Merge remote-tracking branch '4.9/tmp-951d823' into msm-4.9
* 4.9/tmp-951d823:
Linux 4.9.30
drm/i915/gvt: Disable access to stolen memory as a guest
drivers: char: mem: Check for address space wraparound with mmap()
nfsd: encoders mustn't use unitialized values in error cases
nfsd: fix undefined behavior in nfsd4_layout_verify
NFS: Use GFP_NOIO for two allocations in writeback
NFS: Fix use after free in write error path
NFSv4: Fix a hang in OPEN related to server reboot
drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
mtd: nand: add ooblayout for old hamming layout
mtd: nand: omap2: Fix partition creation via cmdline mtdparts
mtd: nand: orion: fix clk handling
PCI: Freeze PME scan before suspending devices
PCI: Only allow WC mmap on prefetchable resources
PCI: Fix another sanity check bug in /proc/pci mmap
PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
tracing/kprobes: Enforce kprobes teardown after testing
um: Fix to call read_initrd after init_bootmem
osf_wait4(): fix infoleak
MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
nvme: unmap CMB and remove sysfs file in reset path
genirq: Fix chained interrupt data ordering
uwb: fix device quirk on big-endian hosts
stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
metag/uaccess: Check access_ok in strncpy_from_user
metag/uaccess: Fix access_ok()
iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
staging: rtl8192e: GetTs Fix invalid TID 7 warning.
staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
arm64: documentation: document tagged pointer stack constraints
arm64: uaccess: ensure extension of access_ok() addr
arm64: armv8_deprecated: ensure extension of addr
arm64: ensure extension of smp_store_release value
arm64: xchg: hazard against entire exchange variable
arm64: dts: hi6220: Reset the mmc hosts
ARM: dts: imx6sx-sdb: Remove OPP override
ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
ARM: dts: at91: sama5d3_xplained: fix ADC vref
ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
ARM: 8662/1: module: split core and init PLT sections
KVM: arm: plug potential guest hardware debug leakage
arm: KVM: Do not use stack-protector to compile HYP code
arm64: KVM: Do not use stack-protector to compile EL2 code
powerpc/tm: Fix FP and VMX register corruption
powerpc/64e: Fix hang when debugging programs with relocated kernel
powerpc/iommu: Do not call PageTransHuge() on tail pages
powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
powerpc/book3s/mce: Move add_taint() later in virtual mode
powerpc/eeh: Avoid use after free in eeh_handle_special_event()
powerpc/mm: Ensure IRQs are off in switch_mm()
cx231xx-cards: fix NULL-deref at probe
cx231xx-audio: fix NULL-deref at probe
cx231xx-audio: fix init error path
dw2102: limit messages to buffer size
digitv: limit messages to buffer size
dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
zr364xx: enforce minimum size when reading header
dib0700: fix NULL-deref at probe
s5p-mfc: Fix unbalanced call to clock management
gspca: konica: add missing endpoint sanity check
s5p-mfc: Fix race between interrupt routine and device functions
iio: hid-sensor: Store restore poll and hysteresis on S3
iio: proximity: as3935: fix as3935_write
ipx: call ipxitf_put() in ioctl error path
USB: hub: fix non-SS hub-descriptor handling
USB: hub: fix SS hub-descriptor handling
USB: serial: io_ti: fix div-by-zero in set_termios
USB: serial: mct_u232: fix big-endian baud-rate handling
USB: serial: qcserial: add more Lenovo EM74xx device IDs
usb: serial: option: add Telit ME910 support
USB: iowarrior: fix info ioctl on big-endian hosts
usb: musb: Fix trying to suspend while active for OTG configurations
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
usb: dwc3: gadget: Prevent losing events in event cache
dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
ttusb2: limit messages to buffer size
mceusb: fix NULL-deref at probe
usbvision: fix NULL-deref at probe
net: irda: irda-usb: fix firmware name on big-endian hosts
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
usb: host: xhci-plat: propagate return value of platform_get_irq()
xhci: remove GFP_DMA flag from allocation
libnvdimm: fix clear length of nvdimm_forget_poison()
fscrypt: avoid collisions when presenting long encrypted filenames
f2fs: check entire encrypted bigname when finding a dentry
USB: chaoskey: fix Alea quirk on big-endian hosts
USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
USB: serial: ftdi_sio: fix setting latency for unprivileged users
pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
IB/hfi1: Fix a subcontext memory leak
IB/hfi1: Return an error on memory allocation failure
IIO: bmp280-core.c: fix error in humidity calculation
iio: dac: ad7303: fix channel description
ibmvscsis: Do not send aborted task response
of: fdt: add missing allocation-failure check
of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
of: fix sparse warning in of_pci_range_parser_one
proc: Fix unbalanced hard link numbers
cxl: Route eeh events to all drivers in cxl_pci_error_detected()
cxl: Force context lock during EEH flow
ohci-pci: add qemu quirk
cdc-acm: fix possible invalid access when processing notification
gpio: omap: return error if requested debounce time is not possible
drm/nouveau/tmr: handle races with hw when updating the next alarm time
drm/nouveau/tmr: avoid processing completed alarms when adding a new one
drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
drm/nouveau/tmr: ack interrupt before processing alarms
drm/nouveau/therm: remove ineffective workarounds for alarm bugs
drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
drm/amdgpu: Make display watermark calculations more accurate
ath9k_htc: fix NULL-deref at probe
ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
s390/cputime: fix incorrect system time
s390/kdump: Add final note
regulator: tps65023: Fix inverted core enable logic.
regulator: rk808: Fix RK818 LDO2
x86: fix 32-bit case of __get_user_asm_u64()
KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
KVM: x86: Fix potential preemption when get the current kvmclock timestamp
KVM: x86: Fix load damaged SSEx MXCSR register
ima: accept previously set IMA_NEW_FILE
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
mwifiex: MAC randomization should not be persistent
rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
md: update slab_cache before releasing new stripes when stripes resizing
dm space map disk: fix some book keeping in the disk space map
dm thin metadata: call precommit before saving the roots
dm bufio: make the parameter "retain_bytes" unsigned long
dm cache metadata: fail operations if fail_io mode has been established
dm mpath: split and rename activate_path() to prepare for its expanded use
dm bufio: check new buffer allocation watermark every 30 seconds
dm bufio: avoid a possible ABBA deadlock
dm raid: select the Kconfig option CONFIG_MD_RAID0
dm btree: fix for dm_btree_find_lowest_key()
infiniband: call ipv6 route lookup via the stub interface
mlx5: Fix mlx5_ib_map_mr_sg mr length
ASoC: cs4271: configure reset GPIO as output
tpm_crb: check for bad response size
tpm: add sleep only for retry in i2c_nuvoton_write_status()
tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
tpm_tis_spi: Add small delay after last transfer
tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
tpm_tis_spi: Check correct byte for wait state indicator
tpm_tis_spi: Abort transfer when too many wait states are signaled
tpm_tis_spi: Use single function to transfer data
fanotify: don't expose EOPENSTALE to userspace
ARM: tegra: paz00: Mark panel regulator as enabled on boot
ALSA: hda: Fix cpu lockup when stopping the cmd dmas
tpm_tis_core: Choose appropriate timeout for reading burstcount
USB: core: replace %p with %pK
char: lp: fix possible integer overflow in lp_setup()
watchdog: pcwd_usb: fix NULL-deref at probe
USB: ene_usb6250: fix DMA to the stack
usb: misc: legousbtower: Fix memory leak
usb: misc: legousbtower: Fix buffers on stack
UPSTREAM: drm/fb_cma_helper: Add missing forward declaration
ANDROID: uid_sys_stats: defer io stats calulation for dead tasks
BACKPORT: drm/fence: fix memory overwrite when setting out_fence fd
BACKPORT: drm/fence: add drm_crtc_create_fence()
UPSTREAM: drm/fences: add DOC: for explicit fencing
UPSTREAM: drm/atomic: Fix double free in drm_atomic_state_default_clear
BACKPORT: drm/fence: add out-fences support
BACKPORT: drm/fence: add fence timeline to drm_crtc
BACKPORT: drm/fence: add in-fences support
BACKPORT: dma-buf: Use fence_get_rcu_safe() for retrieving the exclusive fence
BACKPORT: drm/fb_cma_helper: Add drm_fb_cma_prepare_fb() helper
BACKPORT: drm/atomic: add drm_atomic_set_fence_for_plane()
UPSTREAM: dma-buf: Update kerneldoc for sync_file_create
UPSTREAM: Revert "dma-buf/sync-file: Avoid enable fence signaling if poll(.timeout=0)"
UPSTREAM: reservation: revert "wait only with non-zero timeout specified (v3)" v2
BACKPORT: dma-buf/fence: revert "don't wait when specified timeout is zero" (v2)
UPSTREAM: dma-buf/sw_sync: put fence reference from the fence creation
UPSTREAM: dma-buf/fence: add an lockdep_assert_held()
UPSTREAM: dma-buf/sync_file: hold reference to fence when creating sync_file
UPSTREAM: drm/fence: release fence reference when canceling event
UPSTREAM: dma-buf: Restart reservation_object_test_signaled_rcu() after writes
UPSTREAM: dma-buf: Restart reservation_object_wait_timeout_rcu() after writes
UPSTREAM: dma-buf: Restart reservation_object_get_fences_rcu() after writes
UPSTREAM: dma-buf: Introduce fence_get_rcu_safe()
ANDROID: sdcardfs: Check for NULL in revalidate
ANDROID: Add CGROUP_BPF to android base config
BACKPORT: UPSTREAM: bpf: pass sk to helper functions
BACKPORT: UPSTREAM: Add a eBPF helper function to retrieve socket uid
BACKPORT: UPSTREAM: Add a helper function to get socket cookie in eBPF
ANDROID: Fix missing uapi headers
UPSTREAM: cgroup: Fix CGROUP_BPF config
UPSTREAM: samples: bpf: add userspace example for attaching eBPF programs to cgroups
UPSTREAM: net: ipv4, ipv6: run cgroup eBPF egress programs
UPSTREAM: net: filter: run cgroup eBPF ingress programs
UPSTREAM: bpf: add BPF_PROG_ATTACH and BPF_PROG_DETACH commands
UPSTREAM: cgroup: add support for eBPF programs
UPSTREAM: bpf: add new prog type for cgroup socket filtering
Change-Id: Ic92b4df2a2fd08d1ec4bbcf6a5d6e100acfa5b61
Signed-off-by: Kyle Yan <kyan@codeaurora.org>