Merge 4.4.140 into android-4.4

Changes in 4.4.140
	usb: cdc_acm: Add quirk for Uniden UBC125 scanner
	USB: serial: cp210x: add CESINEL device ids
	USB: serial: cp210x: add Silicon Labs IDs for Windows Update
	n_tty: Fix stall at n_tty_receive_char_special().
	staging: android: ion: Return an ERR_PTR in ion_map_kernel
	n_tty: Access echo_* variables carefully.
	x86/boot: Fix early command-line parsing when matching at end
	ath10k: fix rfc1042 header retrieval in QCA4019 with eth decap mode
	i2c: rcar: fix resume by always initializing registers before transfer
	ipv4: Fix error return value in fib_convert_metrics()
	kprobes/x86: Do not modify singlestep buffer while resuming
	nvme-pci: initialize queue memory before interrupts
	netfilter: nf_tables: use WARN_ON_ONCE instead of BUG_ON in nft_do_chain()
	ARM: dts: imx6q: Use correct SDMA script for SPI5 core
	ubi: fastmap: Correctly handle interrupted erasures in EBA
	mm: hugetlb: yield when prepping struct pages
	tracing: Fix missing return symbol in function_graph output
	scsi: sg: mitigate read/write abuse
	s390: Correct register corruption in critical section cleanup
	drbd: fix access after free
	cifs: Fix infinite loop when using hard mount option
	jbd2: don't mark block as modified if the handle is out of credits
	ext4: make sure bitmaps and the inode table don't overlap with bg descriptors
	ext4: always check block group bounds in ext4_init_block_bitmap()
	ext4: only look at the bg_flags field if it is valid
	ext4: verify the depth of extent tree in ext4_find_extent()
	ext4: include the illegal physical block in the bad map ext4_error msg
	ext4: clear i_data in ext4_inode_info when removing inline data
	ext4: add more inode number paranoia checks
	ext4: add more mount time checks of the superblock
	ext4: check superblock mapped prior to committing
	HID: i2c-hid: Fix "incomplete report" noise
	HID: hiddev: fix potential Spectre v1
	HID: debug: check length before copy_to_user()
	x86/mce: Detect local MCEs properly
	x86/mce: Fix incorrect "Machine check from unknown source" message
	media: cx25840: Use subdev host data for PLL override
	mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
	dm bufio: avoid sleeping while holding the dm_bufio lock
	dm bufio: drop the lock when doing GFP_NOIO allocation
	mtd: rawnand: mxc: set spare area size register explicitly
	dm bufio: don't take the lock in dm_bufio_shrink_count
	mtd: cfi_cmdset_0002: Change definition naming to retry write operation
	mtd: cfi_cmdset_0002: Change erase functions to retry for error
	mtd: cfi_cmdset_0002: Change erase functions to check chip good only
	netfilter: nf_log: don't hold nf_log_mutex during user access
	staging: comedi: quatech_daqp_cs: fix no-op loop daqp_ao_insn_write()
	Linux 4.4.140

Change-Id: I1eb015e1fee548fb958c7e5eb4754b425cfab6b7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 24 insertions, 10 deletions

diff --git a/arch/x86/lib/cmdline.c b/arch/x86/lib/cmdline.c
index a744506856b1..88ce150186c6 100644
--- a/arch/x86/lib/cmdline.c
+++ b/arch/x86/lib/cmdline.c
@@ -21,12 +21,14 @@ static inline int myisspace(u8 c)
  * @option: option string to look for
  *
  * Returns the position of that @option (starts counting with 1)
- * or 0 on not found.
+ * or 0 on not found.  @option will only be found if it is found
+ * as an entire word in @cmdline.  For instance, if @option="car"
+ * then a cmdline which contains "cart" will not match.
  */
 int cmdline_find_option_bool(const char *cmdline, const char *option)
 {
 	char c;
-	int len, pos = 0, wstart = 0;
+	int pos = 0, wstart = 0;
 	const char *opptr = NULL;
 	enum {
 		st_wordstart = 0,	/* Start of word/after whitespace */
@@ -37,11 +39,14 @@ int cmdline_find_option_bool(const char *cmdline, const char *option)
 	if (!cmdline)
 		return -1;      /* No command line */
 
-	len = min_t(int, strlen(cmdline), COMMAND_LINE_SIZE);
-	if (!len)
+	if (!strlen(cmdline))
 		return 0;
 
-	while (len--) {
+	/*
+	 * This 'pos' check ensures we do not overrun
+	 * a non-NULL-terminated 'cmdline'
+	 */
+	while (pos < COMMAND_LINE_SIZE) {
 		c = *(char *)cmdline++;
 		pos++;
 
@@ -58,17 +63,26 @@ int cmdline_find_option_bool(const char *cmdline, const char *option)
 			/* fall through */
 
 		case st_wordcmp:
-			if (!*opptr)
+			if (!*opptr) {
+				/*
+				 * We matched all the way to the end of the
+				 * option we were looking for.  If the
+				 * command-line has a space _or_ ends, then
+				 * we matched!
+				 */
 				if (!c || myisspace(c))
 					return wstart;
 				else
 					state = st_wordskip;
-			else if (!c)
+			} else if (!c) {
+				/*
+				 * Hit the NULL terminator on the end of
+				 * cmdline.
+				 */
 				return 0;
-			else if (c != *opptr++)
+			} else if (c != *opptr++) {
 				state = st_wordskip;
-			else if (!len)		/* last word and is matching */
-				return wstart;
+			}
 			break;
 
 		case st_wordskip: