Merge 4.4.221 into android-4.4-p

Changes in 4.4.221
	ext4: fix extent_status fragmentation for plain files
	ALSA: hda - Fix incorrect usage of IS_REACHABLE()
	net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()
	net: ipv4: avoid unused variable warning for sysctl
	crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static
	vti4: removed duplicate log message.
	scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
	ceph: return ceph_mdsc_do_request() errors from __get_parent()
	ceph: don't skip updating wanted caps when cap is stale
	pwm: rcar: Fix late Runtime PM enablement
	scsi: iscsi: Report unbind session event when the target has been removed
	ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
	kernel/gcov/fs.c: gcov_seq_next() should increase position index
	ipc/util.c: sysvipc_find_ipc() should increase position index
	s390/cio: avoid duplicated 'ADD' uevents
	pwm: renesas-tpu: Fix late Runtime PM enablement
	pwm: bcm2835: Dynamically allocate base
	ipv6: fix restrict IPV6_ADDRFORM operation
	macvlan: fix null dereference in macvlan_device_event()
	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
	net/x25: Fix x25_neigh refcnt leak when receiving frame
	tcp: cache line align MAX_TCP_HEADER
	team: fix hang in team_mode_get()
	xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
	ALSA: hda: Remove ASUS ROG Zenith from the blacklist
	iio: xilinx-xadc: Fix ADC-B powerdown
	iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
	iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
	fs/namespace.c: fix mountpoint reference counter race
	USB: sisusbvga: Change port variable from signed to unsigned
	USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
	drivers: usb: core: Don't disable irqs in usb_sg_wait() during URB submit.
	drivers: usb: core: Minimize irq disabling in usb_sg_cancel()
	USB: core: Fix free-while-in-use bug in the USB S-Glibrary
	USB: hub: Fix handling of connect changes during sleep
	ALSA: usx2y: Fix potential NULL dereference
	ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
	ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
	KVM: Check validity of resolved slot when searching memslots
	KVM: VMX: Enable machine check support for 32bit targets
	tty: hvc: fix buffer overflow during hvc_alloc().
	tty: rocket, avoid OOB access
	usb-storage: Add unusual_devs entry for JMicron JMS566
	audit: check the length of userspace generated audit records
	ASoC: dapm: fixup dapm kcontrol widget
	ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
	staging: comedi: dt2815: fix writing hi byte of analog output
	staging: comedi: Fix comedi_device refcnt leak in comedi_open
	staging: vt6656: Fix drivers TBTT timing counter.
	staging: vt6656: Power save stop wake_up_count wrap around.
	UAS: no use logging any details in case of ENODEV
	UAS: fix deadlock in error handling and PM flushing work
	usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
	remoteproc: Fix wrong rvring index computation
	sctp: use right member as the param of list_for_each_entry
	fuse: fix possibly missed wake-up after abort
	mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
	usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
	net/cxgb4: Check the return from t4_query_params properly
	perf/core: fix parent pid/tid in task exit events
	bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
	scsi: target: fix PR IN / READ FULL STATUS for FC
	xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
	ext4: convert BUG_ON's to WARN_ON's in mballoc.c
	ext4: avoid declaring fs inconsistent due to invalid file handles
	ext4: protect journal inode's blocks using block_validity
	ext4: don't perform block validity checks on the journal inode
	ext4: fix block validity checks for journal inodes using indirect blocks
	ext4: unsigned int compared against zero
	propagate_one(): mnt_set_mountpoint() needs mount_lock
	Linux 4.4.221

Change-Id: I95cadd4206a7c89541de002faacea3a28e7b1ac3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index 128da86f1431..f94484ea1b26 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -925,6 +925,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 	case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2:
 		if (!audit_enabled && msg_type != AUDIT_USER_AVC)
 			return 0;
+		/* exit early if there isn't at least one character to print */
+		if (data_len < 2)
+			return -EINVAL;
 
 		err = audit_filter_user(msg_type);
 		if (err == 1) { /* match or error */