Merge tag v4.4.55 into branch 'msm-4.4'

refs/heads/tmp-28ec98b:
  Linux 4.4.55
  ext4: don't BUG when truncating encrypted inodes on the orphan list
  dm: flush queued bios when process blocks to avoid deadlock
  nfit, libnvdimm: fix interleave set cookie calculation
  s390/kdump: Use "LINUX" ELF note name instead of "CORE"
  KVM: s390: Fix guest migration for huge guests resulting in panic
  mvsas: fix misleading indentation
  serial: samsung: Continue to work if DMA request fails
  USB: serial: io_ti: fix information leak in completion handler
  USB: serial: io_ti: fix NULL-deref in interrupt callback
  USB: iowarrior: fix NULL-deref in write
  USB: iowarrior: fix NULL-deref at probe
  USB: serial: omninet: fix reference leaks at open
  USB: serial: safe_serial: fix information leak in completion handler
  usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers
  usb: host: xhci-dbg: HCIVERSION should be a binary number
  usb: gadget: function: f_fs: pass companion descriptor along
  usb: dwc3: gadget: make Set Endpoint Configuration macros safe
  usb: gadget: dummy_hcd: clear usb_gadget region before registration
  powerpc: Emulation support for load/store instructions on LE
  tracing: Add #undef to fix compile error
  MIPS: Netlogic: Fix CP0_EBASE redefinition warnings
  MIPS: DEC: Avoid la pseudo-instruction in delay slots
  mm: memcontrol: avoid unused function warning
  cpmac: remove hopeless #warning
  MIPS: ralink: Remove unused rt*_wdt_reset functions
  MIPS: ralink: Cosmetic change to prom_init().
  mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy
  MIPS: Update lemote2f_defconfig for CPU_FREQ_STAT change
  MIPS: ip22: Fix ip28 build for modern gcc
  MIPS: Update ip27_defconfig for SCSI_DH change
  MIPS: ip27: Disable qlge driver in defconfig
  MIPS: Update defconfigs for NF_CT_PROTO_DCCP/UDPLITE change
  crypto: improve gcc optimization flags for serpent and wp512
  USB: serial: digi_acceleport: fix OOB-event processing
  USB: serial: digi_acceleport: fix OOB data sanity check
  Linux 4.4.54
  drivers: hv: Turn off write permission on the hypercall page
  fat: fix using uninitialized fields of fat_inode/fsinfo_inode
  libceph: use BUG() instead of BUG_ON(1)
  drm/i915/dsi: Do not clear DPOUNIT_CLOCK_GATE_DISABLE from vlv_init_display_clock_gating
  fakelb: fix schedule while atomic
  drm/atomic: fix an error code in mode_fixup()
  drm/ttm: Make sure BOs being swapped out are cacheable
  drm/edid: Add EDID_QUIRK_FORCE_8BPC quirk for Rotel RSX-1058
  drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS
  drm/ast: Call open_key before enable_mmio in POST code
  drm/ast: Fix test for VGA enabled
  drm/amdgpu: add more cases to DCE11 possible crtc mask setup
  mac80211: flush delayed work when entering suspend
  xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD
  pwm: pca9685: Fix period change with same duty cycle
  nlm: Ensure callback code also checks that the files match
  target: Fix NULL dereference during LUN lookup + active I/O shutdown
  ceph: remove req from unsafe list when unregistering it
  ktest: Fix child exit code processing
  IB/srp: Fix race conditions related to task management
  IB/srp: Avoid that duplicate responses trigger a kernel bug
  IB/IPoIB: Add destination address when re-queue packet
  IB/ipoib: Fix deadlock between rmmod and set_mode
  mnt: Tuck mounts under others instead of creating shadow/side mounts.
  net: mvpp2: fix DMA address calculation in mvpp2_txq_inc_put()
  s390: use correct input data address for setup_randomness
  s390: make setup_randomness work
  s390: TASK_SIZE for kernel threads
  s390/dcssblk: fix device size calculation in dcssblk_direct_access()
  s390/qdio: clear DSCI prior to scanning multiple input queues
  Bluetooth: Add another AR3012 04ca:3018 device
  KVM: VMX: use correct vmcs_read/write for guest segment selector/base
  KVM: s390: Disable dirty log retrieval for UCONTROL guests
  serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards
  tty: n_hdlc: get rid of racy n_hdlc.tbuf
  TTY: n_hdlc, fix lockdep false positive
  Linux 4.4.53
  scsi: lpfc: Correct WQ creation for pagesize
  MIPS: IP22: Fix build error due to binutils 2.25 uselessnes.
  MIPS: IP22: Reformat inline assembler code to modern standards.
  powerpc/xmon: Fix data-breakpoint
  dmaengine: ipu: Make sure the interrupt routine checks all interrupts.
  bcma: use (get|put)_device when probing/removing device driver
  md linear: fix a race between linear_add() and linear_congested()
  rtc: sun6i: Switch to the external oscillator
  rtc: sun6i: Add some locking
  NFSv4: fix getacl ERANGE for some ACL buffer sizes
  NFSv4: fix getacl head length estimation
  NFSv4: Fix memory and state leak in _nfs4_open_and_get_state
  nfsd: special case truncates some more
  nfsd: minor nfsd_setattr cleanup
  rtlwifi: rtl8192c-common: Fix "BUG: KASAN:
  rtlwifi: Fix alignment issues
  gfs2: Add missing rcu locking for glock lookup
  rdma_cm: fail iwarp accepts w/o connection params
  RDMA/core: Fix incorrect structure packing for booleans
  Drivers: hv: util: Backup: Fix a rescind processing issue
  Drivers: hv: util: Fcopy: Fix a rescind processing issue
  Drivers: hv: util: kvp: Fix a rescind processing issue
  hv: init percpu_list in hv_synic_alloc()
  hv: allocate synic pages for all present CPUs
  usb: gadget: udc: fsl: Add missing complete function.
  usb: host: xhci: plat: check hcc_params after add hcd
  usb: musb: da8xx: Remove CPPI 3.0 quirk and methods
  w1: ds2490: USB transfer buffers need to be DMAable
  w1: don't leak refcount on slave attach failure in w1_attach_slave_device()
  can: usb_8dev: Fix memory leak of priv->cmd_msg_buffer
  iio: pressure: mpl3115: do not rely on structure field ordering
  iio: pressure: mpl115: do not rely on structure field ordering
  arm/arm64: KVM: Enforce unconditional flush to PoC when mapping to stage-2
  fuse: add missing FR_FORCE
  crypto: testmgr - Pad aes_ccm_enc_tv_template vector
  ath9k: use correct OTP register offsets for the AR9340 and AR9550
  ath9k: fix race condition in enabling/disabling IRQs
  ath5k: drop bogus warning on drv_set_key with unsupported cipher
  target: Fix multi-session dynamic se_node_acl double free OOPs
  target: Obtain se_node_acl->acl_kref during get_initiator_node_acl
  samples/seccomp: fix 64-bit comparison macros
  ext4: return EROFS if device is r/o and journal replay is needed
  ext4: preserve the needs_recovery flag when the journal is aborted
  ext4: fix inline data error paths
  ext4: fix data corruption in data=journal mode
  ext4: trim allocation requests to group size
  ext4: do not polute the extents cache while shifting extents
  ext4: Include forgotten start block on fallocate insert range
  loop: fix LO_FLAGS_PARTSCAN hang
  block/loop: fix race between I/O and set_status
  jbd2: don't leak modified metadata buffers on an aborted journal
  Fix: Disable sys_membarrier when nohz_full is enabled
  sd: get disk reference in sd_check_events()
  scsi: use 'scsi_device_from_queue()' for scsi_dh
  scsi: aacraid: Reorder Adapter status check
  scsi: storvsc: properly set residual data length on errors
  scsi: storvsc: properly handle SRB_ERROR when sense message is present
  scsi: storvsc: use tagged SRB requests if supported by the device
  dm stats: fix a leaked s->histogram_boundaries array
  dm cache: fix corruption seen when using cache > 2TB
  ipc/shm: Fix shmat mmap nil-page protection
  mm: do not access page->mapping directly on page_endio
  mm: vmpressure: fix sending wrong events on underflow
  mm/page_alloc: fix nodes for reclaim in fast path
  iommu/vt-d: Tylersburg isoch identity map check is done too late.
  iommu/vt-d: Fix some macros that are incorrectly specified in intel-iommu
  regulator: Fix regulator_summary for deviceless consumers
  staging: rtl: fix possible NULL pointer dereference
  ALSA: hda - Fix micmute hotkey problem for a lenovo AIO machine
  ALSA: hda - Add subwoofer support for Dell Inspiron 17 7000 Gaming
  ALSA: seq: Fix link corruption by event error handling
  ALSA: ctxfi: Fallback DMA mask to 32bit
  ALSA: timer: Reject user params with too small ticks
  ALSA: hda - fix Lewisburg audio issue
  ALSA: hda/realtek - Cannot adjust speaker's volume on a Dell AIO
  ARM: dts: at91: Enable DMA on sama5d2_xplained console
  ARM: dts: at91: Enable DMA on sama5d4_xplained console
  ARM: at91: define LPDDR types
  media: fix dm1105.c build error
  uvcvideo: Fix a wrong macro
  am437x-vpfe: always assign bpp variable
  MIPS: Handle microMIPS jumps in the same way as MIPS32/MIPS64 jumps
  MIPS: Calculate microMIPS ra properly when unwinding the stack
  MIPS: Fix is_jump_ins() handling of 16b microMIPS instructions
  MIPS: Fix get_frame_info() handling of microMIPS function size
  MIPS: Prevent unaligned accesses during stack unwinding
  MIPS: Clear ISA bit correctly in get_frame_info()
  MIPS: Lantiq: Keep ethernet enabled during boot
  MIPS: OCTEON: Fix copy_from_user fault handling for large buffers
  MIPS: BCM47XX: Fix button inversion for Asus WL-500W
  MIPS: Fix special case in 64 bit IP checksumming.
  samples: move mic/mpssd example code from Documentation
  Linux 4.4.52
  kvm: vmx: ensure VMCS is current while enabling PML
  Revert "usb: chipidea: imx: enable CI_HDRC_SET_NON_ZERO_TTHA"
  rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down
  block: fix double-free in the failure path of cgwb_bdi_init()
  goldfish: Sanitize the broken interrupt handler
  x86/platform/goldfish: Prevent unconditional loading
  USB: serial: ark3116: fix register-accessor error handling
  USB: serial: opticon: fix CTS retrieval at open
  USB: serial: spcp8x5: fix modem-status handling
  USB: serial: ftdi_sio: fix line-status over-reporting
  USB: serial: ftdi_sio: fix extreme low-latency setting
  USB: serial: ftdi_sio: fix modem-status error handling
  USB: serial: cp210x: add new IDs for GE Bx50v3 boards
  USB: serial: mos7840: fix another NULL-deref at open
  tty: serial: msm: Fix module autoload
  net: socket: fix recvmmsg not returning error from sock_error
  ip: fix IP_CHECKSUM handling
  irda: Fix lockdep annotations in hashbin_delete().
  dccp: fix freeing skb too early for IPV6_RECVPKTINFO
  packet: Do not call fanout_release from atomic contexts
  packet: fix races in fanout_add()
  net/llc: avoid BUG_ON() in skb_orphan()
  blk-mq: really fix plug list flushing for nomerge queues
  rtc: interface: ignore expired timers when enqueuing new timers
  rtlwifi: rtl_usb: Fix missing entry in USB driver's private data
  Linux 4.4.51
  mmc: core: fix multi-bit bus width without high-speed mode
  bcache: Make gc wakeup sane, remove set_task_state()
  ntb_transport: Pick an unused queue
  NTB: ntb_transport: fix debugfs_remove_recursive
  printk: use rcuidle console tracepoint
  ARM: 8658/1: uaccess: fix zeroing of 64-bit get_user()
  futex: Move futex_init() to core_initcall
  drm/dp/mst: fix kernel oops when turning off secondary monitor
  drm/radeon: Use mode h/vdisplay fields to hide out of bounds HW cursor
  Input: elan_i2c - add ELAN0605 to the ACPI table
  Fix missing sanity check in /dev/sg
  scsi: don't BUG_ON() empty DMA transfers
  fuse: fix use after free issue in fuse_dev_do_read()
  siano: make it work again with CONFIG_VMAP_STACK
  vfs: fix uninitialized flags in splice_to_pipe()
  Linux 4.4.50
  l2tp: do not use udp_ioctl()
  ping: fix a null pointer dereference
  packet: round up linear to header len
  net: introduce device min_header_len
  sit: fix a double free on error path
  sctp: avoid BUG_ON on sctp_wait_for_sndbuf
  mlx4: Invoke softirqs after napi_reschedule
  macvtap: read vnet_hdr_size once
  tun: read vnet_hdr_sz once
  tcp: avoid infinite loop in tcp_splice_read()
  ipv6: tcp: add a missing tcp_v6_restore_cb()
  ip6_gre: fix ip6gre_err() invalid reads
  netlabel: out of bound access in cipso_v4_validate()
  ipv4: keep skb->dst around in presence of IP options
  net: use a work queue to defer net_disable_timestamp() work
  tcp: fix 0 divide in __tcp_select_window()
  ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
  ipv6: fix ip6_tnl_parse_tlv_enc_lim()
  can: Fix kernel panic at security_sock_rcv_skb

Conflicts:
	drivers/scsi/sd.c
	drivers/usb/gadget/function/f_fs.c
	drivers/usb/host/xhci-plat.c

CRs-Fixed: 2023471
Change-Id: I396051a8de30271af77b3890d4b19787faa1c31e
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

1 files changed, 9 insertions, 4 deletions

diff --git a/ipc/shm.c b/ipc/shm.c
index 88a6f1e78066..09267be8d27b 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1083,8 +1083,8 @@ out_unlock1:
  * "raddr" thing points to kernel space, and there has to be a wrapper around
  * this.
  */
-long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
-	      unsigned long shmlba)
+long do_shmat(int shmid, char __user *shmaddr, int shmflg,
+	      ulong *raddr, unsigned long shmlba)
 {
 	struct shmid_kernel *shp;
 	unsigned long addr;
@@ -1105,8 +1105,13 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
 		goto out;
 	else if ((addr = (ulong)shmaddr)) {
 		if (addr & (shmlba - 1)) {
-			if (shmflg & SHM_RND)
-				addr &= ~(shmlba - 1);	   /* round down */
+			/*
+			 * Round down to the nearest multiple of shmlba.
+			 * For sane do_mmap_pgoff() parameters, avoid
+			 * round downs that trigger nil-page and MAP_FIXED.
+			 */
+			if ((shmflg & SHM_RND) && addr >= shmlba)
+				addr &= ~(shmlba - 1);
 			else
 #ifndef __ARCH_FORCE_SHMLBA
 				if (addr & ~PAGE_MASK)