Merge remote-tracking branch 'common/android-4.4-p' into lineage-18.1-caf-msm8998

* common/android-4.4-p:
  Linux 4.4.293
  usb: max-3421: Use driver data instead of maintaining a list of bound devices
  ASoC: DAPM: Cover regression by kctl change notification fix
  batman-adv: Avoid WARN_ON timing related checks
  batman-adv: Don't always reallocate the fragmentation skb head
  batman-adv: Reserve needed_*room for fragments
  batman-adv: Consider fragmentation for needed_headroom
  batman-adv: set .owner to THIS_MODULE
  batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh
  batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh
  batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN
  batman-adv: Prevent duplicated softif_vlan entry
  batman-adv: Fix multicast TT issues with bogus ROAM flags
  batman-adv: Keep fragments equally sized
  drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors
  drm/udl: fix control-message timeout
  cfg80211: call cfg80211_stop_ap when switch from P2P_GO type
  parisc/sticon: fix reverse colors
  btrfs: fix memory ordering between normal and ordered work functions
  mm: kmemleak: slob: respect SLAB_NOLEAKTRACE flag
  hexagon: export raw I/O routines for modules
  tun: fix bonding active backup with arp monitoring
  NFC: reorder the logic in nfc_{un,}register_device
  NFC: reorganize the functions in nci_request
  platform/x86: hp_accel: Fix an error handling path in 'lis3lv02d_probe()'
  mips: bcm63xx: add support for clk_get_parent()
  net: bnx2x: fix variable dereferenced before check
  sched/core: Mitigate race cpus_share_cache()/update_top_cache_domain()
  mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set
  sh: define __BIG_ENDIAN for math-emu
  sh: fix kconfig unmet dependency warning for FRAME_POINTER
  maple: fix wrong return value of maple_bus_init().
  sh: check return code of request_irq
  powerpc/dcr: Use cmplwi instead of 3-argument cmpli
  ALSA: gus: fix null pointer dereference on pointer block
  powerpc/5200: dts: fix memory node unit name
  scsi: target: Fix alua_tg_pt_gps_count tracking
  scsi: target: Fix ordered tag handling
  MIPS: sni: Fix the build
  tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
  usb: host: ohci-tmio: check return value after calling platform_get_resource()
  ARM: dts: omap: fix gpmc,mux-add-data type
  scsi: advansys: Fix kernel pointer leak
  usb: musb: tusb6010: check return value after calling platform_get_resource()
  scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
  net: batman-adv: fix error handling
  PCI/MSI: Destroy sysfs before freeing entries
  parisc/entry: fix trace test in syscall exit path
  PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
  mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks
  ARM: 9156/1: drop cc-option fallbacks for architecture selection
  USB: chipidea: fix interrupt deadlock
  vsock: prevent unnecessary refcnt inc for nonblocking connect
  nfc: pn533: Fix double free when pn533_fill_fragment_skbs() fails
  llc: fix out-of-bound array index in llc_sk_dev_hash()
  bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed
  net: davinci_emac: Fix interrupt pacing disable
  xen-pciback: Fix return in pm_ctrl_init()
  scsi: qla2xxx: Turn off target reset during issue_lip
  watchdog: f71808e_wdt: fix inaccurate report in WDIOC_GETTIMEOUT
  m68k: set a default value for MEMORY_RESERVE
  netfilter: nfnetlink_queue: fix OOB when mac header was cleared
  dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro
  RDMA/mlx4: Return missed an error if device doesn't support steering
  scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
  power: supply: rt5033_battery: Change voltage values to µV
  usb: gadget: hid: fix error code in do_config()
  serial: 8250_dw: Drop wrong use of ACPI_PTR()
  video: fbdev: chipsfb: use memset_io() instead of memset()
  memory: fsl_ifc: fix leak of irq and nand_irq in fsl_ifc_ctrl_probe
  JFS: fix memleak in jfs_mount
  scsi: dc395: Fix error case unwinding
  ARM: s3c: irq-s3c24xx: Fix return value check for s3c24xx_init_intc()
  crypto: pcrypt - Delay write to padata->info
  libertas: Fix possible memory leak in probe and disconnect
  libertas_tf: Fix possible memory leak in probe and disconnect
  smackfs: use netlbl_cfg_cipsov4_del() for deleting cipso_v4_doi
  mwifiex: Send DELBA requests according to spec
  platform/x86: thinkpad_acpi: Fix bitwise vs. logical warning
  net: stream: don't purge sk_error_queue in sk_stream_kill_queues()
  drm/msm: uninitialized variable in msm_gem_import()
  memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()
  memstick: avoid out-of-range warning
  b43: fix a lower bounds test
  b43legacy: fix a lower bounds test
  crypto: qat - detect PFVF collision after ACK
  ath9k: Fix potential interrupt storm on queue reset
  cpuidle: Fix kobject memory leaks in error paths
  media: si470x: Avoid card name truncation
  media: dvb-usb: fix ununit-value in az6027_rc_query
  parisc/kgdb: add kgdb_roundup() to make kgdb work with idle polling
  parisc: fix warning in flush_tlb_all
  ARM: 9136/1: ARMv7-M uses BE-8, not BE-32
  ARM: clang: Do not rely on lr register for stacktrace
  smackfs: use __GFP_NOFAIL for smk_cipso_doi()
  iwlwifi: mvm: disable RX-diversity in powersave
  PM: hibernate: Get block device exclusively in swsusp_check()
  mwl8k: Fix use-after-free in mwl8k_fw_state_machine()
  lib/xz: Validate the value before assigning it to an enum variable
  lib/xz: Avoid overlapping memcpy() with invalid input with in-place decompression
  memstick: r592: Fix a UAF bug when removing the driver
  ACPI: battery: Accept charges over the design capacity as full
  ath: dfs_pattern_detector: Fix possible null-pointer dereference in channel_detector_create()
  tracefs: Have tracefs directories not set OTH permission bits by default
  media: usb: dvd-usb: fix uninit-value bug in dibusb_read_eeprom_byte()
  ACPICA: Avoid evaluating methods too early during system resume
  ia64: don't do IA64_CMPXCHG_DEBUG without CONFIG_PRINTK
  media: mceusb: return without resubmitting URB in case of -EPROTO error.
  media: s5p-mfc: fix possible null-pointer dereference in s5p_mfc_probe()
  media: uvcvideo: Set capability in s_param
  media: netup_unidvb: handle interrupt properly according to the firmware
  media: mt9p031: Fix corrupted frame after restarting stream
  x86: Increase exception stack sizes
  smackfs: Fix use-after-free in netlbl_catmap_walk()
  MIPS: lantiq: dma: reset correct number of channel
  MIPS: lantiq: dma: add small delay after reset
  platform/x86: wmi: do not fail if disabling fails
  Bluetooth: fix use-after-free error in lock_sock_nested()
  Bluetooth: sco: Fix lock_sock() blockage by memcpy_from_msg()
  USB: iowarrior: fix control-message timeouts
  USB: serial: keyspan: fix memleak on probe errors
  iio: dac: ad5446: Fix ad5622_write() return value
  quota: correct error number in free_dqentry()
  quota: check block number when reading the block in quota file
  ALSA: mixer: fix deadlock in snd_mixer_oss_set_volume
  ALSA: mixer: oss: Fix racy access to slots
  power: supply: max17042_battery: use VFSOC for capacity when no rsns
  power: supply: max17042_battery: Prevent int underflow in set_soc_threshold
  signal: Remove the bogus sigkill_pending in ptrace_stop
  mwifiex: Read a PCI register after writing the TX ring write pointer
  wcn36xx: Fix HT40 capability for 2Ghz band
  PCI: Mark Atheros QCA6174 to avoid bus reset
  ath6kl: fix control-message timeout
  ath6kl: fix division by zero in send path
  mwifiex: fix division by zero in fw download path
  EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
  hwmon: (pmbus/lm25066) Add offset coefficients
  btrfs: fix lost error handling when replaying directory deletes
  vmxnet3: do not stop tx queues after netif_device_detach()
  spi: spl022: fix Microwire full duplex mode
  xen/netfront: stop tx queues during live migration
  mmc: winbond: don't build on M68K
  hyperv/vmbus: include linux/bitops.h
  x86/irq: Ensure PI wakeup handler is unregistered before module unload
  ALSA: timer: Unconditionally unlink slave instances, too
  ALSA: timer: Fix use-after-free problem
  ALSA: synth: missing check for possible NULL after the call to kstrdup
  ALSA: line6: fix control and interrupt message timeouts
  ALSA: 6fire: fix control and bulk message timeouts
  ALSA: ua101: fix division by zero at probe
  media: ite-cir: IR receiver stop working after receive overflow
  parisc: Fix ptrace check on syscall return
  mmc: dw_mmc: Dont wait for DRTO on Write RSP error
  ocfs2: fix data corruption on truncate
  libata: fix read log timeout value
  Input: i8042 - Add quirk for Fujitsu Lifebook T725
  Input: elantench - fix misreporting trackpoint coordinates
  xhci: Fix USB 3.1 enumeration issues by increasing roothub power-on-good delay
  binder: use cred instead of task for selinux checks
  binder: use euid from cred instead of using task
  FROMGIT: binder: fix test regression due to sender_euid change
  BACKPORT: binder: use cred instead of task for selinux checks
  BACKPORT: binder: use euid from cred instead of using task
  BACKPORT: ip_gre: add validation for csum_start
  Linux 4.4.292
  rsi: fix control-message timeout
  staging: rtl8192u: fix control-message timeouts
  staging: r8712u: fix control-message timeout
  comedi: vmk80xx: fix bulk and interrupt message timeouts
  comedi: vmk80xx: fix bulk-buffer overflow
  comedi: vmk80xx: fix transfer-buffer overflows
  staging: comedi: drivers: replace le16_to_cpu() with usb_endpoint_maxp()
  comedi: ni_usb6501: fix NULL-deref in command paths
  comedi: dt9812: fix DMA buffers on stack
  isofs: Fix out of bound access for corrupted isofs image
  usb: hso: fix error handling code of hso_create_net_device
  printk/console: Allow to disable console output by using console="" or console=null
  usb-storage: Add compatibility quirk flags for iODD 2531/2541
  usb: gadget: Mark USB_FSL_QE broken on 64-bit
  IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
  IB/qib: Use struct_size() helper
  net: hso: register netdev later to avoid a race condition
  ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
  scsi: core: Put LLD module refcnt after SCSI device is released
  Linux 4.4.291
  sctp: add vtag check in sctp_sf_violation
  sctp: use init_tag from inithdr for ABORT chunk
  nios2: Make NIOS2_DTB_SOURCE_BOOL depend on !COMPILE_TEST
  regmap: Fix possible double-free in regcache_rbtree_exit()
  net: lan78xx: fix division by zero in send path
  mmc: sdhci: Map more voltage level to SDHCI_POWER_330
  mmc: dw_mmc: exynos: fix the finding clock sample value
  mmc: vub300: fix control-message timeouts
  Revert "net: mdiobus: Fix memory leak in __mdiobus_register"
  nfc: port100: fix using -ERRNO as command type mask
  ata: sata_mv: Fix the error handling of mv_chip_id()
  usbnet: fix error return code in usbnet_probe()
  usbnet: sanity check for maxpacket
  ARM: 8819/1: Remove '-p' from LDFLAGS
  ARM: 9139/1: kprobes: fix arch_init_kprobes() prototype
  ARM: 9134/1: remove duplicate memcpy() definition
  ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are 4B aligned
  Linux 4.4.290
  ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
  tracing: Have all levels of checks prevent recursion
  net: mdiobus: Fix memory leak in __mdiobus_register
  ALSA: hda: avoid write to STATESTS if controller is in reset
  platform/x86: intel_scu_ipc: Update timeout value in comment
  isdn: mISDN: Fix sleeping function called from invalid context
  ARM: dts: spear3xx: Fix gmac node
  netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
  isdn: cpai: check ctr->cnr to avoid array index out of bound
  nfc: nci: fix the UAF of rf_conn_info object
  ovl: fix missing negative dentry check in ovl_rename()
  ASoC: DAPM: Fix missing kctl change notifications
  ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
  elfcore: correct reference to CONFIG_UML
  ocfs2: mount fails with buffer overflow in strlen
  can: peak_pci: peak_pci_remove(): fix UAF
  can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
  can: rcar_can: fix suspend/resume
  NIOS2: irqflags: rename a redefined register name
  netfilter: ipvs: make global sysctl readonly in non-init netns
  NFSD: Keep existing listeners on portlist error
  r8152: select CRC32 and CRYPTO/CRYPTO_HASH/CRYPTO_SHA256
  drm/msm: Fix null pointer dereference on pointer edp
  pata_legacy: fix a couple uninitialized variable bugs
  NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
  NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
  nfc: fix error handling of nfc_proto_register()
  ethernet: s2io: fix setting mac address during resume
  net: encx24j600: check error in devm_regmap_init_encx24j600
  net: korina: select CRC32
  net: arc: select CRC32
  iio: ssp_sensors: fix error code in ssp_print_mcu_debug()
  iio: ssp_sensors: add more range checking in ssp_parse_dataframe()
  iio: adc128s052: Fix the error handling path of 'adc128_probe()'
  nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
  USB: serial: option: add Telit LE910Cx composition 0x1204
  USB: serial: qcserial: add EM9191 QDL support
  Input: xpad - add support for another USB ID of Nacon GC-100
  efi/cper: use stack buffer for error record decoding
  cb710: avoid NULL pointer subtraction
  xhci: Enable trust tx length quirk for Fresco FL11 USB controller
  s390: fix strrchr() implementation
  ALSA: seq: Fix a potential UAF by wrong private_free call order

 Conflicts:
	drivers/gpu/drm/msm/msm_gem.c
	net/bluetooth/l2cap_sock.c

Change-Id: Ia008e8ba419fa5604b5780265564ba80d05fbafa

3 files changed, 23 insertions, 6 deletions

diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c
index 25d59a95bd66..abea25310ac7 100644
--- a/lib/decompress_unxz.c
+++ b/lib/decompress_unxz.c
@@ -167,7 +167,7 @@
  * memeq and memzero are not used much and any remotely sane implementation
  * is fast enough. memcpy/memmove speed matters in multi-call mode, but
  * the kernel image is decompressed in single-call mode, in which only
- * memcpy speed can matter and only if there is a lot of uncompressible data
+ * memmove speed can matter and only if there is a lot of uncompressible data
  * (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the
  * functions below should just be kept small; it's probably not worth
  * optimizing for speed.
diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
index 08c3c8049998..2c5197d6b944 100644
--- a/lib/xz/xz_dec_lzma2.c
+++ b/lib/xz/xz_dec_lzma2.c
@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
 
 		*left -= copy_size;
 
-		memcpy(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
+		/*
+		 * If doing in-place decompression in single-call mode and the
+		 * uncompressed size of the file is larger than the caller
+		 * thought (i.e. it is invalid input!), the buffers below may
+		 * overlap and cause undefined behavior with memcpy().
+		 * With valid inputs memcpy() would be fine here.
+		 */
+		memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
 		dict->pos += copy_size;
 
 		if (dict->full < dict->pos)
@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
 			if (dict->pos == dict->end)
 				dict->pos = 0;
 
-			memcpy(b->out + b->out_pos, b->in + b->in_pos,
+			/*
+			 * Like above but for multi-call mode: use memmove()
+			 * to avoid undefined behavior with invalid input.
+			 */
+			memmove(b->out + b->out_pos, b->in + b->in_pos,
 					copy_size);
 		}
 
@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b)
 		if (dict->pos == dict->end)
 			dict->pos = 0;
 
+		/*
+		 * These buffers cannot overlap even if doing in-place
+		 * decompression because in multi-call mode dict->buf
+		 * has been allocated by us in this file; it's not
+		 * provided by the caller like in single-call mode.
+		 */
 		memcpy(b->out + b->out_pos, dict->buf + dict->start,
 				copy_size);
 	}
diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c
index ac809b1e64f7..9e5b9ab537fe 100644
--- a/lib/xz/xz_dec_stream.c
+++ b/lib/xz/xz_dec_stream.c
@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s)
 	 * we will accept other check types too, but then the check won't
 	 * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given.
 	 */
+	if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX)
+		return XZ_OPTIONS_ERROR;
+
 	s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1];
 
 #ifdef XZ_DEC_ANY_CHECK
-	if (s->check_type > XZ_CHECK_MAX)
-		return XZ_OPTIONS_ERROR;
-
 	if (s->check_type > XZ_CHECK_CRC32)
 		return XZ_UNSUPPORTED_CHECK;
 #else