Merge 4.4.162 into android-4.4-p

Changes in 4.4.162
	ASoC: wm8804: Add ACPI support
	ASoC: sigmadsp: safeload should not have lower byte limit
	selftests/efivarfs: add required kernel configs
	mfd: omap-usb-host: Fix dts probe of children
	sound: enable interrupt after dma buffer initialization
	stmmac: fix valid numbers of unicast filter entries
	net: macb: disable scatter-gather for macb on sama5d3
	ARM: dts: at91: add new compatibility string for macb on sama5d3
	drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7
	ext4: add corruption check in ext4_xattr_set_entry()
	mm/vmstat.c: fix outdated vmstat_text
	mach64: detect the dot clock divider correctly on sparc
	perf script python: Fix export-to-postgresql.py occasional failure
	i2c: i2c-scmi: fix for i2c_smbus_write_block_data
	xhci: Don't print a warning when setting link state for disabled ports
	jffs2: return -ERANGE when xattr buffer is too small
	bnxt_en: Fix TX timeout during netpoll.
	bonding: avoid possible dead-lock
	ip6_tunnel: be careful when accessing the inner header
	ip_tunnel: be careful when accessing the inner header
	ipv4: fix use-after-free in ip_cmsg_recv_dstaddr()
	net: ipv4: update fnhe_pmtu when first hop's MTU changes
	net/ipv6: Display all addresses in output of /proc/net/if_inet6
	netlabel: check for IPV4MASK in addrinfo_get
	net/usb: cancel pending work when unbinding smsc75xx
	qlcnic: fix Tx descriptor corruption on 82xx devices
	team: Forbid enslaving team device to itself
	net: mvpp2: Extract the correct ethtype from the skb for tx csum offload
	net: systemport: Fix wake-up interrupt race during resume
	rtnl: limit IFLA_NUM_TX_QUEUES and IFLA_NUM_RX_QUEUES to 4096
	KVM: x86: remove eager_fpu field of struct kvm_vcpu_arch
	x86/fpu: Remove use_eager_fpu()
	x86/fpu: Remove struct fpu::counter
	x86/fpu: Finish excising 'eagerfpu'
	media: af9035: prevent buffer overflow on write
	clocksource/drivers/ti-32k: Add CLOCK_SOURCE_SUSPEND_NONSTOP flag for non-am43 SoCs
	Input: atakbd - fix Atari keymap
	Input: atakbd - fix Atari CapsLock behaviour
	net/mlx4: Use cpumask_available for eq->affinity_mask
	powerpc/tm: Fix userspace r13 corruption
	powerpc/tm: Avoid possible userspace r1 corruption on reclaim
	ARC: build: Get rid of toolchain check
	usb: gadget: serial: fix oops when data rx'd after close
	Drivers: hv: utils: Invoke the poll function after handshake
	Drivers: hv: util: Pass the channel information during the init call
	Drivers: hv: kvp: fix IP Failover
	HV: properly delay KVP packets when negotiation is in progress
	Linux 4.4.162

Change-Id: I70efa929e8fd08d28228e251d276847cfdfb0bac
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 14 insertions, 8 deletions

diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 4d0365a55841..cfb546ebf294 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -639,14 +639,20 @@ static size_t ext4_xattr_free_space(struct ext4_xattr_entry *last,
 }
 
 static int
-ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s)
+ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s,
+		     struct inode *inode)
 {
-	struct ext4_xattr_entry *last;
+	struct ext4_xattr_entry *last, *next;
 	size_t free, min_offs = s->end - s->base, name_len = strlen(i->name);
 
 	/* Compute min_offs and last. */
 	last = s->first;
-	for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {
+	for (; !IS_LAST_ENTRY(last); last = next) {
+		next = EXT4_XATTR_NEXT(last);
+		if ((void *)next >= s->end) {
+			EXT4_ERROR_INODE(inode, "corrupted xattr entries");
+			return -EFSCORRUPTED;
+		}
 		if (!last->e_value_block && last->e_value_size) {
 			size_t offs = le16_to_cpu(last->e_value_offs);
 			if (offs < min_offs)
@@ -829,7 +835,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 			mb2_cache_entry_delete_block(ext4_mb_cache, hash,
 						     bs->bh->b_blocknr);
 			ea_bdebug(bs->bh, "modifying in-place");
-			error = ext4_xattr_set_entry(i, s);
+			error = ext4_xattr_set_entry(i, s, inode);
 			if (!error) {
 				if (!IS_LAST_ENTRY(s->first))
 					ext4_xattr_rehash(header(s->base),
@@ -875,7 +881,7 @@ ext4_xattr_block_set(handle_t *handle, struct inode *inode,
 		s->end = s->base + sb->s_blocksize;
 	}
 
-	error = ext4_xattr_set_entry(i, s);
+	error = ext4_xattr_set_entry(i, s, inode);
 	if (error == -EFSCORRUPTED)
 		goto bad_block;
 	if (error)
@@ -1063,7 +1069,7 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode,
 
 	if (EXT4_I(inode)->i_extra_isize == 0)
 		return -ENOSPC;
-	error = ext4_xattr_set_entry(i, s);
+	error = ext4_xattr_set_entry(i, s, inode);
 	if (error) {
 		if (error == -ENOSPC &&
 		    ext4_has_inline_data(inode)) {
@@ -1075,7 +1081,7 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode,
 			error = ext4_xattr_ibody_find(inode, i, is);
 			if (error)
 				return error;
-			error = ext4_xattr_set_entry(i, s);
+			error = ext4_xattr_set_entry(i, s, inode);
 		}
 		if (error)
 			return error;
@@ -1101,7 +1107,7 @@ static int ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
 
 	if (EXT4_I(inode)->i_extra_isize == 0)
 		return -ENOSPC;
-	error = ext4_xattr_set_entry(i, s);
+	error = ext4_xattr_set_entry(i, s, inode);
 	if (error)
 		return error;
 	header = IHDR(inode, ext4_raw_inode(&is->iloc));