Merge 4.4.285 into android-4.4-p

Changes in 4.4.285
	s390/bpf: Fix optimizing out zero-extensions
	PM / wakeirq: Fix unbalanced IRQ enable for wakeirq
	sctp: validate chunk size in __rcv_asconf_lookup
	sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
	thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
	9p/trans_virtio: Remove sysfs file on probe failure
	prctl: allow to setup brk for et_dyn executables
	profiling: fix shift-out-of-bounds bugs
	dmaengine: acpi-dma: check for 64-bit MMIO address
	dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
	parisc: Move pci_dev_is_behind_card_dino to where it is used
	dmaengine: ioat: depends on !UML
	ceph: lockdep annotations for try_nonblocking_invalidate
	nilfs2: fix memory leak in nilfs_sysfs_create_device_group
	nilfs2: fix NULL pointer in nilfs_##name##_attr_release
	nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
	nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
	nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
	nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
	blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
	drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV
	sctp: validate from_addr_param return
	Linux 4.4.285

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I10ef4f8fa6f8c53aaedfa2e6c5212b1faecad1b4

2 files changed, 11 insertions, 17 deletions

diff --git a/kernel/profile.c b/kernel/profile.c
index 9cd8e18e6f18..927a0345e259 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -38,7 +38,8 @@ struct profile_hit {
 #define NR_PROFILE_GRP		(NR_PROFILE_HIT/PROFILE_GRPSZ)
 
 static atomic_t *prof_buffer;
-static unsigned long prof_len, prof_shift;
+static unsigned long prof_len;
+static unsigned short int prof_shift;
 
 int prof_on __read_mostly;
 EXPORT_SYMBOL_GPL(prof_on);
@@ -63,8 +64,8 @@ int profile_setup(char *str)
 		if (str[strlen(sleepstr)] == ',')
 			str += strlen(sleepstr) + 1;
 		if (get_option(&str, &par))
-			prof_shift = par;
-		pr_info("kernel sleep profiling enabled (shift: %ld)\n",
+			prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+		pr_info("kernel sleep profiling enabled (shift: %u)\n",
 			prof_shift);
 #else
 		pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n");
@@ -74,21 +75,21 @@ int profile_setup(char *str)
 		if (str[strlen(schedstr)] == ',')
 			str += strlen(schedstr) + 1;
 		if (get_option(&str, &par))
-			prof_shift = par;
-		pr_info("kernel schedule profiling enabled (shift: %ld)\n",
+			prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+		pr_info("kernel schedule profiling enabled (shift: %u)\n",
 			prof_shift);
 	} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
 		prof_on = KVM_PROFILING;
 		if (str[strlen(kvmstr)] == ',')
 			str += strlen(kvmstr) + 1;
 		if (get_option(&str, &par))
-			prof_shift = par;
-		pr_info("kernel KVM profiling enabled (shift: %ld)\n",
+			prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+		pr_info("kernel KVM profiling enabled (shift: %u)\n",
 			prof_shift);
 	} else if (get_option(&str, &par)) {
-		prof_shift = par;
+		prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
 		prof_on = CPU_PROFILING;
-		pr_info("kernel profiling enabled (shift: %ld)\n",
+		pr_info("kernel profiling enabled (shift: %u)\n",
 			prof_shift);
 	}
 	return 1;
@@ -475,7 +476,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 	unsigned long p = *ppos;
 	ssize_t read;
 	char *pnt;
-	unsigned int sample_step = 1 << prof_shift;
+	unsigned long sample_step = 1UL << prof_shift;
 
 	profile_flip_buffers();
 	if (p >= (prof_len+1)*sizeof(unsigned int))
diff --git a/kernel/sys.c b/kernel/sys.c
index 5a40f5c07054..d5ea3360038c 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1777,13 +1777,6 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
 	error = -EINVAL;
 
 	/*
-	 * @brk should be after @end_data in traditional maps.
-	 */
-	if (prctl_map->start_brk <= prctl_map->end_data ||
-	    prctl_map->brk <= prctl_map->end_data)
-		goto out;
-
-	/*
 	 * Neither we should allow to override limits if they set.
 	 */
 	if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map->brk,