Merge 5.4.156 into android11-5.4-lts

Changes in 5.4.156
	parisc: math-emu: Fix fall-through warnings
	net: switchdev: do not propagate bridge updates across bridges
	tee: optee: Fix missing devices unregister during optee_remove
	ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
	xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
	xtensa: xtfpga: Try software restart before simulating CPU reset
	NFSD: Keep existing listeners on portlist error
	dma-debug: fix sg checks in debug_dma_map_sg()
	ASoC: wm8960: Fix clock configuration on slave mode
	netfilter: ipvs: make global sysctl readonly in non-init netns
	lan78xx: select CRC32
	net: dsa: lantiq_gswip: fix register definition
	NIOS2: irqflags: rename a redefined register name
	net: hns3: reset DWRR of unused tc to zero
	net: hns3: add limit ets dwrr bandwidth cannot be 0
	net: hns3: disable sriov before unload hclge layer
	net: stmmac: Fix E2E delay mechanism
	net: enetc: fix ethtool counter name for PM0_TERR
	can: rcar_can: fix suspend/resume
	can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
	can: peak_pci: peak_pci_remove(): fix UAF
	can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer
	can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
	can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length
	can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes
	ceph: fix handling of "meta" errors
	ocfs2: fix data corruption after conversion from inline format
	ocfs2: mount fails with buffer overflow in strlen
	elfcore: correct reference to CONFIG_UML
	vfs: check fd has read access in kernel_read_file_from_fd()
	ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
	ALSA: hda/realtek: Add quirk for Clevo PC50HS
	ASoC: DAPM: Fix missing kctl change notifications
	audit: fix possible null-pointer dereference in audit_filter_rules
	powerpc64/idle: Fix SP offsets when saving GPRs
	KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
	KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest
	powerpc/idle: Don't corrupt back chain when going idle
	mm, slub: fix mismatch between reconstructed freelist depth and cnt
	mm, slub: fix potential memoryleak in kmem_cache_open()
	nfc: nci: fix the UAF of rf_conn_info object
	isdn: cpai: check ctr->cnr to avoid array index out of bound
	netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
	selftests: netfilter: remove stray bash debug line
	gcc-plugins/structleak: add makefile var for disabling structleak
	btrfs: deal with errors when checking if a dir entry exists during log replay
	net: stmmac: add support for dwmac 3.40a
	ARM: dts: spear3xx: Fix gmac node
	isdn: mISDN: Fix sleeping function called from invalid context
	platform/x86: intel_scu_ipc: Update timeout value in comment
	ALSA: hda: avoid write to STATESTS if controller is in reset
	Input: snvs_pwrkey - add clk handling
	scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
	net: mdiobus: Fix memory leak in __mdiobus_register
	tracing: Have all levels of checks prevent recursion
	ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
	pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()
	Linux 5.4.156

Signed-off-by: Greg Kroah-Hartman <[email protected]>
Change-Id: Ieddfb50beffee79c5ff9e9fc1d3241aa754929d0

fs/exec.c

@@ -988,7 +988,7 @@ int kernel_read_file_from_fd(int fd, void **buf, loff_t *size, loff_t max_size,
 	struct fd f = fdget(fd);
 	int ret = -EBADF;
 
-	if (!f.file)
+	if (!f.file || !(f.file->f_mode & FMODE_READ))
 		goto out;
 
 	ret = kernel_read_file(f.file, buf, size, max_size, id);