Merge tag 'v4.1.38' into 4.1-2.0.x-imx

Linux 4.1.38

* tag 'v4.1.38': (109 commits)
  Linux 4.1.38
  gro: Allow tunnel stacking in the case of FOU/GUE
  tunnels: Don't apply GRO to multiple layers of encapsulation.
  net: ipv4: Convert IP network timestamps to be y2038 safe
  ipip: Properly mark ipip GRO packets as encapsulated.
  sg_write()/bsg_write() is not fit to be called under KERNEL_DS
  fs: exec: apply CLOEXEC before changing dumpable task flags
  IB/cma: Fix a race condition in iboe_addr_get_sgid()
  Revert "ALSA: usb-audio: Fix race at stopping the stream"
  kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF)
  drivers/gpu/drm/ast: Fix infinite loop if read fails
  target/user: Fix use-after-free of tcmu_cmds if they are expired
  kernel/debug/debug_core.c: more properly delay for secondary CPUs
  scsi: avoid a permanent stop of the scsi device's request queue
  IB/multicast: Check ib_find_pkey() return value
  IPoIB: Avoid reading an uninitialized member variable
  block_dev: don't test bdev->bd_contains when it is not stable
  btrfs: limit async_work allocation and worker func duration
  mm/vmscan.c: set correct defer count for shrinker
  Input: drv260x - fix input device's parent assignment
  ...

1 files changed, 3 insertions, 0 deletions

diff --git a/block/bsg.c b/block/bsg.c
index d214e929ce18..b9a53615bdef 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -655,6 +655,9 @@ bsg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 
 	dprintk("%s: write %Zd bytes\n", bd->name, count);
 
+	if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
+		return -EINVAL;
+
 	bsg_set_block(bd, file);
 
 	bytes_written = 0;