This is the 4.9.219 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl6UI7sACgkQONu9yGCS
 aT5png//QOOP2eJhRXJ1fljGpHhS8TizKPG4HsvWYEvbJpiPgap4+K//MHHPQJBH
 c7C03STaMoFEwb2kmWIWmQWwUlRIRaG0ubuCGYLboncts0jWOnbuN3u51Z31V2/w
 LjJ3BKAt+EDGxltxV+KFE7Gp5DQ5bvN4PzlkNDpyF90QtjCZSDBpFR0c466lkUsy
 26RYU3BG2RbuNDGPqgzhIsTvc4hpmiPM/pvkXbAHqjf7TDeDPZnQntfwvqjtSUVu
 fDey9pBNSkfam++29t14bYVeRIp1i73ASFZe7IOajb3+U5B+mUGD1efurDAAMjiE
 hJpw1p2SNidDntUfW53xF6xiSNDmxUpOQexWNgMQZZrLow0EObm4eRkXwJLgch18
 BmtgHg2NKHfcosXP+yTzmwiyBOes0/q7EnIR6IeCWdYH+9TXwSy4BL+eMyJUZR7+
 A1FEIt3+SuIee88N+b+rn4u94r4vvxzRBZ5flpX8TJDSkQ2FhAf4to7dXHA/BZkg
 +IKNaW/zvcgTRGROOzODVenbXcGseOseoNMXzp4PciAtZvWfGXo0LU82gD/SivS4
 tkA+C/bBu5WBzPr0Pzl+fhlHn5maLpIIukNPOGsSASBh/d11BVE4951GzlhEFjgT
 km4bfo/85QtD43s68emrJUNoUE7RfKlulhlbN5Aa+Xg/N/DcTo8=
 =/6B3
 -----END PGP SIGNATURE-----

Merge 4.9.219 into android-4.9-q

Changes in 4.9.219
	l2tp: ensure sessions are freed after their PPPOL2TP socket
	l2tp: fix race between l2tp_session_delete() and l2tp_tunnel_closeall()
	drm/bochs: downgrade pci_request_region failure from error to warning
	ipv4: fix a RCU-list lock in fib_triestat_seq_show
	net, ip_tunnel: fix interface lookup with no key
	sctp: fix refcount bug in sctp_wfree
	sctp: fix possibly using a bad saddr with a given dst
	drm/etnaviv: replace MMU flush marker with flush sequence
	blk-mq: sync the update nr_hw_queues with blk_mq_queue_tag_busy_iter
	blk-mq: Allow blocking queue tag iter callbacks
	coresight: do not use the BIT() macro in the UAPI header
	net: dsa: tag_brcm: Fix skb->fwd_offload_mark location
	padata: always acquire cpu_hotplug_lock before pinst->lock
	mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
	net: dsa: bcm_sf2: Ensure correct sub-node is parsed
	net: stmmac: dwmac1000: fix out-of-bounds mac address reg setting
	slcan: Don't transmit uninitialized stack data in padding
	net: phy: micrel: kszphy_resume(): add delay after genphy_resume() before accessing PHY registers
	random: always use batched entropy for get_random_u{32,64}
	tools/accounting/getdelays.c: fix netlink attribute length
	ASoC: jz4740-i2s: Fix divider written at incorrect offset in register
	IB/hfi1: Call kobject_put() when kobject_init_and_add() fails
	IB/hfi1: Fix memory leaks in sysfs registration and unregistration
	ceph: remove the extra slashes in the server path
	ceph: canonicalize server path in place
	Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
	RDMA/cm: Update num_paths in cma_resolve_iboe_route error flow
	clk: qcom: rcg: Return failure for RCG update
	drm/msm: stop abusing dma_map/unmap for cache
	arm64: Fix size of __early_cpu_boot_status
	usb: dwc3: don't set gadget->is_otg flag
	drm_dp_mst_topology: fix broken drm_dp_sideband_parse_remote_dpcd_read()
	drm/msm: Use the correct dma_sync calls in msm_gem
	Linux 4.9.219

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic787d6aa9374864ce928ac1ef802077ac55ca232

net/l2tp/l2tp_core.c

@@ -1343,6 +1343,9 @@ again:
 
 			hlist_del_init(&session->hlist);
 
+			if (test_and_set_bit(0, &session->dead))
+				goto again;
+
 			if (session->ref != NULL)
 				(*session->ref)(session);
 
@@ -1791,6 +1794,9 @@ EXPORT_SYMBOL_GPL(__l2tp_session_unhash);
  */
 int l2tp_session_delete(struct l2tp_session *session)
 {
+	if (test_and_set_bit(0, &session->dead))
+		return 0;
+
 	if (session->ref)
 		(*session->ref)(session);
 	__l2tp_session_unhash(session);

net/l2tp/l2tp_core.h

@@ -84,6 +84,7 @@ struct l2tp_session_cfg {
 struct l2tp_session {
 	int			magic;		/* should be
 						 * L2TP_SESSION_MAGIC */
+	long			dead;
 
 	struct l2tp_tunnel	*tunnel;	/* back pointer to tunnel
 						 * context */

net/l2tp/l2tp_ppp.c

@@ -429,11 +429,11 @@ static void pppol2tp_session_close(struct l2tp_session *session)
 
 	BUG_ON(session->magic != L2TP_SESSION_MAGIC);
 
-	if (sock) {
+	if (sock)
 		inet_shutdown(sock, SEND_SHUTDOWN);
-		/* Don't let the session go away before our socket does */
-		l2tp_session_inc_refcount(session);
-	}
+
+	/* Don't let the session go away before our socket does */
+	l2tp_session_inc_refcount(session);
 }
 
 /* Really kill the session socket. (Called from sock_put() if