Merge 4.14.156 into android-4.14

Changes in 4.14.156
	spi: mediatek: use correct mata->xfer_len when in fifo transfer
	tee: optee: add missing of_node_put after of_device_is_available
	Revert "OPP: Protect dev_list with opp_table lock"
	net: cdc_ncm: Signedness bug in cdc_ncm_set_dgram_size()
	idr: Fix idr_get_next race with idr_remove
	mm/memory_hotplug: don't access uninitialized memmaps in shrink_pgdat_span()
	mm/memory_hotplug: fix updating the node span
	arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault
	fbdev: Ditch fb_edid_add_monspecs
	net: ovs: fix return type of ndo_start_xmit function
	net: xen-netback: fix return type of ndo_start_xmit function
	ARM: dts: dra7: Enable workaround for errata i870 in PCIe host mode
	ARM: dts: omap5: enable OTG role for DWC3 controller
	net: hns3: Fix for netdev not up problem when setting mtu
	f2fs: return correct errno in f2fs_gc
	ARM: dts: sun8i: h3-h5: ir register size should be the whole memory block
	SUNRPC: Fix priority queue fairness
	IB/hfi1: Ensure ucast_dlid access doesnt exceed bounds
	iommu/io-pgtable-arm: Fix race handling in split_blk_unmap()
	kvm: arm/arm64: Fix stage2_flush_memslot for 4 level page table
	arm64/numa: Report correct memblock range for the dummy node
	ath10k: fix vdev-start timeout on error
	ata: ahci_brcm: Allow using driver or DSL SoCs
	ath9k: fix reporting calculated new FFT upper max
	usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in fotg210_get_status()
	usb: dwc3: gadget: Check ENBLSLPM before sending ep command
	nl80211: Fix a GET_KEY reply attribute
	irqchip/irq-mvebu-icu: Fix wrong private data retrieval
	watchdog: w83627hf_wdt: Support NCT6796D, NCT6797D, NCT6798D
	KVM: PPC: Inform the userspace about TCE update failures
	dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction
	dmaengine: timb_dma: Use proper enum in td_prep_slave_sg
	ext4: fix build error when DX_DEBUG is defined
	clk: keystone: Enable TISCI clocks if K3_ARCH
	sunrpc: Fix connect metrics
	mei: samples: fix a signedness bug in amt_host_if_call()
	cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update
	cxgb4: Use proper enum in IEEE_FAUX_SYNC
	powerpc/pseries: Fix DTL buffer registration
	powerpc/pseries: Fix how we iterate over the DTL entries
	powerpc/xive: Move a dereference below a NULL test
	ARM: dts: at91: sama5d4_xplained: fix addressable nand flash size
	ARM: dts: at91: at91sam9x5cm: fix addressable nand flash size
	mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer
	PM / hibernate: Check the success of generating md5 digest before hibernation
	tools: PCI: Fix compilation warnings
	clocksource/drivers/sh_cmt: Fixup for 64-bit machines
	clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines
	md: allow metadata updates while suspending an array - fix
	ixgbe: Fix ixgbe TX hangs with XDP_TX beyond queue limit
	i40e: Use proper enum in i40e_ndo_set_vf_link_state
	ixgbe: Fix crash with VFs and flow director on interface flap
	IB/mthca: Fix error return code in __mthca_init_one()
	IB/mlx4: Avoid implicit enumerated type conversion
	ACPICA: Never run _REG on system_memory and system_IO
	powerpc/time: Use clockevents_register_device(), fixing an issue with large decrementer
	ata: ep93xx: Use proper enums for directions
	media: rc: ir-rc6-decoder: enable toggle bit for Kathrein RCU-676 remote
	media: pxa_camera: Fix check for pdev->dev.of_node
	media: i2c: adv748x: Support probing a single output
	ALSA: hda/sigmatel - Disable automute for Elo VuPoint
	KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC and LR
	USB: serial: cypress_m8: fix interrupt-out transfer length
	mtd: physmap_of: Release resources on error
	cpu/SMT: State SMT is disabled even with nosmt and without "=force"
	brcmfmac: reduce timeout for action frame scan
	brcmfmac: fix full timeout waiting for action frame on-channel tx
	qtnfmac: pass sgi rate info flag to wireless core
	qtnfmac: drop error reports for out-of-bounds key indexes
	clk: samsung: exynos5420: Define CLK_SECKEY gate clock only or Exynos5420
	clk: samsung: Use clk_hw API for calling clk framework from clk notifiers
	i2c: brcmstb: Allow enabling the driver on DSL SoCs
	NFSv4.x: fix lock recovery during delegation recall
	dmaengine: ioat: fix prototype of ioat_enumerate_channels
	media: cec-gpio: select correct Signal Free Time
	Input: st1232 - set INPUT_PROP_DIRECT property
	Input: silead - try firmware reload after unsuccessful resume
	remoteproc: Check for NULL firmwares in sysfs interface
	kexec: Allocate decrypted control pages for kdump if SME is enabled
	x86/olpc: Fix build error with CONFIG_MFD_CS5535=m
	dmaengine: rcar-dmac: set scatter/gather max segment size
	crypto: mxs-dcp - Fix SHA null hashes and output length
	crypto: mxs-dcp - Fix AES issues
	xfrm: use correct size to initialise sp->ovec
	ACPI / SBS: Fix rare oops when removing modules
	iwlwifi: mvm: don't send keys when entering D3
	x86/fsgsbase/64: Fix ptrace() to read the FS/GS base accurately
	mmc: tmio: Fix SCC error detection
	fbdev: sbuslib: use checked version of put_user()
	fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper()
	reset: Fix potential use-after-free in __of_reset_control_get()
	bcache: recal cached_dev_sectors on detach
	media: dw9714: Fix error handling in probe function
	s390/kasan: avoid vdso instrumentation
	proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted()
	backlight: lm3639: Unconditionally call led_classdev_unregister
	mfd: ti_am335x_tscadc: Keep ADC interface on if child is wakeup capable
	printk: Give error on attempt to set log buffer length to over 2G
	media: isif: fix a NULL pointer dereference bug
	GFS2: Flush the GFS2 delete workqueue before stopping the kernel threads
	media: cx231xx: fix potential sign-extension overflow on large shift
	x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error
	gpio: syscon: Fix possible NULL ptr usage
	spi: fsl-lpspi: Prevent FIFO under/overrun by default
	pinctrl: gemini: Mask and set properly
	spi: spidev: Fix OF tree warning logic
	ARM: 8802/1: Call syscall_trace_exit even when system call skipped
	orangefs: rate limit the client not running info message
	pinctrl: gemini: Fix up TVC clock group
	hwmon: (pwm-fan) Silence error on probe deferral
	hwmon: (ina3221) Fix INA3221_CONFIG_MODE macros
	netfilter: nft_compat: do not dump private area
	misc: cxl: Fix possible null pointer dereference
	mac80211: minstrel: fix using short preamble CCK rates on HT clients
	mac80211: minstrel: fix CCK rate group streams value
	mac80211: minstrel: fix sampling/reporting of CCK rates in HT mode
	spi: rockchip: initialize dma_slave_config properly
	mlxsw: spectrum_switchdev: Check notification relevance based on upper device
	ARM: dts: omap5: Fix dual-role mode on Super-Speed port
	tools: PCI: Fix broken pcitest compilation
	powerpc/time: Fix clockevent_decrementer initalisation for PR KVM
	mmc: tmio: fix SCC error handling to avoid false positive CRC error
	Linux 4.14.156

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 17 insertions, 3 deletions

diff --git a/lib/idr.c b/lib/idr.c
index edd9b2be1651..8c1a98d03164 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -111,13 +111,27 @@ void *idr_get_next(struct idr *idr, int *nextid)
 {
 	struct radix_tree_iter iter;
 	void __rcu **slot;
-
-	slot = radix_tree_iter_find(&idr->idr_rt, &iter, *nextid);
+	void *entry = NULL;
+
+	radix_tree_for_each_slot(slot, &idr->idr_rt, &iter, *nextid) {
+		entry = rcu_dereference_raw(*slot);
+		if (!entry)
+			continue;
+		if (!radix_tree_deref_retry(entry))
+			break;
+		if (slot != (void *)&idr->idr_rt.rnode &&
+				entry != (void *)RADIX_TREE_INTERNAL_NODE)
+			break;
+		slot = radix_tree_iter_retry(&iter);
+	}
 	if (!slot)
 		return NULL;
 
+	if (WARN_ON_ONCE(iter.index > INT_MAX))
+		return NULL;
+
 	*nextid = iter.index;
-	return rcu_dereference_raw(*slot);
+	return entry;
 }
 EXPORT_SYMBOL(idr_get_next);