ipv4: fix the rcu race between free_fib_info and ip_route_output_slow

We hit a kernel OOPS.

<3>[23898.789643] BUG: sleeping function called from invalid context at
/data/buildbot/workdir/ics/hardware/intel/linux-2.6/arch/x86/mm/fault.c:1103
<3>[23898.862215] in_atomic(): 0, irqs_disabled(): 0, pid: 10526, name:
Thread-6683
<4>[23898.967805] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.258526] Pid: 10526, comm: Thread-6683 Tainted: G        W
3.0.8-137685-ge7742f9 #1
<4>[23899.357404] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.904225] Call Trace:
<4>[23899.989209]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.000416]  [<c1238c2a>] __might_sleep+0x10a/0x110
<4>[23900.007357]  [<c1228021>] do_page_fault+0xd1/0x3c0
<4>[23900.013764]  [<c18e9ba9>] ? restore_all+0xf/0xf
<4>[23900.024024]  [<c17c007b>] ? napi_complete+0x8b/0x690
<4>[23900.029297]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.123739]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.128955]  [<c18ea0c3>] error_code+0x5f/0x64
<4>[23900.133466]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.138450]  [<c17f6298>] ? __ip_route_output_key+0x698/0x7c0
<4>[23900.144312]  [<c17f5f8d>] ? __ip_route_output_key+0x38d/0x7c0
<4>[23900.150730]  [<c17f63df>] ip_route_output_flow+0x1f/0x60
<4>[23900.156261]  [<c181de58>] ip4_datagram_connect+0x188/0x2b0
<4>[23900.161960]  [<c18e981f>] ? _raw_spin_unlock_bh+0x1f/0x30
<4>[23900.167834]  [<c18298d6>] inet_dgram_connect+0x36/0x80
<4>[23900.173224]  [<c14f9e88>] ? _copy_from_user+0x48/0x140
<4>[23900.178817]  [<c17ab9da>] sys_connect+0x9a/0xd0
<4>[23900.183538]  [<c132e93c>] ? alloc_file+0xdc/0x240
<4>[23900.189111]  [<c123925d>] ? sub_preempt_count+0x3d/0x50

Function free_fib_info resets nexthop_nh->nh_dev to NULL before releasing
fi. Other cpu might be accessing fi. Fixing it by delaying the releasing.

With the patch, we ran MTBF testing on Android mobile for 12 hours
and didn't trigger the issue.

Thank Eric for very detailed review/checking the issue.

CRs-fixed: 430941
Change-Id: I14480ff9085a8e13fe43ea14bfa53fb7b77384b3
Signed-off-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Signed-off-by: Kun Jiang <kunx.jiang@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: e49cc0da7283088c5e03d475ffe2fdcb24a6d5b1
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Jay Chokshi <jchokshi@codeaurora.org>
msm: dcvs: fail gracefully if TZ does not support dcvs

If dcvs attempts to initialize on a system where TZ does not support
dcvs, it will eventually cause a crash. Prevent this by disabling
dcvs if TZ does not successfully initialize its part of dcvs.

Change-Id: Ic9cd361243c03c3832133614c4847a2815b0bbb4
Signed-off-by: Steve Muckle <smuckle@codeaurora.org>
sync: Limit logging to particular fence on timeout and error

Change-Id: I5bd7d62260666cdd2a32212f0e828d2d5d7d7bba
Signed-off-by: Prakash Kamliya <pkamliya@codeaurora.org>
Signed-off-by: Ananta Kishore K <akollipa@codeaurora.org>
msm: Fix race condition in domain lookup

During lookup of domains we take a pointer to the root node
of the rb tree before taking the mutex to protect the rb tree.
However, the rb root node might change if another process updates
the rb tree after we take the pointer to the root node. This can
cause us to not find the entry that we are looking for.
Fix this by ensuring we have taken the mutex before getting the
root node pointer.

CRs-fixed: 493503
Change-Id: I4702740e486fda0cd92df0401d8e4706598a899b
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>