Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android

* linux-linaro-lsk-v4.4: (622 commits)
  Linux 4.4.166
  drm/ast: Remove existing framebuffers before loading driver
  s390/mm: Check for valid vma before zapping in gmap_discard
  namei: allow restricted O_CREAT of FIFOs and regular files
  sched/core: Allow __sched_setscheduler() in interrupts when PI is not used
  btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
  usb: xhci: fix uninitialized completion when USB3 port got wrong status
  tty: wipe buffer if not echoing data
  tty: wipe buffer.
  iwlwifi: mvm: fix regulatory domain update when the firmware starts
  scsi: qla2xxx: do not queue commands when unloading
  scsi: ufshcd: release resources if probe fails
  scsi: ufs: fix race between clock gating and devfreq scaling work
  scsi: ufshcd: Fix race between clk scaling and ungate work
  scsi: ufs: fix bugs related to null pointer access and array size
  netfilter: nf_tables: fix oops when inserting an element into a verdict map
  mwifiex: fix p2p device doesn't find in scan problem
  mwifiex: Fix NULL pointer dereference in skb_dequeue()
  cw1200: Don't leak memory if krealloc failes
  Input: xpad - add support for Xbox1 PDP Camo series gamepad
  ...

  Conflicts:
    Makefile
    arch/x86/Makefile
    drivers/base/power/main.c
    drivers/block/zram/zram_drv.c
    kernel/debug/kdb/kdb_io.c
    net/ipv6/route.c
    scripts/Kbuild.include
      Conflicts in above files are fixed as done in AOSP Change-Id:
      I5bd20327e0c1139c46f74e8d5916fa0530a307d3 ("Merge 4.4.165 into android-4.4").

    arch/arm64/include/asm/cpufeature.h
    arch/arm64/kernel/cpufeature.c
      Conflicts in above files is due to AOSP Change-Id:
      I11cb874d12a7d0921f452c62b0752e0028a8e0a7 ("FROMLIST: arm64: entry: Add
      fake CPU feature for unmapping the kernel at EL0"), which needed a minor
      rebasing.

Signed-off-by: Amit Pundir <amit.pundir@linaro.org>

1 files changed, 25 insertions, 21 deletions

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index ef90667e048b..598343f07569 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -606,28 +606,30 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 			 * Do the same thing for the memory mapping - between
 			 * elf_bss and last_bss is the bss section.
 			 */
-			k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
+			k = load_addr + eppnt->p_vaddr + eppnt->p_memsz;
 			if (k > last_bss)
 				last_bss = k;
 		}
 	}
 
+	/*
+	 * Now fill out the bss section: first pad the last page from
+	 * the file up to the page boundary, and zero it from elf_bss
+	 * up to the end of the page.
+	 */
+	if (padzero(elf_bss)) {
+		error = -EFAULT;
+		goto out;
+	}
+	/*
+	 * Next, align both the file and mem bss up to the page size,
+	 * since this is where elf_bss was just zeroed up to, and where
+	 * last_bss will end after the vm_brk() below.
+	 */
+	elf_bss = ELF_PAGEALIGN(elf_bss);
+	last_bss = ELF_PAGEALIGN(last_bss);
+	/* Finally, if there is still more bss to allocate, do it. */
 	if (last_bss > elf_bss) {
-		/*
-		 * Now fill out the bss section.  First pad the last page up
-		 * to the page boundary, and then perform a mmap to make sure
-		 * that there are zero-mapped pages up to and including the
-		 * last bss page.
-		 */
-		if (padzero(elf_bss)) {
-			error = -EFAULT;
-			goto out;
-		}
-
-		/* What we have mapped so far */
-		elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
-
-		/* Map the last of the bss segment */
 		error = vm_brk(elf_bss, last_bss - elf_bss);
 		if (BAD_ADDR(error))
 			goto out;
@@ -1216,11 +1218,13 @@ static int load_elf_library(struct file *file)
 		goto out_free_ph;
 	}
 
-	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
-			    ELF_MIN_ALIGN - 1);
-	bss = eppnt->p_memsz + eppnt->p_vaddr;
-	if (bss > len)
-		vm_brk(len, bss - len);
+	len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);
+	bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);
+	if (bss > len) {
+		error = vm_brk(len, bss - len);
+		if (BAD_ADDR(error))
+			goto out_free_ph;
+	}
 	error = 0;
 
 out_free_ph: