mm: Hold a file reference in madvise_remove

commit 9ab4233dd08036fe34a89c7dc6f47a8bf2eb29eb upstream.

Otherwise the code races with munmap (causing a use-after-free
of the vma) or with close (causing a use-after-free of the struct
file).

The bug was introduced by commit 90ed52ebe481 ("[PATCH] holepunch: fix
mmap_sem i_mutex deadlock")

[bwh: Backported to 3.2:
 - Adjust context
 - madvise_remove() calls vmtruncate_range(), not do_fallocate()]
[luto: Backported to 3.0: Adjust context]

Cc: Hugh Dickins <hugh@veritas.com>
Cc: Miklos Szeredi <mszeredi@suse.cz>
Cc: Badari Pulavarty <pbadari@us.ibm.com>
Cc: Nick Piggin <npiggin@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net: wireless: bcmdhd: Update to version 5.90.195.104

- Fix p2p support for new wpa_supplicant
- Propagate disconnect error code for cfg80211

Change-Id: I9643fbad7b6170b0e794fd7854201931d5eefb22
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
net: wireless: bcmdhd: Update to version 5.90.195.114

- Get AP beacon and DTIM to set proper DTIM skipping

Change-Id: I6bc23f050c144bf8361078ad587bcadbfe3a37fc
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
net: add missing WIPHY flags
net: wireless: bcmdhd: Enable P2P probe request handling only during discovery

Change-Id: I2db29d5ed7f66f2a45feb890c81d510fcad24dd2
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>