Merge 4.4.69 into android-4.4

Changes in 4.4.69
	xen: adjust early dom0 p2m handling to xen hypervisor behavior
	target: Fix compare_and_write_callback handling for non GOOD status
	target/fileio: Fix zero-length READ and WRITE handling
	target: Convert ACL change queue_depth se_session reference usage
	iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement
	usb: host: xhci: print correct command ring address
	USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit
	USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously
	staging: vt6656: use off stack for in buffer USB transfers.
	staging: vt6656: use off stack for out buffer USB transfers.
	staging: gdm724x: gdm_mux: fix use-after-free on module unload
	staging: comedi: jr3_pci: fix possible null pointer dereference
	staging: comedi: jr3_pci: cope with jiffies wraparound
	usb: misc: add missing continue in switch
	usb: Make sure usb/phy/of gets built-in
	usb: hub: Fix error loop seen after hub communication errors
	usb: hub: Do not attempt to autosuspend disconnected devices
	x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
	selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug
	x86, pmem: Fix cache flushing for iovec write < 8 bytes
	um: Fix PTRACE_POKEUSER on x86_64
	KVM: x86: fix user triggerable warning in kvm_apic_accept_events()
	KVM: arm/arm64: fix races in kvm_psci_vcpu_on
	block: fix blk_integrity_register to use template's interval_exp if not 0
	crypto: algif_aead - Require setkey before accept(2)
	dm era: save spacemap metadata root after the pre-commit
	vfio/type1: Remove locked page accounting workqueue
	IB/core: Fix sysfs registration error flow
	IB/IPoIB: ibX: failed to create mcg debug file
	IB/mlx4: Fix ib device initialization error flow
	IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level
	ext4: evict inline data when writing to memory map
	fs/xattr.c: zero out memory copied to userspace in getxattr
	ceph: fix memory leak in __ceph_setxattr()
	fs/block_dev: always invalidate cleancache in invalidate_bdev()
	Set unicode flag on cifs echo request to avoid Mac error
	SMB3: Work around mount failure when using SMB3 dialect to Macs
	CIFS: fix mapping of SFM_SPACE and SFM_PERIOD
	cifs: fix CIFS_IOC_GET_MNT_INFO oops
	CIFS: add misssing SFM mapping for doublequote
	padata: free correct variable
	arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses
	serial: samsung: Use right device for DMA-mapping calls
	serial: omap: fix runtime-pm handling on unbind
	serial: omap: suspend device on probe errors
	tty: pty: Fix ldisc flush after userspace become aware of the data already
	Bluetooth: Fix user channel for 32bit userspace on 64bit kernel
	Bluetooth: hci_bcm: add missing tty-device sanity check
	Bluetooth: hci_intel: add missing tty-device sanity check
	mac80211: pass RX aggregation window size to driver
	mac80211: pass block ack session timeout to to driver
	mac80211: RX BA support for sta max_rx_aggregation_subframes
	wlcore: Pass win_size taken from ieee80211_sta to FW
	wlcore: Add RX_BA_WIN_SIZE_CHANGE_EVENT event
	ipmi: Fix kernel panic at ipmi_ssif_thread()
	Linux 4.4.69

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

9 files changed, 39 insertions, 12 deletions

diff --git a/fs/block_dev.c b/fs/block_dev.c
index e5733bb537c9..26bbaaefdff4 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -88,12 +88,11 @@ void invalidate_bdev(struct block_device *bdev)
 {
 	struct address_space *mapping = bdev->bd_inode->i_mapping;
 
-	if (mapping->nrpages == 0)
-		return;
-
-	invalidate_bh_lrus();
-	lru_add_drain_all();	/* make sure all lru add caches are flushed */
-	invalidate_mapping_pages(mapping, 0, -1);
+	if (mapping->nrpages) {
+		invalidate_bh_lrus();
+		lru_add_drain_all();	/* make sure all lru add caches are flushed */
+		invalidate_mapping_pages(mapping, 0, -1);
+	}
 	/* 99% of the time, we don't need to flush the cleancache on the bdev.
 	 * But, for the strange corners, lets be cautious
 	 */
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index 819163d8313b..b24275ef97f7 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -369,6 +369,7 @@ static int __set_xattr(struct ceph_inode_info *ci,
 
 	if (update_xattr) {
 		int err = 0;
+
 		if (xattr && (flags & XATTR_CREATE))
 			err = -EEXIST;
 		else if (!xattr && (flags & XATTR_REPLACE))
@@ -376,12 +377,14 @@ static int __set_xattr(struct ceph_inode_info *ci,
 		if (err) {
 			kfree(name);
 			kfree(val);
+			kfree(*newxattr);
 			return err;
 		}
 		if (update_xattr < 0) {
 			if (xattr)
 				__remove_xattr(ci, xattr);
 			kfree(name);
+			kfree(*newxattr);
 			return 0;
 		}
 	}
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 02b071bf3732..a0b3e7d1be48 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -83,6 +83,9 @@ convert_sfm_char(const __u16 src_char, char *target)
 	case SFM_COLON:
 		*target = ':';
 		break;
+	case SFM_DOUBLEQUOTE:
+		*target = '"';
+		break;
 	case SFM_ASTERISK:
 		*target = '*';
 		break;
@@ -418,6 +421,9 @@ static __le16 convert_to_sfm_char(char src_char, bool end_of_string)
 	case ':':
 		dest_char = cpu_to_le16(SFM_COLON);
 		break;
+	case '"':
+		dest_char = cpu_to_le16(SFM_DOUBLEQUOTE);
+		break;
 	case '*':
 		dest_char = cpu_to_le16(SFM_ASTERISK);
 		break;
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 479bc0a941f3..07ade707fa60 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -57,6 +57,7 @@
  * not conflict (although almost does) with the mapping above.
  */
 
+#define SFM_DOUBLEQUOTE ((__u16) 0xF020)
 #define SFM_ASTERISK    ((__u16) 0xF021)
 #define SFM_QUESTION    ((__u16) 0xF025)
 #define SFM_COLON       ((__u16) 0xF022)
@@ -64,8 +65,8 @@
 #define SFM_LESSTHAN    ((__u16) 0xF023)
 #define SFM_PIPE        ((__u16) 0xF027)
 #define SFM_SLASH       ((__u16) 0xF026)
-#define SFM_PERIOD	((__u16) 0xF028)
-#define SFM_SPACE	((__u16) 0xF029)
+#define SFM_SPACE	((__u16) 0xF028)
+#define SFM_PERIOD	((__u16) 0xF029)
 
 /*
  * Mapping mechanism to use when one of the seven reserved characters is
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5e2f8b8ca08a..b60150e5b5ce 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -717,6 +717,9 @@ CIFSSMBEcho(struct TCP_Server_Info *server)
 	if (rc)
 		return rc;
 
+	if (server->capabilities & CAP_UNICODE)
+		smb->hdr.Flags2 |= SMBFLG2_UNICODE;
+
 	/* set up echo request */
 	smb->hdr.Tid = 0xffff;
 	smb->hdr.WordCount = 1;
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 35cf990f87d3..a8f5b31636dc 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -272,6 +272,8 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
 				rc = -EOPNOTSUPP;
 			break;
 		case CIFS_IOC_GET_MNT_INFO:
+			if (pSMBFile == NULL)
+				break;
 			tcon = tlink_tcon(pSMBFile->tlink);
 			rc = smb_mnt_get_fsinfo(xid, tcon, (void __user *)arg);
 			break;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 6cb2603f8a5c..f4afa3b1cc56 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -564,8 +564,12 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
 	}
 
 	if (rsplen != sizeof(struct validate_negotiate_info_rsp)) {
-		cifs_dbg(VFS, "invalid size of protocol negotiate response\n");
-		return -EIO;
+		cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n",
+			 rsplen);
+
+		/* relax check since Mac returns max bufsize allowed on ioctl */
+		if (rsplen > CIFSMaxBufSize)
+			return -EIO;
 	}
 
 	/* check validate negotiate info response matches what we got earlier */
@@ -1518,8 +1522,12 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
 	 * than one credit. Windows typically sets this smaller, but for some
 	 * ioctls it may be useful to allow server to send more. No point
 	 * limiting what the server can send as long as fits in one credit
+	 * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
+	 * (by default, note that it can be overridden to make max larger)
+	 * in responses (except for read responses which can be bigger.
+	 * We may want to bump this limit up
 	 */
-	req->MaxOutputResponse = cpu_to_le32(0xFF00); /* < 64K uses 1 credit */
+	req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
 
 	if (is_fsctl)
 		req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 8f917150ca69..41576cda7fed 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5447,6 +5447,11 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
 	file_update_time(vma->vm_file);
 
 	down_read(&EXT4_I(inode)->i_mmap_sem);
+
+	ret = ext4_convert_inline_data(inode);
+	if (ret)
+		goto out_ret;
+
 	/* Delalloc case is easy... */
 	if (test_opt(inode->i_sb, DELALLOC) &&
 	    !ext4_should_journal_data(inode) &&
diff --git a/fs/xattr.c b/fs/xattr.c
index 9b932b95d74e..f0da9d24e9ca 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -442,7 +442,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
 			size = XATTR_SIZE_MAX;
 		kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
 		if (!kvalue) {
-			vvalue = vmalloc(size);
+			vvalue = vzalloc(size);
 			if (!vvalue)
 				return -ENOMEM;
 			kvalue = vvalue;