Merge 4.4.66 into android-4.4

Changes in 4.4.66:
	f2fs: do more integrity verification for superblock
	xc2028: unlock on error in xc2028_set_config()
	ARM: OMAP2+: timer: add probe for clocksources
	clk: sunxi: Add apb0 gates for H3
	crypto: testmgr - fix out of bound read in __test_aead()
	drm/amdgpu: fix array out of bounds
	ext4: check if in-inode xattr is corrupted in ext4_expand_extra_isize_ea()
	md:raid1: fix a dead loop when read from a WriteMostly disk
	MIPS: Fix crash registers on non-crashing CPUs
	net: cavium: liquidio: Avoid dma_unmap_single on uninitialized ndata
	net_sched: close another race condition in tcf_mirred_release()
	RDS: Fix the atomicity for congestion map update
	regulator: core: Clear the supply pointer if enabling fails
	usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize
	xen/x86: don't lose event interrupts
	sparc64: kern_addr_valid regression
	sparc64: Fix kernel panic due to erroneous #ifdef surrounding pmd_write()
	net: neigh: guard against NULL solicit() method
	net: phy: handle state correctly in phy_stop_machine
	l2tp: purge socket queues in the .destruct() callback
	net/packet: fix overflow in check for tp_frame_nr
	net/packet: fix overflow in check for tp_reserve
	l2tp: take reference on sessions being dumped
	l2tp: fix PPP pseudo-wire auto-loading
	net: ipv4: fix multipath RTM_GETROUTE behavior when iif is given
	sctp: listen on the sock only when it's state is listening or closed
	tcp: clear saved_syn in tcp_disconnect()
	dp83640: don't recieve time stamps twice
	net: ipv6: RTF_PCPU should not be settable from userspace
	netpoll: Check for skb->queue_mapping
	ip6mr: fix notification device destruction
	macvlan: Fix device ref leak when purging bc_queue
	ipv6: check skb->protocol before lookup for nexthop
	ipv6: check raw payload size correctly in ioctl
	ALSA: firewire-lib: fix inappropriate assignment between signed/unsigned type
	ALSA: seq: Don't break snd_use_lock_sync() loop by timeout
	MIPS: KGDB: Use kernel context for sleeping threads
	MIPS: Avoid BUG warning in arch_check_elf
	p9_client_readdir() fix
	Input: i8042 - add Clevo P650RS to the i8042 reset list
	nfsd: check for oversized NFSv2/v3 arguments
	ARCv2: save r30 on kernel entry as gcc uses it for code-gen
	ftrace/x86: Fix triple fault with graph tracing and suspend-to-ram
	Linux 4.4.66

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 28 insertions, 4 deletions

diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index f7455e668474..b310ed81c10e 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -233,6 +233,27 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh)
 	return error;
 }
 
+static int
+__xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header,
+			 void *end, const char *function, unsigned int line)
+{
+	struct ext4_xattr_entry *entry = IFIRST(header);
+	int error = -EFSCORRUPTED;
+
+	if (((void *) header >= end) ||
+	    (header->h_magic != le32_to_cpu(EXT4_XATTR_MAGIC)))
+		goto errout;
+	error = ext4_xattr_check_names(entry, end, entry);
+errout:
+	if (error)
+		__ext4_error_inode(inode, function, line, 0,
+				   "corrupted in-inode xattr");
+	return error;
+}
+
+#define xattr_check_inode(inode, header, end) \
+	__xattr_check_inode((inode), (header), (end), __func__, __LINE__)
+
 static inline int
 ext4_xattr_check_entry(struct ext4_xattr_entry *entry, size_t size)
 {
@@ -344,7 +365,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
 	header = IHDR(inode, raw_inode);
 	entry = IFIRST(header);
 	end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
-	error = ext4_xattr_check_names(entry, end, entry);
+	error = xattr_check_inode(inode, header, end);
 	if (error)
 		goto cleanup;
 	error = ext4_xattr_find_entry(&entry, name_index, name,
@@ -475,7 +496,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)
 	raw_inode = ext4_raw_inode(&iloc);
 	header = IHDR(inode, raw_inode);
 	end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
-	error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header));
+	error = xattr_check_inode(inode, header, end);
 	if (error)
 		goto cleanup;
 	error = ext4_xattr_list_entries(dentry, IFIRST(header),
@@ -1017,8 +1038,7 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
 	is->s.here = is->s.first;
 	is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
 	if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
-		error = ext4_xattr_check_names(IFIRST(header), is->s.end,
-					       IFIRST(header));
+		error = xattr_check_inode(inode, header, is->s.end);
 		if (error)
 			return error;
 		/* Find the named attribute. */
@@ -1319,6 +1339,10 @@ retry:
 	last = entry;
 	total_ino = sizeof(struct ext4_xattr_ibody_header);
 
+	error = xattr_check_inode(inode, header, end);
+	if (error)
+		goto cleanup;
+
 	free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
 	if (free >= isize_diff) {
 		entry = IFIRST(header);