Merge 4.4.273 into android-4.4-p

Changes in 4.4.273
	proc: Track /proc/$pid/attr/ opener mm_struct
	net/nfc/rawsock.c: fix a permission check bug
	ASoC: sti-sas: add missing MODULE_DEVICE_TABLE
	isdn: mISDN: netjet: Fix crash in nj_probe:
	bonding: init notify_work earlier to avoid uninitialized use
	netlink: disable IRQs for netlink_lock_table()
	net: mdiobus: get rid of a BUG_ON()
	net/qla3xxx: fix schedule while atomic in ql_sem_spinlock
	scsi: vmw_pvscsi: Set correct residual data length
	scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal
	net: macb: ensure the device is available before accessing GEMGXL control registers
	net: appletalk: cops: Fix data race in cops_probe1
	MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER
	bnx2x: Fix missing error code in bnx2x_iov_init_one()
	powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c controllers
	powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c controllers
	i2c: mpc: Make use of i2c_recover_bus()
	i2c: mpc: implement erratum A-004447 workaround
	kvm: avoid speculation-based attacks from out-of-range memslot accesses
	btrfs: return value from btrfs_mark_extent_written() in case of error
	cgroup1: don't allow '\n' in renaming
	USB: f_ncm: ncm_bitrate (speed) is unsigned
	usb: dwc3: ep0: fix NULL pointer exception
	USB: serial: ftdi_sio: add NovaTech OrionMX product ID
	USB: serial: omninet: add device id for Zyxel Omni 56K Plus
	USB: serial: quatech2: fix control-request directions
	usb: gadget: eem: fix wrong eem header operation
	perf: Fix data race between pin_count increment/decrement
	NFS: Fix a potential NULL dereference in nfs_get_client()
	perf session: Correct buffer copying when peeking events
	kvm: fix previous commit for 32-bit builds
	NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
	scsi: core: Only put parent device if host state differs from SHOST_CREATED
	ftrace: Do not blindly read the ip address in ftrace_bug()
	proc: only require mm_struct for writing
	Linux 4.4.273

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I97fdaeb60b62a57bf34ecceabda8be5cee23a0e7

4 files changed, 21 insertions, 4 deletions

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 73b547f88bfc..2426dc56426f 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1089,7 +1089,7 @@ int btrfs_mark_extent_written(struct btrfs_trans_handle *trans,
 	int del_nr = 0;
 	int del_slot = 0;
 	int recow;
-	int ret;
+	int ret = 0;
 	u64 ino = btrfs_ino(inode);
 
 	path = btrfs_alloc_path();
@@ -1284,7 +1284,7 @@ again:
 	}
 out:
 	btrfs_free_path(path);
-	return 0;
+	return ret;
 }
 
 /*
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index d6d5d2a48e83..ba2cd0bd3894 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -377,7 +377,7 @@ nfs_get_client(const struct nfs_client_initdata *cl_init,
 
 	if (cl_init->hostname == NULL) {
 		WARN_ON(1);
-		return NULL;
+		return ERR_PTR(-EINVAL);
 	}
 
 	dprintk("--> nfs_get_client(%s,v%u)\n",
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 92ca753723b5..e10bada12361 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -4887,6 +4887,14 @@ static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen
 	do {
 		err = __nfs4_proc_set_acl(inode, buf, buflen);
 		trace_nfs4_set_acl(inode, err);
+		if (err == -NFS4ERR_BADOWNER || err == -NFS4ERR_BADNAME) {
+			/*
+			 * no need to retry since the kernel
+			 * isn't involved in encoding the ACEs.
+			 */
+			err = -EINVAL;
+			break;
+		}
 		err = nfs4_handle_exception(NFS_SERVER(inode), err,
 				&exception);
 	} while (exception.retry);
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 60490877986e..7137daebbe06 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2471,6 +2471,13 @@ out:
 }
 
 #ifdef CONFIG_SECURITY
+static int proc_pid_attr_open(struct inode *inode, struct file *file)
+{
+	file->private_data = NULL;
+	__mem_open(inode, file, PTRACE_MODE_READ_FSCREDS);
+	return 0;
+}
+
 static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
 				  size_t count, loff_t *ppos)
 {
@@ -2501,7 +2508,7 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
 	struct task_struct *task = get_proc_task(inode);
 
 	/* A task may only write when it was the opener. */
-	if (file->f_cred != current_real_cred())
+	if (file->private_data != current->mm)
 		return -EPERM;
 
 	length = -ESRCH;
@@ -2542,9 +2549,11 @@ out_no_task:
 }
 
 static const struct file_operations proc_pid_attr_operations = {
+	.open		= proc_pid_attr_open,
 	.read		= proc_pid_attr_read,
 	.write		= proc_pid_attr_write,
 	.llseek		= generic_file_llseek,
+	.release	= mem_release,
 };
 
 static const struct pid_entry attr_dir_stuff[] = {