Merge 4.4.155 into android-4.4

Changes in 4.4.155
	net: 6lowpan: fix reserved space for single frames
	net: mac802154: tx: expand tailroom if necessary
	9p/net: Fix zero-copy path in the 9p virtio transport
	net: lan78xx: Fix misplaced tasklet_schedule() call
	spi: davinci: fix a NULL pointer dereference
	drm/i915/userptr: reject zero user_size
	powerpc/fadump: handle crash memory ranges array index overflow
	powerpc/pseries: Fix endianness while restoring of r3 in MCE handler.
	fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
	9p/virtio: fix off-by-one error in sg list bounds check
	net/9p/client.c: version pointer uninitialized
	net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()
	x86/mm/pat: Fix L1TF stable backport for CPA, 2nd call
	dm cache metadata: save in-core policy_hint_size to on-disk superblock
	iio: ad9523: Fix displayed phase
	iio: ad9523: Fix return value for ad952x_store()
	vmw_balloon: fix inflation of 64-bit GFNs
	vmw_balloon: do not use 2MB without batching
	vmw_balloon: VMCI_DOORBELL_SET does not check status
	vmw_balloon: fix VMCI use when balloon built into kernel
	tracing: Do not call start/stop() functions when tracing_on does not change
	tracing/blktrace: Fix to allow setting same value
	kthread, tracing: Don't expose half-written comm when creating kthreads
	uprobes: Use synchronize_rcu() not synchronize_sched()
	9p: fix multiple NULL-pointer-dereferences
	PM / sleep: wakeup: Fix build error caused by missing SRCU support
	pnfs/blocklayout: off by one in bl_map_stripe()
	ARM: tegra: Fix Tegra30 Cardhu PCA954x reset
	mm/tlb: Remove tlb_remove_table() non-concurrent condition
	iommu/vt-d: Add definitions for PFSID
	iommu/vt-d: Fix dev iotlb pfsid use
	osf_getdomainname(): use copy_to_user()
	sys: don't hold uts_sem while accessing userspace memory
	userns: move user access out of the mutex
	ubifs: Fix memory leak in lprobs self-check
	Revert "UBIFS: Fix potential integer overflow in allocation"
	ubifs: Check data node size before truncate
	ubifs: Fix synced_i_size calculation for xattr inodes
	pwm: tiehrpwm: Fix disabling of output of PWMs
	fb: fix lost console when the user unplugs a USB adapter
	udlfb: set optimal write delay
	getxattr: use correct xattr length
	bcache: release dc->writeback_lock properly in bch_writeback_thread()
	perf auxtrace: Fix queue resize
	fs/quota: Fix spectre gadget in do_quotactl
	x86/io: add interface to reserve io memtype for a resource range. (v1.1)
	drm/drivers: add support for using the arch wc mapping API.
	Linux 4.4.155

Change-Id: Ie455609e00dd70d3fa723cd254f544109db8a788
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 28 insertions, 36 deletions

diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 63f06a2b1f7f..bbc7cb9faa01 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -526,24 +526,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path,
 SYSCALL_DEFINE1(osf_utsname, char __user *, name)
 {
 	int error;
+	char tmp[5 * 32];
 
 	down_read(&uts_sem);
-	error = -EFAULT;
-	if (copy_to_user(name + 0, utsname()->sysname, 32))
-		goto out;
-	if (copy_to_user(name + 32, utsname()->nodename, 32))
-		goto out;
-	if (copy_to_user(name + 64, utsname()->release, 32))
-		goto out;
-	if (copy_to_user(name + 96, utsname()->version, 32))
-		goto out;
-	if (copy_to_user(name + 128, utsname()->machine, 32))
-		goto out;
+	memcpy(tmp + 0 * 32, utsname()->sysname, 32);
+	memcpy(tmp + 1 * 32, utsname()->nodename, 32);
+	memcpy(tmp + 2 * 32, utsname()->release, 32);
+	memcpy(tmp + 3 * 32, utsname()->version, 32);
+	memcpy(tmp + 4 * 32, utsname()->machine, 32);
+	up_read(&uts_sem);
 
-	error = 0;
- out:
-	up_read(&uts_sem);	
-	return error;
+	if (copy_to_user(name, tmp, sizeof(tmp)))
+		return -EFAULT;
+	return 0;
 }
 
 SYSCALL_DEFINE0(getpagesize)
@@ -561,24 +556,22 @@ SYSCALL_DEFINE0(getdtablesize)
  */
 SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen)
 {
-	unsigned len;
-	int i;
+	int len, err = 0;
+	char *kname;
+	char tmp[32];
 
-	if (!access_ok(VERIFY_WRITE, name, namelen))
-		return -EFAULT;
-
-	len = namelen;
-	if (len > 32)
-		len = 32;
+	if (namelen < 0 || namelen > 32)
+		namelen = 32;
 
 	down_read(&uts_sem);
-	for (i = 0; i < len; ++i) {
-		__put_user(utsname()->domainname[i], name + i);
-		if (utsname()->domainname[i] == '\0')
-			break;
-	}
+	kname = utsname()->domainname;
+	len = strnlen(kname, namelen);
+	len = min(len + 1, namelen);
+	memcpy(tmp, kname, len);
 	up_read(&uts_sem);
 
+	if (copy_to_user(name, tmp, len))
+		return -EFAULT;
 	return 0;
 }
 
@@ -741,13 +734,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
 	};
 	unsigned long offset;
 	const char *res;
-	long len, err = -EINVAL;
+	long len;
+	char tmp[__NEW_UTS_LEN + 1];
 
 	offset = command-1;
 	if (offset >= ARRAY_SIZE(sysinfo_table)) {
 		/* Digital UNIX has a few unpublished interfaces here */
 		printk("sysinfo(%d)", command);
-		goto out;
+		return -EINVAL;
 	}
 
 	down_read(&uts_sem);
@@ -755,13 +749,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
 	len = strlen(res)+1;
 	if ((unsigned long)len > (unsigned long)count)
 		len = count;
-	if (copy_to_user(buf, res, len))
-		err = -EFAULT;
-	else
-		err = 0;
+	memcpy(tmp, res, len);
 	up_read(&uts_sem);
- out:
-	return err;
+	if (copy_to_user(buf, tmp, len))
+		return -EFAULT;
+	return 0;
 }
 
 SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,