Merge 4.4.75 into android-4.4

Changes in 4.4.75
	fs/exec.c: account for argv/envp pointers
	autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
	lib/cmdline.c: fix get_options() overflow while parsing ranges
	KVM: PPC: Book3S HV: Preserve userspace HTM state properly
	CIFS: Improve readdir verbosity
	HID: Add quirk for Dell PIXART OEM mouse
	signal: Only reschedule timers on signals timers have sent
	powerpc/kprobes: Pause function_graph tracing during jprobes handling
	Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
	time: Fix clock->read(clock) race around clocksource changes
	target: Fix kref->refcount underflow in transport_cmd_finish_abort
	iscsi-target: Reject immediate data underflow larger than SCSI transfer length
	drm/radeon: add a PX quirk for another K53TK variant
	drm/radeon: add a quirk for Toshiba Satellite L20-183
	drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating
	drm/amdgpu: adjust default display clock
	USB: usbip: fix nonconforming hub descriptor
	rxrpc: Fix several cases where a padded len isn't checked in ticket decode
	of: Add check to of_scan_flat_dt() before accessing initial_boot_params
	mtd: spi-nor: fix spansion quad enable
	powerpc/slb: Force a full SLB flush when we insert for a bad EA
	usb: gadget: f_fs: avoid out of bounds access on comp_desc
	net: phy: Initialize mdio clock at probe function
	net: phy: fix marvell phy status reading
	nvme/quirk: Add a delay before checking for adapter readiness
	nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too
	Linux 4.4.75

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 24 insertions, 4 deletions

diff --git a/fs/exec.c b/fs/exec.c
index b1f5ddbf7d56..073ae12b396e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -206,8 +206,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 
 	if (write) {
 		unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;
+		unsigned long ptr_size;
 		struct rlimit *rlim;
 
+		/*
+		 * Since the stack will hold pointers to the strings, we
+		 * must account for them as well.
+		 *
+		 * The size calculation is the entire vma while each arg page is
+		 * built, so each time we get here it's calculating how far it
+		 * is currently (rather than each call being just the newly
+		 * added size from the arg page).  As a result, we need to
+		 * always add the entire size of the pointers, so that on the
+		 * last call to get_arg_page() we'll actually have the entire
+		 * correct size.
+		 */
+		ptr_size = (bprm->argc + bprm->envc) * sizeof(void *);
+		if (ptr_size > ULONG_MAX - size)
+			goto fail;
+		size += ptr_size;
+
 		acct_arg_size(bprm, size / PAGE_SIZE);
 
 		/*
@@ -225,13 +243,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
 		 *    to work from.
 		 */
 		rlim = current->signal->rlim;
-		if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {
-			put_page(page);
-			return NULL;
-		}
+		if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4)
+			goto fail;
 	}
 
 	return page;
+
+fail:
+	put_page(page);
+	return NULL;
 }
 
 static void put_arg_page(struct page *page)