Merge remote-tracking branch '4.9/tmp-05a906d' into msm-4.9
* 4.9/tmp-05a906d:
Linux 4.9.56
Revert "socket, bpf: fix possible use after free"
Linux 4.9.55
KVM: x86: fix singlestepping over syscall
f2fs: don't allow encrypted operations without keys
ext4: don't allow encrypted operations without keys
ext4: Don't clear SGID when inheriting ACLs
ext4: fix data corruption for mmap writes
vfs: deny copy_file_range() for non regular files
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
mmc: core: add driver strength selection when selecting hs400es
nvme-pci: Use PCI bus address for data/queues in CMB
drm/i915/bios: ignore HDMI on port A
brcmfmac: setup passive scan if requested by user-space
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
scsi: sd: Do not override max_sectors_kb sysfs setting
iwlwifi: add workaround to disable wide channels in 5GHz
iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
netlink: fix nla_put_{u8,u16,u32} for KASAN
rocker: fix rocker_tlv_put_* functions for KASAN
HID: wacom: bits shifted too much for 9th and 10th buttons
HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
HID: wacom: leds: Don't try to control the EKR's read-only LEDs
HID: i2c-hid: allocate hid buffers for real worst case
ftrace: Fix kmemleak in unregister_ftrace_graph
stm class: Fix a use-after-free
Drivers: hv: fcopy: restore correct transfer length
driver core: platform: Don't read past the end of "driver_override" buffer
percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
powerpc/tm: Fix illegal TM state in signal handler
powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
socket, bpf: fix possible use after free
net: rtnetlink: fix info leak in RTM_GETSTATS call
tipc: use only positive error codes in messages
ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
ip6_gre: ip6gre_tap device should keep dst
netlink: do not proceed if dump's start() errs
net: Set sk_prot_creator when cloning sockets to the right proto
packet: only test po->has_vnet_hdr once in packet_snd
packet: in packet_do_bind, test fanout with bind_lock held
net: dsa: Fix network device registration order
tun: bail out from tun_get_user() if the skb is empty
l2tp: fix race condition in l2tp_tunnel_delete
l2tp: Avoid schedule while atomic in exit_net
vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
net: qcom/emac: specify the correct size when mapping a DMA buffer
net_sched: always reset qdisc backlog in qdisc_reset()
isdn/i4l: fetch the ppp_write buffer in one shot
bpf: one perf event close won't free bpf program attached by another perf event
packet: hold bind lock when rebinding to fanout hook
net: emac: Fix napi poll list corruption
tcp: fastopen: fix on syn-data transmit failure
net/sched: cls_matchall: fix crash when used with classful qdisc
ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
net: phy: Fix mask value write on gmii2rgmii converter speed register
ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
udpv6: Fix the checksum computation when HW checksum does not apply
tcp: fix data delivery rate
bpf/verifier: reject BPF_ALU64|BPF_END
tcp: update skb->skb_mstamp more carefully
sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
mlxsw: spectrum: Prevent mirred-related crash on removal
ALSA: usx2y: Suppress kernel warning at page allocation failures
Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
ALSA: compress: Remove unused variable
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
lib/ratelimit.c: use deferred printk() version
mm, oom_reaper: skip mm structs with mmu notifiers
staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
uwb: ensure that endpoint is interrupt
uwb: properly check kthread_run return value
iio: adc: mcp320x: Fix oops on module unload
iio: adc: mcp320x: Fix readout of negative voltages
iio: ad7793: Fix the serial interface reset
IIO: BME280: Updates to Humidity readings need ctrl_reg write!
iio: core: Return error for failed read_reg
staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
iio: ad_sigma_delta: Implement a dedicated reset function
iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
xhci: fix finding correct bus_state structure for USB 3.1 hosts
USB: fix out-of-bounds in usb_set_configuration
usb: Increase quirk delay for USB devices
USB: core: harden cdc_parse_cdc_header
USB: uas: fix bug in handling of alternate settings
USB: g_mass_storage: Fix deadlock when driver is unbound
usb: gadget: mass_storage: set msg_registered after msg registered
USB: devio: Don't corrupt user memory
USB: dummy-hcd: Fix erroneous synchronization change
USB: dummy-hcd: fix infinite-loop resubmission bug
USB: dummy-hcd: fix connection failures (wrong speed)
USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
usb: pci-quirks.c: Corrected timeout values used in handshake
ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
usb-storage: fix bogus hardware error messages for ATA pass-thru devices
usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
usb: gadget: udc: renesas_usb3: fix for no-data control transfer
usb: gadget: udc: atmel: set vbus irqflags explicitly
USB: gadgetfs: fix copy_to_user while holding spinlock
USB: gadgetfs: Fix crash caused by inadequate synchronization
Linux 4.9.54
s390/mm: make pmdp_invalidate() do invalidation only
ttpci: address stringop overflow warning
ALSA: au88x0: avoid theoretical uninitialized access
ASoC: rt5660: remove double const
ASoC: rt5659: drop double const
ASoC: rt5514: fix gcc-7 warning
ARM: remove duplicate 'const' annotations'
IB/qib: fix false-postive maybe-uninitialized warning
tools/power turbostat: bugfix: GFXMHz column not changing
ARM: dts: BCM5301X: Fix memory start address
libata: transport: Remove circular dependency at free time
ASoC: wm_adsp: Return an error on write to a disabled volatile control
xfs: remove kmem_zalloc_greedy
i2c: meson: fix wrong variable usage in meson_i2c_put_data
netfilter: nf_tables: set pktinfo->thoff at AH header if found
md/raid10: submit bio directly to replacement disk
rds: ib: add error handle
mm/cgroup: avoid panic when init with low memory
iommu/io-pgtable-arm: Check for leaf entry before dereferencing it
x86/acpi: Restore the order of CPU IDs
cpufreq: intel_pstate: Update pid_params.sample_rate_ns in pid_param_set()
ibmvnic: Free tx/rx scrq pointer array when releasing sub-crqs
nfs: make nfs4_cb_sv_ops static
parisc: perf: Fix potential NULL pointer dereference
netfilter: nfnl_cthelper: fix incorrect helper->expect_class_max
nvme-rdma: handle cpu unplug when re-establishing the controller
MIPS: smp-cps: Fix retrieval of VPE mask on big endian CPUs
exynos-gsc: Do not swap cb/cr for semi planar formats
iommu/exynos: Block SYSMMU while invalidating FLPD cache
MIPS: IRQ Stack: Unwind IRQ stack onto task stack
netfilter: invoke synchronize_rcu after set the _hook_ to NULL
drivers/rapidio/devices/tsi721.c: make module parameter variable name unique
kasan: do not sanitize kexec purgatory
hugetlbfs: initialize shared policy as part of inode allocation
sata_via: Enable hotplug only on VT6421
Btrfs: fix potential use-after-free for cloned bio
Btrfs: fix segmentation fault when doing dio read
bridge: netlink: register netdevice before executing changelink
mmc: sdio: fix alignment issue in struct sdio_func
qed: Fix possible system hang in the dcbnl-getdcbx() path.
net: dsa: b53: Include IMP/CPU port in dumb forwarding mode
udp: disable inner UDP checksum offloads in IPsec case
usb: plusb: Add support for PL-27A1
team: fix memory leaks
net/packet: check length in getsockopt() called with PACKET_HDRLEN
net: core: Prevent from dereferencing null pointer when releasing SKB
lkdtm: Fix Oops when unloading the module
mips: ath79: clock:- Unmap region obtained by of_iomap
MIPS: Lantiq: Fix another request_mem_region() return code check
HID: wacom: release the resources before leaving despite devm
drm: mali-dp: Fix transposed horizontal/vertical flip
drm: mali-dp: Fix destination size handling when rotating
ASoC: dapm: fix some pointer error handling
rtl8xxxu: Add additional USB IDs for rtl8192eu devices
usb: chipidea: vbus event may exist before starting gadget
iommu/arm-smmu: Set privileged attribute to 'default' instead of 'unprivileged'
spi: pxa2xx: Add support for Intel Gemini Lake
ath10k: prevent sta pointer rcu violation
audit: log 32-bit socketcalls
ASoC: dapm: handle probe deferrals
partitions/efi: Fix integer overflow in GPT size calculation
sfc: get PIO buffer size from the NIC
USB: serial: mos7840: fix control-message error handling
USB: serial: mos7720: fix control-message error handling
drm/amdkfd: fix improper return value on error
arm: dts: mt2701: Add subsystem clock controller device nodes
IB/ipoib: Replace list_del of the neigh->list with list_del_init
IB/ipoib: rtnl_unlock can not come after free_netdev
IB/ipoib: Fix deadlock over vlan_mutex
serial: 8250_port: Remove dangerous pr_debug()
tty: goldfish: Fix a parameter of a call to free_irq
serial: 8250: moxa: Store num_ports in brd
drm/i915/psr: disable psr2 for resolution greater than 32X20
ARM: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM
IB/rxe: Fix a MR reference leak in check_rkey()
IB/rxe: Add a runtime check in alloc_index()
iio: adc: hx711: Add DT binding for avia,hx711
iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL register modifications
iio: adc: imx25-gcq: Fix module autoload
hwmon: (gl520sm) Fix overflows and crash seen when writing into limit attributes
usb: make the MTK XHCI driver compile for older MIPS SoCs
clk/axs10x: Clear init field in driver probe
sh_eth: use correct name for ECMR_MPDE bit
reset: ti_syscon: fix a ti_syscon_reset_status issue
extcon: axp288: Use vbus-valid instead of -present to determine cable presence
igb: re-assign hw address pointer on reset after PCI error
ARM: dts: am335x-chilisom: Wakeup from RTC-only state by power on event
scsi: be2iscsi: Add checks to validate CID alloc/free
power: supply: axp288_fuel_gauge: Fix fuel_gauge_reg_readb return on error
MIPS: ralink: Fix incorrect assignment on ralink_soc
MIPS: ralink: Fix a typo in the pinmux setup.
MIPS: Ensure bss section ends on a long-aligned address
ARM: dts: r8a7790: Use R-Car Gen 2 fallback binding for msiof nodes
RDS: RDMA: Fix the composite message user notification
clk: sunxi-ng: fix PLL_CPUX adjusting on H3
ARM: dts: exynos: Add CPU OPPs for Exynos4412 Prime
drm/i915: Fix the overlay frontbuffer tracking
GFS2: Fix reference to ERR_PTR in gfs2_glock_iter_next
drm: bridge: add DT bindings for TI ths8135
drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define
FROMLIST: binder: fix use-after-free in binder_transaction()
FROMLIST: binder: fix an ret value override
FROMLIST: binder: fix memory corruption in binder_transaction binder
Conflicts:
mm/oom_kill.c
sound/usb/card.c
Change-Id: I8b32fbdaa2be959a4149cf07d0bda16b75eeacbc
Signed-off-by: Kyle Yan <kyan@codeaurora.org>