANDROID: uid_sys_stats: reduce update_io_stats overhead
  UPSTREAM: char: lack of bool string made CONFIG_DEVPORT always on
  UPSTREAM: char: Drop bogus dependency of DEVPORT on !M68K
  Revert "Android: sdcardfs: Don't do d_add for lower fs"
  ANDROID: usb: gadget: fix MTP enumeration issue under super speed mode
  Android: sdcardfs: Don't complain in fixup_lower_ownership
  Android: sdcardfs: Don't do d_add for lower fs
  ANDROID: sdcardfs: ->iget fixes
  Android: sdcardfs: Change cache GID value
  BACKPORT: [UPSTREAM] ext2: convert to mbcache2
  BACKPORT [UPSTREAM] ext4: convert to mbcache2
  BACKPORT: [UPSTREAM] mbcache2: reimplement mbcache
  Linux 4.4.62
  ibmveth: set correct gso_size and gso_type
  net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions
  net/mlx4_core: Fix racy CQ (Completion Queue) free
  net/mlx4_en: Fix bad WQE issue
  usb: hub: Wait for connection to be reestablished after port reset
  blk-mq: Avoid memory reclaim when remapping queues
  net/packet: fix overflow in check for priv area size
  crypto: caam - fix RNG deinstantiation error checking
  MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch
  MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK
  MIPS: Switch to the irq_stack in interrupts
  MIPS: Only change $28 to thread_info if coming from user mode
  MIPS: Stack unwinding while on IRQ stack
  MIPS: Introduce irq_stack
  mtd: bcm47xxpart: fix parsing first block after aligned TRX
  usb: dwc3: gadget: delay unmap of bounced requests
  drm/i915: Stop using RP_DOWN_EI on Baytrail
  drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3
  UPSTREAM: net: socket: Make unnecessarily global sockfs_setattr() static
  UPSTREAM: net: ipv4: Don't crash if passing a null sk to ip_do_redirect.
  UPSTREAM: net/packet: fix overflow in check for priv area size
  Linux 4.4.61
  mm/mempolicy.c: fix error handling in set_mempolicy and mbind.
  MIPS: Flush wrong invalid FTLB entry for huge page
  MIPS: Lantiq: fix missing xbar kernel panic
  MIPS: End spinlocks with .insn
  MIPS: ralink: Fix typos in rt3883 pinctrl
  MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels
  s390/uaccess: get_user() should zero on failure (again)
  s390/decompressor: fix initrd corruption caused by bss clear
  nios2: reserve boot memory for device tree
  powerpc: Don't try to fix up misaligned load-with-reservation instructions
  powerpc/mm: Add missing global TLB invalidate if cxl is active
  metag/usercopy: Add missing fixups
  metag/usercopy: Fix src fixup in from user rapf loops
  metag/usercopy: Set flags before ADDZ
  metag/usercopy: Zero rest of buffer from copy_from_user
  metag/usercopy: Add early abort to copy_to_user
  metag/usercopy: Fix alignment error checking
  metag/usercopy: Drop unused macros
  ring-buffer: Fix return value check in test_ringbuffer()
  ptrace: fix PTRACE_LISTEN race corrupting task->state
  Reset TreeId to zero on SMB2 TREE_CONNECT
  iio: bmg160: reset chip when probing
  arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region
  arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm
  staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
  sysfs: be careful of error returns from ops->show()
  drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
  drm/vmwgfx: Remove getparam error message
  drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
  drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
  drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
  drm/vmwgfx: Type-check lookups of fence objects
  Revert "Revert "Revert "CHROMIUM: android: binder: Fix potential scheduling-while-atomic"""
  ANDROID: sdcardfs: Directly pass lower file for mmap
  UPSTREAM: checkpatch: special audit for revert commit line
  UPSTREAM: PM / sleep: make PM notifiers called symmetrically
  Revert "Revert "CHROMIUM: android: binder: Fix potential scheduling-while-atomic""
  Linux 4.4.60
  padata: avoid race in reordering
  blk: Ensure users for current->bio_list can see the full list.
  blk: improve order of bio handling in generic_make_request()
  power: reset: at91-poweroff: timely shutdown LPDDR memories
  KVM: kvm_io_bus_unregister_dev() should never fail
  rtc: s35390a: improve irq handling
  rtc: s35390a: implement reset routine as suggested by the reference
  rtc: s35390a: make sure all members in the output are set
  rtc: s35390a: fix reading out alarm
  MIPS: Lantiq: Fix cascaded IRQ setup
  mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()
  drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags
  KVM: x86: clear bus pointer when destroyed
  USB: fix linked-list corruption in rh_call_control()
  tty/serial: atmel: fix TX path in atmel_console_write()
  tty/serial: atmel: fix race condition (TX+DMA)
  ACPI: Do not create a platform_device for IOAPIC/IOxAPIC
  ACPI: Fix incompatibility with mcount-based function graph tracing
  ASoC: atmel-classd: fix audio clock rate
  ALSA: hda - fix a problem for lineout on a Dell AIO machine
  ALSA: seq: Fix race during FIFO resize
  scsi: libsas: fix ata xfer length
  scsi: sg: check length passed to SG_NEXT_CMD_LEN
  scsi: mpt3sas: fix hang on ata passthrough commands
  xen/setup: Don't relocate p2m over existing one
  libceph: force GFP_NOIO for socket allocations
  Linux 4.4.59
  sched/rt: Add a missing rescheduling point
  fscrypt: remove broken support for detecting keyring key revocation
  metag/ptrace: Reject partial NT_METAG_RPIPE writes
  metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS
  metag/ptrace: Preserve previous registers for short regset write
  sparc/ptrace: Preserve previous registers for short regset write
  mips/ptrace: Preserve previous registers for short regset write
  h8300/ptrace: Fix incorrect register transfer count
  c6x/ptrace: Remove useless PTRACE_SETREGSET implementation
  pinctrl: qcom: Don't clear status bit on irq_unmask
  virtio_balloon: init 1st buffer in stats vq
  xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
  xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
  xfrm: policy: init locks early

Conflicts:
	drivers/scsi/sd.c
	drivers/usb/gadget/function/f_mtp.c
	drivers/usb/gadget/function/u_ether.c

Change-Id: I80501cf02d04204f8c0f3a7f5a036eaa4d54546e
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

2 files changed, 30 insertions, 13 deletions

diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 46dbc0a7dfc1..49001fa84ead 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -868,7 +868,8 @@ kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx,
 			continue;
 
 		kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-		kvm->buses[bus_idx]->ioeventfd_count--;
+		if (kvm->buses[bus_idx])
+			kvm->buses[bus_idx]->ioeventfd_count--;
 		ioeventfd_release(p);
 		ret = 0;
 		break;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 336ed267c407..cb092bd9965b 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -654,8 +654,11 @@ static void kvm_destroy_vm(struct kvm *kvm)
 	list_del(&kvm->vm_list);
 	spin_unlock(&kvm_lock);
 	kvm_free_irq_routing(kvm);
-	for (i = 0; i < KVM_NR_BUSES; i++)
-		kvm_io_bus_destroy(kvm->buses[i]);
+	for (i = 0; i < KVM_NR_BUSES; i++) {
+		if (kvm->buses[i])
+			kvm_io_bus_destroy(kvm->buses[i]);
+		kvm->buses[i] = NULL;
+	}
 	kvm_coalesced_mmio_free(kvm);
 #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER)
 	mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm);
@@ -3271,6 +3274,8 @@ int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
 	};
 
 	bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+	if (!bus)
+		return -ENOMEM;
 	r = __kvm_io_bus_write(vcpu, bus, &range, val);
 	return r < 0 ? r : 0;
 }
@@ -3288,6 +3293,8 @@ int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx,
 	};
 
 	bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+	if (!bus)
+		return -ENOMEM;
 
 	/* First try the device referenced by cookie. */
 	if ((cookie >= 0) && (cookie < bus->dev_count) &&
@@ -3338,6 +3345,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr,
 	};
 
 	bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu);
+	if (!bus)
+		return -ENOMEM;
 	r = __kvm_io_bus_read(vcpu, bus, &range, val);
 	return r < 0 ? r : 0;
 }
@@ -3350,6 +3359,9 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 	struct kvm_io_bus *new_bus, *bus;
 
 	bus = kvm->buses[bus_idx];
+	if (!bus)
+		return -ENOMEM;
+
 	/* exclude ioeventfd which is limited by maximum fd */
 	if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1)
 		return -ENOSPC;
@@ -3369,37 +3381,41 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
 }
 
 /* Caller must hold slots_lock. */
-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
-			      struct kvm_io_device *dev)
+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+			       struct kvm_io_device *dev)
 {
-	int i, r;
+	int i;
 	struct kvm_io_bus *new_bus, *bus;
 
 	bus = kvm->buses[bus_idx];
-	r = -ENOENT;
+	if (!bus)
+		return;
+
 	for (i = 0; i < bus->dev_count; i++)
 		if (bus->range[i].dev == dev) {
-			r = 0;
 			break;
 		}
 
-	if (r)
-		return r;
+	if (i == bus->dev_count)
+		return;
 
 	new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
 			  sizeof(struct kvm_io_range)), GFP_KERNEL);
-	if (!new_bus)
-		return -ENOMEM;
+	if (!new_bus)  {
+		pr_err("kvm: failed to shrink bus, removing it completely\n");
+		goto broken;
+	}
 
 	memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
 	new_bus->dev_count--;
 	memcpy(new_bus->range + i, bus->range + i + 1,
 	       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
 
+broken:
 	rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
 	synchronize_srcu_expedited(&kvm->srcu);
 	kfree(bus);
-	return r;
+	return;
 }
 
 static struct notifier_block kvm_cpu_notifier = {