Merge 4.4.227 into android-4.4-p

Changes in 4.4.227
	scsi: scsi_devinfo: fixup string compare
	usb: gadget: f_uac2: fix error handling in afunc_bind (again)
	platform/x86: acer-wmi: setup accelerometer when ACPI device was found
	esp6: fix memleak on error path in esp6_input
	IB/mlx4: Fix an error handling path in 'mlx4_ib_rereg_user_mr()'
	ALSA: hda - No loopback on ALC299 codec
	spi: dw: use "smp_mb()" to avoid sending spi data error
	s390/ftrace: save traced function caller
	ARC: Fix ICCM & DCCM runtime size checks
	x86/mmiotrace: Use cpumask_available() for cpumask_var_t variables
	net: bmac: Fix read of MAC address from ROM
	net/ethernet/freescale: rework quiesce/activate for ucc_geth
	net: ethernet: stmmac: Enable interface clocks on probe for IPQ806x
	pppoe: only process PADT targeted at local interfaces
	mmc: fix compilation of user API
	slcan: Fix double-free on slcan_open() error path
	slip: not call free_netdev before rtnl_unlock in slip_open
	scsi: ufs: Release clock if DMA map fails
	devinet: fix memleak in inetdev_init()
	NFC: st21nfca: add missed kfree_skb() in an error path
	vsock: fix timeout in vsock_accept()
	l2tp: add sk_family checks to l2tp_validate_socket
	l2tp: do not use inet_hash()/inet_unhash()
	USB: serial: qcserial: add DW5816e QDL support
	USB: serial: usb_wwan: do not resubmit rx urb on fatal errors
	USB: serial: option: add Telit LE910C1-EUX compositions
	vt: keyboard: avoid signed integer overflow in k_ascii
	staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK
	x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
	x86/cpu: Add a steppings field to struct x86_cpu_id
	x86/cpu: Add 'table' argument to cpu_matches()
	x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
	x86/speculation: Add SRBDS vulnerability and mitigation documentation
	x86/speculation: Add Ivy Bridge to affected list
	iio: vcnl4000: Fix i2c swapped word reading.
	uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
	Linux 4.4.227

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib2e396e7c9444adb4cad958e3423afe3c4d5963d

1 files changed, 10 insertions, 4 deletions

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 8cad3cd92e23..e7dabb254404 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -602,10 +602,6 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
 	if (ret)
 		goto out;
 
-	/* uprobe_write_opcode() assumes we don't cross page boundary */
-	BUG_ON((uprobe->offset & ~PAGE_MASK) +
-			UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
-
 	smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
 	set_bit(UPROBE_COPY_INSN, &uprobe->flags);
 
@@ -884,6 +880,13 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *
 	if (offset > i_size_read(inode))
 		return -EINVAL;
 
+	/*
+	 * This ensures that copy_from_page() and copy_to_page()
+	 * can't cross page boundary.
+	 */
+	if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE))
+		return -EINVAL;
+
  retry:
 	uprobe = alloc_uprobe(inode, offset);
 	if (!uprobe)
@@ -1692,6 +1695,9 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr)
 	uprobe_opcode_t opcode;
 	int result;
 
+	if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE)))
+		return -EINVAL;
+
 	pagefault_disable();
 	result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
 							sizeof(opcode));