Merge 4.4.206 into android-4.4-p

Changes in 4.4.206
	ASoC: compress: fix unsigned integer overflow check
	ASoC: kirkwood: fix external clock probe defer
	clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
	reset: fix reset_control_ops kerneldoc comment
	can: peak_usb: report bus recovery as well
	can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open
	scripts/gdb: fix debugging modules compiled with hot/cold partitioning
	block: drbd: remove a stray unlock in __drbd_send_protocol()
	scsi: lpfc: Fix dif and first burst use in write commands
	ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
	ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
	parisc: Fix serio address output
	parisc: Fix HP SDC hpa address output
	arm64: smp: Handle errors reported by the firmware
	PM / AVS: SmartReflex: NULL check before some freeing functions is not needed
	ARM: ks8695: fix section mismatch warning
	ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
	crypto: user - support incremental algorithm dumps
	mwifiex: fix potential NULL dereference and use after free
	mwifiex: debugfs: correct histogram spacing, formatting
	rtl818x: fix potential use after free
	xfs: require both realtime inodes to mount
	ubi: Put MTD device after it is not used
	ubi: Do not drop UBI device reference before using
	microblaze: adjust the help to the real behavior
	microblaze: move "... is ready" messages to arch/microblaze/Makefile
	gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
	VSOCK: bind to random port for VMADDR_PORT_ANY
	btrfs: only track ref_heads in delayed_ref_updates
	xen/pciback: Check dev_data before using it
	KVM: s390: unregister debug feature on failing arch init
	pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
	pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
	HID: doc: fix wrong data structure reference for UHID_OUTPUT
	gfs2: take jdata unstuff into account in do_grow
	xfs: Align compat attrlist_by_handle with native implementation.
	IB/qib: Fix an error code in qib_sdma_verbs_send()
	powerpc/book3s/32: fix number of bats in p/v_block_mapped()
	powerpc/xmon: fix dump_segments()
	drivers/regulator: fix a missing check of return value
	serial: max310x: Fix tx_empty() callback
	openrisc: Fix broken paths to arch/or32
	RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
	scsi: qla2xxx: deadlock by configfs_depend_item
	scsi: csiostor: fix incorrect dma device in case of vport
	ath6kl: Only use match sets when firmware supports it
	ath6kl: Fix off by one error in scan completion
	powerpc/prom: fix early DEBUG messages
	powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
	powerpc/44x/bamboo: Fix PCI range
	drbd: reject attach of unsuitable uuids even if connected
	drbd: fix print_st_err()'s prototype to match the definition
	regulator: tps65910: fix a missing check of return value
	net/net_namespace: Check the return value of register_pernet_subsys()
	um: Make GCOV depend on !KCOV
	net: stmicro: fix a missing check of clk_prepare
	atl1e: checking the status of atl1e_write_phy_reg
	tipc: fix a missing check of genlmsg_put
	ocfs2: clear journal dirty flag after shutdown journal
	lib/genalloc.c: use vzalloc_node() to allocate the bitmap
	lib/genalloc.c: include vmalloc.h
	mtd: Check add_mtd_device() ret code
	tipc: fix memory leak in tipc_nl_compat_publ_dump
	net/core/neighbour: tell kmemleak about hash tables
	net/core/neighbour: fix kmemleak minimal reference count for hash tables
	sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
	decnet: fix DN_IFREQ_SIZE
	tipc: fix skb may be leaky in tipc_link_input
	sfc: initialise found bitmap in efx_ef10_mtd_probe
	net: fix possible overflow in __sk_mem_raise_allocated()
	net: dev: Use unsigned integer as an argument to left-shift
	scsi: libsas: Support SATA PHY connection rate unmatch fixing during discovery
	ACPI / APEI: Switch estatus pool to use vmalloc memory
	scsi: libsas: Check SMP PHY control function result
	powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()
	mtd: Remove a debug trace in mtdpart.c
	staging: rtl8192e: fix potential use after free
	USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
	mei: bus: prefix device names on bus with the bus name
	media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE
	net: macb: fix error format in dev_err()
	pwm: Clear chip_data in pwm_put()
	macvlan: schedule bc_work even if error
	openvswitch: fix flow command message size
	slip: Fix use-after-free Read in slip_open
	openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
	openvswitch: remove another BUG_ON()
	tipc: fix link name length check
	net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
	HID: core: check whether Usage Page item is after Usage ID items
	hwrng: stm32 - fix unbalanced pm_runtime_enable
	platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
	Linux 4.4.206

Change-Id: Ie297a77bf4a6cd8f1bf629d43684902c529d23c9
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 20 insertions, 17 deletions

diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index b93c6db18ed3..f18dc2d045c2 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -257,30 +257,33 @@ drop_alg:
 
 static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
 {
-	struct crypto_alg *alg;
+	const size_t start_pos = cb->args[0];
+	size_t pos = 0;
 	struct crypto_dump_info info;
-	int err;
-
-	if (cb->args[0])
-		goto out;
-
-	cb->args[0] = 1;
+	struct crypto_alg *alg;
+	int res;
 
 	info.in_skb = cb->skb;
 	info.out_skb = skb;
 	info.nlmsg_seq = cb->nlh->nlmsg_seq;
 	info.nlmsg_flags = NLM_F_MULTI;
 
+	down_read(&crypto_alg_sem);
 	list_for_each_entry(alg, &crypto_alg_list, cra_list) {
-		err = crypto_report_alg(alg, &info);
-		if (err)
-			goto out_err;
+		if (pos >= start_pos) {
+			res = crypto_report_alg(alg, &info);
+			if (res == -EMSGSIZE)
+				break;
+			if (res)
+				goto out;
+		}
+		pos++;
 	}
-
+	cb->args[0] = pos;
+	res = skb->len;
 out:
-	return skb->len;
-out_err:
-	return err;
+	up_read(&crypto_alg_sem);
+	return res;
 }
 
 static int crypto_dump_report_done(struct netlink_callback *cb)
@@ -498,7 +501,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 	if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
 	    (nlh->nlmsg_flags & NLM_F_DUMP))) {
 		struct crypto_alg *alg;
-		u16 dump_alloc = 0;
+		unsigned long dump_alloc = 0;
 
 		if (link->dump == NULL)
 			return -EINVAL;
@@ -506,16 +509,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 		down_read(&crypto_alg_sem);
 		list_for_each_entry(alg, &crypto_alg_list, cra_list)
 			dump_alloc += CRYPTO_REPORT_MAXSIZE;
+		up_read(&crypto_alg_sem);
 
 		{
 			struct netlink_dump_control c = {
 				.dump = link->dump,
 				.done = link->done,
-				.min_dump_alloc = dump_alloc,
+				.min_dump_alloc = min(dump_alloc, 65535UL),
 			};
 			err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
 		}
-		up_read(&crypto_alg_sem);
 
 		return err;
 	}