Merge android-4.4@64a73ff (v4.4.76) into msm-4.4

* refs/heads/tmp-64a73ff:
  Linux 4.4.76
  KVM: nVMX: Fix exception injection
  KVM: x86: zero base3 of unusable segments
  KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh()
  KVM: x86: fix emulation of RSM and IRET instructions
  cpufreq: s3c2416: double free on driver init error path
  iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid()
  iommu: Handle default domain attach failure
  iommu/vt-d: Don't over-free page table directories
  ocfs2: o2hb: revert hb threshold to keep compatible
  x86/mm: Fix flush_tlb_page() on Xen
  x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space
  ARM: 8685/1: ensure memblock-limit is pmd-aligned
  ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation
  sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting
  watchdog: bcm281xx: Fix use of uninitialized spinlock.
  xfrm: Oops on error in pfkey_msg2xfrm_state()
  xfrm: NULL dereference on allocation failure
  xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
  jump label: fix passing kbuild_cflags when checking for asm goto support
  ravb: Fix use-after-free on `ifconfig eth0 down`
  sctp: check af before verify address in sctp_addr_id2transport
  net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV
  perf probe: Fix to show correct locations for events on modules
  be2net: fix status check in be_cmd_pmac_add()
  s390/ctl_reg: make __ctl_load a full memory barrier
  swiotlb: ensure that page-sized mappings are page-aligned
  coredump: Ensure proper size of sparse core files
  x86/mpx: Use compatible types in comparison to fix sparse error
  mac80211: initialize SMPS field in HT capabilities
  spi: davinci: use dma_mapping_error()
  scsi: lpfc: avoid double free of resource identifiers
  HID: i2c-hid: Add sleep between POWER ON and RESET
  kernel/panic.c: add missing \n
  ibmveth: Add a proper check for the availability of the checksum features
  vxlan: do not age static remote mac entries
  virtio_net: fix PAGE_SIZE > 64k
  vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null
  drm/amdgpu: check ring being ready before using
  net: dsa: Check return value of phy_connect_direct()
  amd-xgbe: Check xgbe_init() return code
  platform/x86: ideapad-laptop: handle ACPI event 1
  scsi: virtio_scsi: Reject commands when virtqueue is broken
  xen-netfront: Fix Rx stall during network stress and OOM
  swiotlb-xen: update dev_addr after swapping pages
  virtio_console: fix a crash in config_work_handler
  Btrfs: fix truncate down when no_holes feature is enabled
  gianfar: Do not reuse pages from emergency reserve
  powerpc/eeh: Enable IO path on permanent error
  net: bgmac: Remove superflous netif_carrier_on()
  net: bgmac: Start transmit queue in bgmac_open
  net: bgmac: Fix SOF bit checking
  bgmac: Fix reversed test of build_skb() return value.
  mtd: bcm47xxpart: don't fail because of bit-flips
  bgmac: fix a missing check for build_skb
  mtd: bcm47xxpart: limit scanned flash area on BCM47XX (MIPS) only
  MIPS: ralink: fix MT7628 wled_an pinmux gpio
  MIPS: ralink: fix MT7628 pinmux typos
  MIPS: ralink: Fix invalid assignment of SoC type
  MIPS: ralink: fix USB frequency scaling
  MIPS: ralink: MT7688 pinmux fixes
  net: korina: Fix NAPI versus resources freeing
  MIPS: ath79: fix regression in PCI window initialization
  net: mvneta: Fix for_each_present_cpu usage
  ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags
  qla2xxx: Fix erroneous invalid handle message
  scsi: lpfc: Set elsiocb contexts to NULL after freeing it
  scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
  KVM: x86: fix fixing of hypercalls
  mm: numa: avoid waiting on freed migrated pages
  block: fix module reference leak on put_disk() call for cgroups throttle
  sysctl: enable strict writes
  usb: gadget: f_fs: Fix possibe deadlock
  drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr
  ALSA: hda - set input_path bitmap to zero after moving it to new place
  ALSA: hda - Fix endless loop of codec configure
  MIPS: Fix IRQ tracing & lockdep when rescheduling
  MIPS: pm-cps: Drop manual cache-line alignment of ready_count
  MIPS: Avoid accidental raw backtrace
  mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff()
  drm/ast: Handle configuration without P2A bridge
  NFSv4: fix a reference leak caused WARNING messages
  netfilter: synproxy: fix conntrackd interaction
  netfilter: xt_TCPMSS: add more sanity tests on tcph->doff
  rtnetlink: add IFLA_GROUP to ifla_policy
  ipv6: Do not leak throw route references
  sfc: provide dummy definitions of vswitch functions
  net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev
  decnet: always not take dst->__refcnt when inserting dst into hash table
  net/mlx5: Wait for FW readiness before initializing command interface
  ipv6: fix calling in6_ifa_hold incorrectly for dad work
  igmp: add a missing spin_lock_init()
  igmp: acquire pmc lock for ip_mc_clear_src()
  net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx
  Fix an intermittent pr_emerg warning about lo becoming free.
  af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers
  net: Zero ifla_vf_info in rtnl_fill_vfinfo()
  decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb
  net: don't call strlen on non-terminated string in dev_set_alias()
  ipv6: release dst on error in ip6_dst_lookup_tail
  UPSTREAM: selinux: enable genfscon labeling for tracefs

Change-Id: I05ae1d6271769a99ea3817e5066f5ab6511f3254
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

1 files changed, 6 insertions, 1 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 1f5d18d80fba..decd8b8d751f 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -997,7 +997,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 	struct path path = { NULL, NULL };
 
 	err = -EINVAL;
-	if (sunaddr->sun_family != AF_UNIX)
+	if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
+	    sunaddr->sun_family != AF_UNIX)
 		goto out;
 
 	if (addr_len == sizeof(short)) {
@@ -1108,6 +1109,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
 	unsigned int hash;
 	int err;
 
+	err = -EINVAL;
+	if (alen < offsetofend(struct sockaddr, sa_family))
+		goto out;
+
 	if (addr->sa_family != AF_UNSPEC) {
 		err = unix_mkname(sunaddr, alen, &hash);
 		if (err < 0)