Merge 4.4.141 into android-4.4

Changes in 4.4.141
	MIPS: Fix ioremap() RAM check
	ibmasm: don't write out of bounds in read handler
	vmw_balloon: fix inflation with batching
	ahci: Disable LPM on Lenovo 50 series laptops with a too old BIOS
	USB: serial: ch341: fix type promotion bug in ch341_control_in()
	USB: serial: cp210x: add another USB ID for Qivicon ZigBee stick
	USB: serial: keyspan_pda: fix modem-status error handling
	USB: yurex: fix out-of-bounds uaccess in read handler
	USB: serial: mos7840: fix status-register error handling
	usb: quirks: add delay quirks for Corsair Strafe
	xhci: xhci-mem: off by one in xhci_stream_id_to_ring()
	HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter
	Fix up non-directory creation in SGID directories
	tools build: fix # escaping in .cmd files for future Make
	iw_cxgb4: correctly enforce the max reg_mr depth
	x86/cpufeature: Move some of the scattered feature bits to x86_capability
	x86/cpufeature: Cleanup get_cpu_cap()
	x86/cpu: Provide a config option to disable static_cpu_has
	x86/fpu: Add an XSTATE_OP() macro
	x86/fpu: Get rid of xstate_fault()
	x86/headers: Don't include asm/processor.h in asm/atomic.h
	x86/cpufeature: Carve out X86_FEATURE_*
	x86/cpufeature: Replace the old static_cpu_has() with safe variant
	x86/cpufeature: Get rid of the non-asm goto variant
	x86/alternatives: Add an auxilary section
	x86/alternatives: Discard dynamic check after init
	x86/vdso: Use static_cpu_has()
	x86/boot: Simplify kernel load address alignment check
	x86/cpufeature: Speed up cpu_feature_enabled()
	x86/cpufeature, x86/mm/pkeys: Add protection keys related CPUID definitions
	x86/mm/pkeys: Fix mismerge of protection keys CPUID bits
	x86/cpu: Add detection of AMD RAS Capabilities
	x86/cpufeature, x86/mm/pkeys: Fix broken compile-time disabling of pkeys
	x86/cpufeature: Update cpufeaure macros
	x86/cpufeature: Make sure DISABLED/REQUIRED macros are updated
	x86/cpufeature: Add helper macro for mask check macros
	uprobes/x86: Remove incorrect WARN_ON() in uprobe_init_insn()
	netfilter: nf_queue: augment nfqa_cfg_policy
	netfilter: x_tables: initialise match/target check parameter struct
	loop: add recursion validation to LOOP_CHANGE_FD
	PM / hibernate: Fix oops at snapshot_write()
	RDMA/ucm: Mark UCM interface as BROKEN
	loop: remember whether sysfs_create_group() was done
	Linux 4.4.141

Change-Id: I777b39a0ede95b58638add97756d6beaf4a9d154
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

4 files changed, 7 insertions, 0 deletions

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 9f70c267a7a5..665fd87cc105 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -701,6 +701,8 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
 	}
 	i = 0;
 
+	memset(&mtpar, 0, sizeof(mtpar));
+	memset(&tgpar, 0, sizeof(tgpar));
 	mtpar.net	= tgpar.net       = net;
 	mtpar.table     = tgpar.table     = name;
 	mtpar.entryinfo = tgpar.entryinfo = e;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index dac62b5e7fe3..9363c1a70f16 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -663,6 +663,7 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
 		return -ENOMEM;
 
 	j = 0;
+	memset(&mtpar, 0, sizeof(mtpar));
 	mtpar.net	= net;
 	mtpar.table     = name;
 	mtpar.entryinfo = &e->ip;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 795c343347ec..6cb9e35d23ac 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -676,6 +676,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 		return -ENOMEM;
 
 	j = 0;
+	memset(&mtpar, 0, sizeof(mtpar));
 	mtpar.net	= net;
 	mtpar.table     = name;
 	mtpar.entryinfo = &e->ipv6;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 7edcfda288c4..54cde78c2718 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1106,6 +1106,9 @@ nfqnl_recv_unsupp(struct sock *ctnl, struct sk_buff *skb,
 static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
 	[NFQA_CFG_CMD]		= { .len = sizeof(struct nfqnl_msg_config_cmd) },
 	[NFQA_CFG_PARAMS]	= { .len = sizeof(struct nfqnl_msg_config_params) },
+	[NFQA_CFG_QUEUE_MAXLEN]	= { .type = NLA_U32 },
+	[NFQA_CFG_MASK]		= { .type = NLA_U32 },
+	[NFQA_CFG_FLAGS]	= { .type = NLA_U32 },
 };
 
 static const struct nf_queue_handler nfqh = {