Merge 5.4.227 into android11-5.4-lts

Changes in 5.4.227
	arm64: dts: rockchip: keep I2S1 disabled for GPIO function on ROCK Pi 4 series
	arm: dts: rockchip: fix node name for hym8563 rtc
	ARM: dts: rockchip: fix ir-receiver node names
	ARM: dts: rockchip: rk3188: fix lcdc1-rgb24 node name
	ARM: 9251/1: perf: Fix stacktraces for tracepoint events in THUMB2 kernels
	ARM: 9266/1: mm: fix no-MMU ZERO_PAGE() implementation
	ARM: dts: rockchip: disable arm_global_timer on rk3066 and rk3188
	9p/fd: Use P9_HDRSZ for header size
	regulator: slg51000: Wait after asserting CS pin
	ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
	btrfs: send: avoid unaligned encoded writes when attempting to clone range
	ASoC: soc-pcm: Add NULL check in BE reparenting
	regulator: twl6030: fix get status of twl6032 regulators
	fbcon: Use kzalloc() in fbcon_prepare_logo()
	9p/xen: check logical size for buffer size
	net: usb: qmi_wwan: add u-blox 0x1342 composition
	mm/khugepaged: take the right locks for page table retraction
	mm/khugepaged: fix GUP-fast interaction by sending IPI
	mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
	xen/netback: Ensure protocol headers don't fall in the non-linear area
	xen/netback: do some code cleanup
	xen/netback: don't call kfree_skb() with interrupts disabled
	Revert "net: dsa: b53: Fix valid setting for MDB entries"
	media: v4l2-dv-timings.c: fix too strict blanking sanity checks
	memcg: fix possible use-after-free in memcg_write_event_control()
	mm/gup: fix gup_pud_range() for dax
	KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field
	drm/shmem-helper: Remove errant put in error path
	HID: usbhid: Add ALWAYS_POLL quirk for some mice
	HID: hid-lg4ff: Add check for empty lbuf
	HID: core: fix shift-out-of-bounds in hid_report_raw_event
	can: af_can: fix NULL pointer dereference in can_rcv_filter
	ieee802154: cc2520: Fix error return code in cc2520_hw_init()
	ca8210: Fix crash by zero initializing data
	drm/bridge: ti-sn65dsi86: Fix output polarity setting bug
	gpio: amd8111: Fix PCI device reference count leak
	e1000e: Fix TX dispatch condition
	igb: Allocate MSI-X vector when testing
	af_unix: Get user_ns from in_skb in unix_diag_get_exact().
	Bluetooth: 6LoWPAN: add missing hci_dev_put() in get_l2cap_conn()
	Bluetooth: Fix not cleanup led when bt_init fails
	net: dsa: ksz: Check return value
	selftests: rtnetlink: correct xfrm policy rule in kci_test_ipsec_offload
	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()
	net: encx24j600: Add parentheses to fix precedence
	net: encx24j600: Fix invalid logic in reading of MISTAT register
	xen-netfront: Fix NULL sring after live migration
	net: mvneta: Prevent out of bounds read in mvneta_config_rss()
	i40e: Fix not setting default xps_cpus after reset
	i40e: Fix for VF MAC address 0
	i40e: Disallow ip4 and ip6 l4_4_bytes
	NFC: nci: Bounds check struct nfc_target arrays
	nvme initialize core quirks before calling nvme_init_subsystem
	net: stmmac: fix "snps,axi-config" node property parsing
	net: thunderx: Fix missing destroy_workqueue of nicvf_rx_mode_wq
	net: hisilicon: Fix potential use-after-free in hisi_femac_rx()
	net: hisilicon: Fix potential use-after-free in hix5hd2_rx()
	tipc: Fix potential OOB in tipc_link_proto_rcv()
	ipv4: Fix incorrect route flushing when source address is deleted
	ipv4: Fix incorrect route flushing when table ID 0 is used
	ethernet: aeroflex: fix potential skb leak in greth_init_rings()
	xen/netback: fix build warning
	net: plip: don't call kfree_skb/dev_kfree_skb() under spin_lock_irq()
	ipv6: avoid use-after-free in ip6_fragment()
	net: mvneta: Fix an out of bounds check
	can: esd_usb: Allow REC and TEC to return to zero
	Linux 5.4.227

Change-Id: Idd4fa0e113a2b94326764baa669ff6fb02797adb
Signed-off-by: Greg Kroah-Hartman <[email protected]>

net/ipv6/ip6_output.c

@@ -919,6 +919,9 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 		if (err < 0)
 			goto fail;
 
+		/* We prevent @rt from being freed. */
+		rcu_read_lock();
+
 		for (;;) {
 			/* Prepare header of the next frame,
 			 * before previous one went down. */
@@ -942,6 +945,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 		if (err == 0) {
 			IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 				      IPSTATS_MIB_FRAGOKS);
+			rcu_read_unlock();
 			return 0;
 		}
 
@@ -949,6 +953,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 
 		IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 			      IPSTATS_MIB_FRAGFAILS);
+		rcu_read_unlock();
 		return err;
 
 slow_path_clean: