Merge 4.4.175 into android-4.4

Changes in 4.4.175
	drm/bufs: Fix Spectre v1 vulnerability
	staging: iio: adc: ad7280a: handle error from __ad7280_read32()
	ASoC: Intel: mrfld: fix uninitialized variable access
	scsi: lpfc: Correct LCB RJT handling
	ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
	dlm: Don't swamp the CPU with callbacks queued during recovery
	x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
	powerpc/pseries: add of_node_put() in dlpar_detach_node()
	serial: fsl_lpuart: clear parity enable bit when disable parity
	ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
	staging:iio:ad2s90: Make probe handle spi_setup failure
	staging: iio: ad7780: update voltage on read
	ARM: OMAP2+: hwmod: Fix some section annotations
	modpost: validate symbol names also in find_elf_symbol
	perf tools: Add Hygon Dhyana support
	soc/tegra: Don't leak device tree node reference
	f2fs: move dir data flush to write checkpoint process
	f2fs: fix wrong return value of f2fs_acl_create
	sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
	nfsd4: fix crash on writing v4_end_grace before nfsd startup
	arm64: ftrace: don't adjust the LR value
	ARM: dts: mmp2: fix TWSI2
	x86/fpu: Add might_fault() to user_insn()
	media: DaVinci-VPBE: fix error handling in vpbe_initialize()
	smack: fix access permissions for keyring
	usb: hub: delay hub autosuspend if USB3 port is still link training
	timekeeping: Use proper seqcount initializer
	ARM: dts: Fix OMAP4430 SDP Ethernet startup
	mips: bpf: fix encoding bug for mm_srlv32_op
	iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
	sata_rcar: fix deferred probing
	clk: imx6sl: ensure MMDC CH0 handshake is bypassed
	cpuidle: big.LITTLE: fix refcount leak
	i2c-axxia: check for error conditions first
	udf: Fix BUG on corrupted inode
	ARM: pxa: avoid section mismatch warning
	ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
	memstick: Prevent memstick host from getting runtime suspended during card detection
	tty: serial: samsung: Properly set flags in autoCTS mode
	arm64: KVM: Skip MMIO insn after emulation
	powerpc/uaccess: fix warning/error with access_ok()
	mac80211: fix radiotap vendor presence bitmap handling
	xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
	Bluetooth: Fix unnecessary error message for HCI request completion
	cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
	drbd: narrow rcu_read_lock in drbd_sync_handshake
	drbd: disconnect, if the wrong UUIDs are attached on a connected peer
	drbd: skip spurious timeout (ping-timeo) when failing promote
	drbd: Avoid Clang warning about pointless switch statment
	video: clps711x-fb: release disp device node in probe()
	fbdev: fbmem: behave better with small rotated displays and many CPUs
	igb: Fix an issue that PME is not enabled during runtime suspend
	fbdev: fbcon: Fix unregister crash when more than one framebuffer
	KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
	NFS: nfs_compare_mount_options always compare auth flavors.
	hwmon: (lm80) fix a missing check of the status of SMBus read
	hwmon: (lm80) fix a missing check of bus read in lm80 probe
	seq_buf: Make seq_buf_puts() null-terminate the buffer
	crypto: ux500 - Use proper enum in cryp_set_dma_transfer
	crypto: ux500 - Use proper enum in hash_set_dma_transfer
	cifs: check ntwrk_buf_start for NULL before dereferencing it
	um: Avoid marking pages with "changed protection"
	niu: fix missing checks of niu_pci_eeprom_read
	scripts/decode_stacktrace: only strip base path when a prefix of the path
	ocfs2: don't clear bh uptodate for block read
	isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
	gdrom: fix a memory leak bug
	block/swim3: Fix -EBUSY error when re-opening device after unmount
	HID: lenovo: Add checks to fix of_led_classdev_register
	kernel/hung_task.c: break RCU locks based on jiffies
	fs/epoll: drop ovflist branch prediction
	exec: load_script: don't blindly truncate shebang string
	thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
	test_hexdump: use memcpy instead of strncpy
	tipc: use destination length for copy string
	string: drop __must_check from strscpy() and restore strscpy() usages in cgroup
	dccp: fool proof ccid_hc_[rt]x_parse_options()
	enic: fix checksum validation for IPv6
	net: dp83640: expire old TX-skb
	skge: potential memory corruption in skge_get_regs()
	net: systemport: Fix WoL with password after deep sleep
	net: dsa: slave: Don't propagate flag changes on down slave interfaces
	ALSA: compress: Fix stop handling on compressed capture streams
	ALSA: hda - Serialize codec registrations
	fuse: call pipe_buf_release() under pipe lock
	fuse: decrement NR_WRITEBACK_TEMP on the right page
	fuse: handle zero sized retrieve correctly
	dmaengine: imx-dma: fix wrong callback invoke
	usb: phy: am335x: fix race condition in _probe
	usb: gadget: udc: net2272: Fix bitwise and boolean operations
	KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
	KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
	perf/x86/intel/uncore: Add Node ID mask
	x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()
	perf/core: Don't WARN() for impossible ring-buffer sizes
	perf tests evsel-tp-sched: Fix bitwise operator
	mtd: rawnand: gpmi: fix MX28 bus master lockup problem
	signal: Always notice exiting tasks
	signal: Better detection of synchronous signals
	misc: vexpress: Off by one in vexpress_syscfg_exec()
	debugfs: fix debugfs_rename parameter checking
	mips: cm: reprime error cause
	MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled
	MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds
	ARM: iop32x/n2100: fix PCI IRQ mapping
	mac80211: ensure that mgmt tx skbs have tailroom for encryption
	drm/modes: Prevent division by zero htotal
	drm/vmwgfx: Fix setting of dma masks
	drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
	HID: debug: fix the ring buffer implementation
	NFC: nxp-nci: Include unaligned.h instead of access_ok.h
	Revert "cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)"
	libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
	xfrm: refine validation of template and selector families
	batman-adv: Avoid WARN on net_device without parent in netns
	batman-adv: Force mac header to start of data on xmit
	Revert "exec: load_script: don't blindly truncate shebang string"
	uapi/if_ether.h: prevent redefinition of struct ethhdr
	ARM: dts: da850-evm: Correct the sound card name
	ARM: dts: kirkwood: Fix polarity of GPIO fan lines
	gpio: pl061: handle failed allocations
	cifs: Limit memory used by lock request calls to a page
	Documentation/network: reword kernel version reference
	Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
	Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
	perf/core: Fix impossible ring-buffer sizes warning
	ALSA: hda - Add quirk for HP EliteBook 840 G5
	ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
	Input: bma150 - register input device after setting private data
	Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
	alpha: fix page fault handling for r16-r18 targets
	alpha: Fix Eiger NR_IRQS to 128
	tracing/uprobes: Fix output for multiple string arguments
	x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls
	signal: Restore the stop PTRACE_EVENT_EXIT
	x86/a.out: Clear the dump structure initially
	dm thin: fix bug where bio that overwrites thin block ignores FUA
	smsc95xx: Use skb_cow_head to deal with cloned skbs
	ch9200: use skb_cow_head() to deal with cloned skbs
	kaweth: use skb_cow_head() to deal with cloned skbs
	usb: dwc2: Remove unnecessary kfree
	pinctrl: msm: fix gpio-hog related boot issues
	uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define
	Linux 4.4.175

Change-Id: I41d95e9717106bcc9342573855fec8f823d9b28c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 9 insertions, 3 deletions

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index c73361859d11..9db7c80a74aa 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -4311,6 +4311,12 @@ static int smack_key_permission(key_ref_t key_ref,
 	int request = 0;
 	int rc;
 
+	/*
+	 * Validate requested permissions
+	 */
+	if (perm & ~KEY_NEED_ALL)
+		return -EINVAL;
+
 	keyp = key_ref_to_ptr(key_ref);
 	if (keyp == NULL)
 		return -EINVAL;
@@ -4330,10 +4336,10 @@ static int smack_key_permission(key_ref_t key_ref,
 	ad.a.u.key_struct.key = keyp->serial;
 	ad.a.u.key_struct.key_desc = keyp->description;
 #endif
-	if (perm & KEY_NEED_READ)
-		request = MAY_READ;
+	if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW))
+		request |= MAY_READ;
 	if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
-		request = MAY_WRITE;
+		request |= MAY_WRITE;
 	rc = smk_access(tkp, keyp->security, request, &ad);
 	rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
 	return rc;