commit 80c1c8322c331586a86e58d3f95026a1265ab396
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Feb 22 15:43:56 2018 +0100

    Linux 4.9.83

commit 08e4d04569874f79963a40890e790d2b4c33ed30
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Nov 30 06:08:05 2017 -0500

    media: r820t: fix r820t_write_reg for KASAN
    
    commit 16c3ada89cff9a8c2a0eea34ffa1aa20af3f6008 upstream.
    
    With CONFIG_KASAN, we get an overly long stack frame due to inlining
    the register access functions:
    
    drivers/media/tuners/r820t.c: In function 'generic_set_freq.isra.7':
    drivers/media/tuners/r820t.c:1334:1: error: the frame size of 2880 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
    
    This is caused by a gcc bug that has now been fixed in gcc-8.
    To work around the problem, we can pass the register data
    through a local variable that older gcc versions can optimize
    out as well.
    
    Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715
    
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 30c68fb6582728657000627af186a99280c50721
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Tue Jan 2 08:57:17 2018 +0100

    ARM: dts: Delete bogus reference to the charlcd
    
    commit 586b2a4befad88cd87b372a1cea01e58c6811ea9 upstream.
    
    The EB MP board probably has a character LCD but the board manual does
    not really state which IRQ it has assigned to this device. The invalid
    assignment was a mistake by me during submission of the DTSI where I was
    looking for the reference, didn't find it and didn't fill it in.
    
    Delete this for now: it can probably be fixed but that requires access
    to the actual board for some trial-and-error experiments.
    
    Reported-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Olof Johansson <olof@lixom.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cc98b53d798024d10aa863f4a42bb6ff8bea6615
Author: Matthias Brugger <matthias.bgg@gmail.com>
Date:   Fri Dec 1 13:07:08 2017 +0100

    arm: dts: mt2701: Add reset-cells
    
    commit ae72e95b5e4ded145bfc6926ad9457b74e3af41a upstream.
    
    The hifsys and ethsys needs the definition of the reset-cells
    property. Fix this.
    
    Reviewed-by: Rob Herring <robh@kernel.org>
    Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 677adefd395e12e957e58c0cbe8017fffde18ede
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Wed Jan 10 17:10:11 2018 +0100

    ARM: dts: s5pv210: add interrupt-parent for ohci
    
    commit 5c1037196b9ee75897c211972de370ed1336ec8f upstream.
    
    The ohci-hcd node has an interrupt number but no interrupt-parent,
    leading to a warning with current dtc versions:
    
    arch/arm/boot/dts/s5pv210-aquila.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000
    arch/arm/boot/dts/s5pv210-goni.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000
    arch/arm/boot/dts/s5pv210-smdkc110.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000
    arch/arm/boot/dts/s5pv210-smdkv210.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000
    arch/arm/boot/dts/s5pv210-torbreck.dtb: Warning (interrupts_property): Missing interrupt-parent for /soc/ohci@ec300000
    
    As seen from the related exynos dts files, the ohci and ehci controllers
    always share one interrupt number, and the number is the same here as
    well, so setting the same interrupt-parent is the reasonable solution
    here.
    
    Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 37ed2c8e496727675e71eaf9f5cc44a43cf4596a
Author: Bjorn Andersson <bjorn.andersson@linaro.org>
Date:   Tue Nov 7 19:45:01 2017 -0800

    arm64: dts: msm8916: Add missing #phy-cells
    
    commit b0ab681285aa66064f2de5b74191c0cabba381ff upstream.
    
    Add a missing #phy-cells to the dsi-phy, to silence dtc warning.
    
    Cc: Archit Taneja <architt@codeaurora.org>
    Fixes: 305410ffd1b2 ("arm64: dts: msm8916: Add display support")
    Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Reviewed-by: Archit Taneja <architt@codeaurora.org>
    Signed-off-by: Andy Gross <andy.gross@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 53e0f2656e81913d9d78b20f00016e109ead44fd
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Wed Jan 10 15:40:37 2018 +0100

    ARM: pxa/tosa-bt: add MODULE_LICENSE tag
    
    commit 3343647813fdf0f2409fbf5816ee3e0622168079 upstream.
    
    Without this tag, we get a build warning:
    
    WARNING: modpost: missing MODULE_LICENSE() in arch/arm/mach-pxa/tosa-bt.o
    
    For completeness, I'm also adding author and description fields.
    
    Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c7bbb6d4c41a8fe36b671010defd89d96ae59637
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Dec 21 22:30:07 2017 +0100

    ARM: dts: exynos: fix RTC interrupt for exynos5410
    
    commit 5628a8ca14149ba4226e3bdce3a04c3b688435ad upstream.
    
    According to the comment added to exynos_dt_pmu_match[] in commit
    8b283c025443 ("ARM: exynos4/5: convert pmu wakeup to stacked domains"),
    the RTC is not able to wake up the system through the PMU on Exynos5410,
    unlike Exynos5420.
    
    However, when the RTC DT node got added, it was a straight copy of
    the Exynos5420 node, which now causes a warning from dtc.
    
    This removes the incorrect interrupt-parent, which should get the
    interrupt working and avoid the warning.
    
    Fixes: e1e146b1b062 ("ARM: dts: exynos: Add RTC and I2C to Exynos5410")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 012e79b98f1a5eead31ea465518af35700a64c10
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Apr 2 17:10:08 2017 -0700

    vfs: don't do RCU lookup of empty pathnames
    
    commit c0eb027e5aef70b71e5a38ee3e264dc0b497f343 upstream.
    
    Normal pathname lookup doesn't allow empty pathnames, but using
    AT_EMPTY_PATH (with name_to_handle_at() or fstatat(), for example) you
    can trigger an empty pathname lookup.
    
    And not only is the RCU lookup in that case entirely unnecessary
    (because we'll obviously immediately finalize the end result), it is
    actively wrong.
    
    Why? An empth path is a special case that will return the original
    'dirfd' dentry - and that dentry may not actually be RCU-free'd,
    resulting in a potential use-after-free if we were to initialize the
    path lazily under the RCU read lock and depend on complete_walk()
    finalizing the dentry.
    
    Found by syzkaller and KASAN.
    
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
    Acked-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Eric Biggers <ebiggers3@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 95a440bc9f4dd1a865dfa00c49b664b951a492a3
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Thu Feb 15 16:16:57 2018 +0100

    x86: fix build warnign with 32-bit PAE
    
    I ran into a 4.9 build warning in randconfig testing, starting with the
    KAISER patches:
    
    arch/x86/kernel/ldt.c: In function 'alloc_ldt_struct':
    arch/x86/include/asm/pgtable_types.h:208:24: error: large integer implicitly truncated to unsigned type [-Werror=overflow]
     #define __PAGE_KERNEL  (__PAGE_KERNEL_EXEC | _PAGE_NX)
                            ^
    arch/x86/kernel/ldt.c:81:6: note: in expansion of macro '__PAGE_KERNEL'
          __PAGE_KERNEL);
          ^~~~~~~~~~~~~
    
    I originally ran into this last year when the patches were part of linux-next,
    and tried to work around it by using the proper 'pteval_t' types consistently,
    but that caused additional problems.
    
    This takes a much simpler approach, and makes the argument type of the dummy
    helper always 64-bit, which is wide enough for any page table layout and
    won't hurt since this call is just an empty stub anyway.
    
    Fixes: 8f0baadf2bea ("kaiser: merged update")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Acked-by: Kees Cook <keescook@chromium.org>
    Acked-by: Hugh Dickins <hughd@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aa72eecb4b0d11c3e198707440c5a97a56e7050f
Author: Gustavo A. R. Silva <garsilva@embeddedor.com>
Date:   Tue Feb 13 13:22:08 2018 -0600

    x86/cpu: Change type of x86_cache_size variable to unsigned int
    
    commit 24dbc6000f4b9b0ef5a9daecb161f1907733765a upstream.
    
    Currently, x86_cache_size is of type int, which makes no sense as we
    will never have a valid cache size equal or less than 0. So instead of
    initializing this variable to -1, it can perfectly be initialized to 0
    and use it as an unsigned variable instead.
    
    Suggested-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Addresses-Coverity-ID: 1464429
    Link: http://lkml.kernel.org/r/20180213192208.GA26414@embeddedor.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 14eb41363919106e50092ed85acb682f30b898bd
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Wed Feb 14 10:14:17 2018 +0300

    x86/spectre: Fix an error message
    
    commit 9de29eac8d2189424d81c0d840cd0469aa3d41c8 upstream.
    
    If i == ARRAY_SIZE(mitigation_options) then we accidentally print
    garbage from one space beyond the end of the mitigation_options[] array.
    
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@suse.de>
    Cc: David Woodhouse <dwmw@amazon.co.uk>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: KarimAllah Ahmed <karahmed@amazon.de>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: kernel-janitors@vger.kernel.org
    Fixes: 9005c6834c0f ("x86/spectre: Simplify spectre_v2 command line parsing")
    Link: http://lkml.kernel.org/r/20180214071416.GA26677@mwanda
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 06be007aa436aae3200ca31fc13fb66568e4ac4b
Author: Jia Zhang <qianyue.zj@alibaba-inc.com>
Date:   Mon Jan 1 09:52:10 2018 +0800

    x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
    
    commit b399151cb48db30ad1e0e93dd40d68c6d007b637 upstream.
    
    x86_mask is a confusing name which is hard to associate with the
    processor's stepping.
    
    Additionally, correct an indent issue in lib/cpu.c.
    
    Signed-off-by: Jia Zhang <qianyue.zj@alibaba-inc.com>
    [ Updated it to more recent kernels. ]
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: bp@alien8.de
    Cc: tony.luck@intel.com
    Link: http://lkml.kernel.org/r/1514771530-70829-1-git-send-email-qianyue.zj@alibaba-inc.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b0809f54222508397a240e83f52ae165b5f21a73
Author: Rui Wang <rui.y.wang@intel.com>
Date:   Mon Dec 18 16:34:10 2017 +0800

    selftests/x86/mpx: Fix incorrect bounds with old _sigfault
    
    commit 961888b1d76d84efc66a8f5604b06ac12ac2f978 upstream.
    
    For distributions with old userspace header files, the _sigfault
    structure is different. mpx-mini-test fails with the following
    error:
    
      [root@Purley]# mpx-mini-test_64 tabletest
      XSAVE is supported by HW & OS
      XSAVE processor supported state mask: 0x2ff
      XSAVE OS supported state mask: 0x2ff
       BNDREGS: size: 64 user: 1 supervisor: 0 aligned: 0
        BNDCSR: size: 64 user: 1 supervisor: 0 aligned: 0
      starting mpx bounds table test
      ERROR: siginfo bounds do not match shadow bounds for register 0
    
    Fix it by using the correct offset of _lower/_upper in _sigfault.
    RHEL needs this patch to work.
    
    Signed-off-by: Rui Wang <rui.y.wang@intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: dave.hansen@linux.intel.com
    Fixes: e754aedc26ef ("x86/mpx, selftests: Add MPX self test")
    Link: http://lkml.kernel.org/r/1513586050-1641-1-git-send-email-rui.y.wang@intel.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 90ca269463c55e99e3e91c667a821c6303f207ec
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Tue Feb 13 14:28:19 2018 +0100

    x86/speculation: Add <asm/msr-index.h> dependency
    
    commit ea00f301285ea2f07393678cd2b6057878320c9d upstream.
    
    Joe Konno reported a compile failure resulting from using an MSR
    without inclusion of <asm/msr-index.h>, and while the current code builds
    fine (by accident) this needs fixing for future patches.
    
    Reported-by: Joe Konno <joe.konno@linux.intel.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: arjan@linux.intel.com
    Cc: bp@alien8.de
    Cc: dan.j.williams@intel.com
    Cc: dave.hansen@linux.intel.com
    Cc: dwmw2@infradead.org
    Cc: dwmw@amazon.co.uk
    Cc: gregkh@linuxfoundation.org
    Cc: hpa@zytor.com
    Cc: jpoimboe@redhat.com
    Cc: linux-tip-commits@vger.kernel.org
    Cc: luto@kernel.org
    Fixes: 20ffa1caecca ("x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support")
    Link: http://lkml.kernel.org/r/20180213132819.GJ25201@hirez.programming.kicks-ass.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 297f8eafece7c4fcabe60b7fc445d497541487e2
Author: Will Deacon <will.deacon@arm.com>
Date:   Mon Feb 5 14:16:06 2018 +0000

    nospec: Move array_index_nospec() parameter checking into separate macro
    
    commit 8fa80c503b484ddc1abbd10c7cb2ab81f3824a50 upstream.
    
    For architectures providing their own implementation of
    array_index_mask_nospec() in asm/barrier.h, attempting to use WARN_ONCE() to
    complain about out-of-range parameters using WARN_ON() results in a mess
    of mutually-dependent include files.
    
    Rather than unpick the dependencies, simply have the core code in nospec.h
    perform the checking for us.
    
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Acked-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: http://lkml.kernel.org/r/1517840166-15399-1-git-send-email-will.deacon@arm.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit be1ea502e31a47e3afd1c82964f35c78c80d271e
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Tue Feb 6 18:22:40 2018 -0800

    x86/speculation: Fix up array_index_nospec_mask() asm constraint
    
    commit be3233fbfcb8f5acb6e3bcd0895c3ef9e100d470 upstream.
    
    Allow the compiler to handle @size as an immediate value or memory
    directly rather than allocating a register.
    
    Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Link: http://lkml.kernel.org/r/151797010204.1289.1510000292250184993.stgit@dwillia2-desk3.amr.corp.intel.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 191752d5d3d0a670842e6fb35291c98f8f818b66
Author: Dominik Brodowski <linux@dominikbrodowski.net>
Date:   Tue Feb 13 09:13:21 2018 +0100

    selftests/x86: Do not rely on "int $0x80" in single_step_syscall.c
    
    commit 4105c69703cdeba76f384b901712c9397b04e9c2 upstream.
    
    On 64-bit builds, we should not rely on "int $0x80" working (it only does if
    CONFIG_IA32_EMULATION=y is enabled). To keep the "Set TF and check int80"
    test running on 64-bit installs with CONFIG_IA32_EMULATION=y enabled, build
    this test only if we can also build 32-bit binaries (which should be a
    good approximation for that).
    
    Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Dmitry Safonov <dsafonov@virtuozzo.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-kselftest@vger.kernel.org
    Cc: shuah@kernel.org
    Link: http://lkml.kernel.org/r/20180211111013.16888-5-linux@dominikbrodowski.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0472707cf4111fee248b212dd50691ad52427f45
Author: Dominik Brodowski <linux@dominikbrodowski.net>
Date:   Sun Feb 11 12:10:11 2018 +0100

    selftests/x86: Do not rely on "int $0x80" in test_mremap_vdso.c
    
    commit 2cbc0d66de0480449c75636f55697c7ff3af61fc upstream.
    
    On 64-bit builds, we should not rely on "int $0x80" working (it only does if
    CONFIG_IA32_EMULATION=y is enabled).
    
    Without this patch, the move test may succeed, but the "int $0x80" causes
    a segfault, resulting in a false negative output of this self-test.
    
    Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Dmitry Safonov <dsafonov@virtuozzo.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-kselftest@vger.kernel.org
    Cc: shuah@kernel.org
    Link: http://lkml.kernel.org/r/20180211111013.16888-4-linux@dominikbrodowski.net
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 60d7b9c7961bc2acc95280212b981f0e5686d586
Author: Ingo Molnar <mingo@kernel.org>
Date:   Tue Feb 13 08:26:17 2018 +0100

    selftests/x86/pkeys: Remove unused functions
    
    commit ce676638fe7b284132a7d7d5e7e7ad81bab9947e upstream.
    
    This also gets rid of two build warnings:
    
      protection_keys.c: In function ‘dumpit’:
      protection_keys.c:419:3: warning: ignoring return value of ‘write’, declared with attribute warn_unused_result [-Wunused-result]
         write(1, buf, nr_read);
         ^~~~~~~~~~~~~~~~~~~~~~
    
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Shuah Khan <shuahkh@osg.samsung.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3aad6fe914e49d71e725e4b231f082593cf38260
Author: Ingo Molnar <mingo@kernel.org>
Date:   Tue Feb 13 09:03:08 2018 +0100

    x86/speculation: Clean up various Spectre related details
    
    commit 21e433bdb95bdf3aa48226fd3d33af608437f293 upstream.
    
    Harmonize all the Spectre messages so that a:
    
        dmesg | grep -i spectre
    
    ... gives us most Spectre related kernel boot messages.
    
    Also fix a few other details:
    
     - clarify a comment about firmware speculation control
    
     - s/KPTI/PTI
    
     - remove various line-breaks that made the code uglier
    
    Acked-by: David Woodhouse <dwmw@amazon.co.uk>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Arjan van de Ven <arjan@linux.intel.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96652962e667387964b5e997811043dd1e698e84
Author: KarimAllah Ahmed <karahmed@amazon.de>
Date:   Sat Feb 10 23:39:25 2018 +0000

    X86/nVMX: Properly set spec_ctrl and pred_cmd before merging MSRs
    
    commit 206587a9fb764d71f035dc7f6d3b6488f5d5b304 upstream.
    
    These two variables should check whether SPEC_CTRL and PRED_CMD are
    supposed to be passed through to L2 guests or not. While
    msr_write_intercepted_l01 would return 'true' if it is not passed through.
    
    So just invert the result of msr_write_intercepted_l01 to implement the
    correct semantics.
    
    Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
    Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
    Reviewed-by: Jim Mattson <jmattson@google.com>
    Acked-by: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Arjan van de Ven <arjan@linux.intel.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Radim Krčmář <rkrcmar@redhat.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: arjan.van.de.ven@intel.com
    Cc: dave.hansen@intel.com
    Cc: kvm@vger.kernel.org
    Cc: sironi@amazon.de
    Fixes: 086e7d4118cc ("KVM: VMX: Allow direct access to MSR_IA32_SPEC_CTRL")
    Link: http://lkml.kernel.org/r/1518305967-31356-5-git-send-email-dwmw@amazon.co.uk
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7b9dd0d16070cd5f38f4ff9dec7b8651e78f3a0e
Author: David Woodhouse <dwmw@amazon.co.uk>
Date:   Sat Feb 10 23:39:24 2018 +0000

    KVM/x86: Reduce retpoline performance impact in slot_handle_level_range(), by always inlining iterator helper methods
    
    commit 928a4c39484281f8ca366f53a1db79330d058401 upstream.
    
    With retpoline, tight loops of "call this function for every XXX" are
    very much pessimised by taking a prediction miss *every* time. This one
    is by far the biggest contributor to the guest launch time with retpoline.
    
    By marking the iterator slot_handle_…() functions always_inline, we can
    ensure that the indirect function call can be optimised away into a
    direct call and it actually generates slightly smaller code because
    some of the other conditionals can get optimised away too.
    
    Performance is now pretty close to what we see with nospectre_v2 on
    the command line.
    
    Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
    Tested-by: Filippo Sironi <sironi@amazon.de>
    Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
    Reviewed-by: Filippo Sironi <sironi@amazon.de>
    Acked-by: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Arjan van de Ven <arjan@linux.intel.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: arjan.van.de.ven@intel.com
    Cc: dave.hansen@intel.com
    Cc: jmattson@google.com
    Cc: karahmed@amazon.de
    Cc: kvm@vger.kernel.org
    Cc: rkrcmar@redhat.com
    Link: http://lkml.kernel.org/r/1518305967-31356-4-git-send-email-dwmw@amazon.co.uk
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 765b60870ae6d2c51ad985b62fcbc60e0c62c824
Author: David Woodhouse <dwmw@amazon.co.uk>
Date:   Mon Feb 12 15:27:34 2018 +0000

    x86/speculation: Correct Speculation Control microcode blacklist again
    
    commit d37fc6d360a404b208547ba112e7dabb6533c7fc upstream.
    
    Arjan points out that the Intel document only clears the 0xc2 microcode
    on *some* parts with CPUID 506E3 (INTEL_FAM6_SKYLAKE_DESKTOP stepping 3).
    For the Skylake H/S platform it's OK but for Skylake E3 which has the
    same CPUID it isn't (yet) cleared.
    
    So removing it from the blacklist was premature. Put it back for now.
    
    Also, Arjan assures me that the 0x84 microcode for Kaby Lake which was
    featured in one of the early revisions of the Intel document was never
    released to the public, and won't be until/unless it is also validated
    as safe. So those can change to 0x80 which is what all *other* versions
    of the doc have identified.
    
    Once the retrospective testing of existing public microcodes is done, we
    should be back into a mode where new microcodes are only released in
    batches and we shouldn't even need to update the blacklist for those
    anyway, so this tweaking of the list isn't expected to be a thing which
    keeps happening.
    
    Requested-by: Arjan van de Ven <arjan.van.de.ven@intel.com>
    Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Arjan van de Ven <arjan@linux.intel.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: arjan.van.de.ven@intel.com
    Cc: dave.hansen@intel.com
    Cc: kvm@vger.kernel.org
    Cc: pbonzini@redhat.com
    Link: http://lkml.kernel.org/r/1518449255-2182-1-git-send-email-dwmw@amazon.co.uk
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 70f822be66083155a96c157825907dfeffc621cd
Author: David Woodhouse <dwmw@amazon.co.uk>
Date:   Sat Feb 10 23:39:22 2018 +0000

    x86/speculation: Update Speculation Control microcode blacklist
    
    commit 1751342095f0d2b36fa8114d8e12c5688c455ac4 upstream.
    
    Intel have retroactively blessed the 0xc2 microcode on Skylake mobile
    and desktop parts, and the Gemini Lake 0x22 microcode is apparently fine
    too. We blacklisted the latter purely because it was present with all
    the other problematic ones in the 2018-01-08 release, but now it's
    explicitly listed as OK.
    
    We still list 0x84 for the various Kaby Lake / Coffee Lake parts, as
    that appeared in one version of the blacklist and then reverted to
    0x80 again. We can change it if 0x84 is actually announced to be safe.
    
    Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Arjan van de Ven <arjan@linux.intel.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dan Williams <dan.j.williams@intel.com>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: arjan.van.de.ven@intel.com
    Cc: jmattson@google.com
    Cc: karahmed@amazon.de
    Cc: kvm@vger.kernel.org
    Cc: pbonzini@redhat.com
    Cc: rkrcmar@redhat.com
    Cc: sironi@amazon.de
    Link: http://lkml.kernel.org/r/1518305967-31356-2-git-send-email-dwmw@amazon.co.uk
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3740b9f09a94660636e33bb1aa577ad8702ca7b6
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date:   Thu Feb 1 11:21:58 2018 +0100

    compiler-gcc.h: Introduce __optimize function attribute
    
    commit df5d45aa08f848b79caf395211b222790534ccc7 upstream.
    
    Create a new function attribute __optimize, which allows to specify an
    optimization level on a per-function basis.
    
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7b559f7f08a835ff0e720afb67c18db3e1bf1b86
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Mon Feb 5 17:18:17 2018 -0800

    x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface
    
    commit 6b8cf5cc9965673951f1ab3f0e3cf23d06e3e2ee upstream.
    
    At entry userspace may have populated registers with values that could
    otherwise be useful in a speculative execution attack. Clear them to
    minimize the kernel's attack surface.
    
    Originally-From: Andi Kleen <ak@linux.intel.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Cc: <stable@vger.kernel.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Link: http://lkml.kernel.org/r/151787989697.7847.4083702787288600552.stgit@dwillia2-desk3.amr.corp.intel.com
    [ Made small improvements to the changelog. ]
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c1a5f89b138321e3645af2603efaef1197125660
Author: Viresh Kumar <viresh.kumar@linaro.org>
Date:   Thu Jan 11 11:28:53 2018 +0530

    arm: spear13xx: Fix spics gpio controller's warning
    
    commit f8975cb1b8a36d0839b6365235778dd9df1d04ca upstream.
    
    This fixes the following warning by also sending the flags argument for
    gpio controllers:
    
    Property 'cs-gpios', cell 6 is not a phandle reference in
    /ahb/apb/spi@e0100000
    
    Fixes: 8113ba917dfa ("ARM: SPEAr: DT: Update device nodes")
    Cc: stable@vger.kernel.org # v3.8+
    Reported-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Olof Johansson <olof@lixom.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e55af9d39b6f649a815080005ceb766e5acf08f4
Author: Viresh Kumar <viresh.kumar@linaro.org>
Date:   Thu Jan 11 11:28:52 2018 +0530

    arm: spear13xx: Fix dmas cells
    
    commit cdd10409914184c7eee5ae3e11beb890c9c16c61 upstream.
    
    The "dmas" cells for the designware DMA controller need to have only 3
    properties apart from the phandle: request line, src master and
    destination master. But the commit 6e8887f60f60 updated it incorrectly
    while moving from platform code to DT. Fix it.
    
    Cc: stable@vger.kernel.org # v3.10+
    Fixes: 6e8887f60f60 ("ARM: SPEAr13xx: Pass generic DW DMAC platform data from DT")
    Reported-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Olof Johansson <olof@lixom.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 65eacaf594d32d2a60003df23c17b8e24fbeee58
Author: Viresh Kumar <viresh.kumar@linaro.org>
Date:   Thu Jan 11 11:28:51 2018 +0530

    arm: spear600: Add missing interrupt-parent of rtc
    
    commit 6ffb5b4f248fe53e0361b8cbc2a523b432566442 upstream.
    
    The interrupt-parent of rtc was missing, add it.
    
    Fixes: 8113ba917dfa ("ARM: SPEAr: DT: Update device nodes")
    Cc: stable@vger.kernel.org # v3.8+
    Reported-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Olof Johansson <olof@lixom.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 56d435814c9653346be9dffd3d99965992eb25a5
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Jan 15 17:37:08 2018 +0100

    ARM: dts: nomadik: add interrupt-parent for clcd
    
    commit e8bfa0422469cdfc86be3f525f621b1d44d2481b upstream.
    
    The clcd device is lacking an interrupt-parent property, which makes
    the interrupt unusable and shows up as a warning with the latest
    dtc version:
    
    arch/arm/boot/dts/ste-nomadik-s8815.dtb: Warning (interrupts_property): Missing interrupt-parent for /amba/clcd@10120000
    arch/arm/boot/dts/ste-nomadik-nhk15.dtb: Warning (interrupts_property): Missing interrupt-parent for /amba/clcd@10120000
    
    I looked up the old board files and found that this interrupt has
    the same irqchip as all the other on-chip device, it just needs one
    extra line.
    
    Fixes: 17470b7da11c ("ARM: dts: add the CLCD LCD display to the NHK15")
    Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 34cad5572f162d39b7dfcabcb3a6ae28bf3dac9d
Author: Patrice Chotard <patrice.chotard@st.com>
Date:   Wed Jan 10 09:21:02 2018 +0100

    ARM: dts: STi: Add gpio polarity for "hdmi,hpd-gpio" property
    
    commit 7ac1f59c09a61e6af6622df6809e003b0af07f3d upstream.
    
    The GPIO polarity is missing in the hdmi,hpd-gpio property, this
    fixes the following DT warnings:
    
    arch/arm/boot/dts/stih410-b2120.dtb: Warning (gpios_property): hdmi,hpd-gpio property
    size (8) too small for cell size 2 in /soc/sti-display-subsystem/sti-hdmi@8d04000
    
    arch/arm/boot/dts/stih407-b2120.dtb: Warning (gpios_property): hdmi,hpd-gpio property
    size (8) too small for cell size 2 in /soc/sti-display-subsystem/sti-hdmi@8d04000
    
    arch/arm/boot/dts/stih410-b2260.dtb: Warning (gpios_property): hdmi,hpd-gpio property
    size (8) too small for cell size 2 in /soc/sti-display-subsystem/sti-hdmi@8d04000
    
    [arnd: marked Cc:stable since this warning shows up with the latest dtc
           by default, and is more likely to actually cause problems than the
           other patches from this series]
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Patrice Chotard <patrice.chotard@st.com>
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 910a2e4931cc08cbb0323d8d24df6c5482a535b2
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Wed Jan 10 17:22:00 2018 +0100

    ARM: lpc3250: fix uda1380 gpio numbers
    
    commit ca32e0c4bf9ca4b87089c5a5ce945e5f2ec890da upstream.
    
    dtc warns about obviously incorrect GPIO numbers for the audio codec
    on both lpc32xx boards:
    
    arch/arm/boot/dts/lpc3250-phy3250.dtb: Warning (gpios_property): reset-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
    arch/arm/boot/dts/lpc3250-phy3250.dtb: Warning (gpios_property): power-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
    arch/arm/boot/dts/lpc3250-ea3250.dtb: Warning (gpios_property): reset-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
    arch/arm/boot/dts/lpc3250-ea3250.dtb: Warning (gpios_property): power-gpio property size (12) too small for cell size 3 in /ahb/apb/i2c@400A0000/uda1380@18
    
    It looks like the nodes are written for a different binding that combines
    the GPIO number into a single number rather than a bank/number pair.
    I found the right numbers on stackexchange.com, so this patch fixes
    the warning and has a reasonable chance of getting things to actually
    work.
    
    Cc: stable@vger.kernel.org
    Link: https://unix.stackexchange.com/questions/59497/alsa-asoc-how-to-correctly-load-devices-drivers/62217#62217
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6d0fe11189f37c91a9386b0b862f00167fd65afc
Author: Bjorn Andersson <bjorn.andersson@linaro.org>
Date:   Thu Nov 30 21:27:32 2017 -0800

    arm64: dts: msm8916: Correct ipc references for smsm
    
    commit 566bd8902e7fa20bd412ed753e09e89c1c96939c upstream.
    
    SMSM is not symmetrical, the incoming bits from WCNSS are available at
    index 6, but the outgoing host id for WCNSS is 3. Further more, upstream
    references the base of APCS (in contrast to downstream), so the register
    offset of 8 must be included.
    
    Fixes: 1fb47e0a9ba4 ("arm64: dts: qcom: msm8916: Add smsm and smp2p nodes")
    Cc: stable@vger.kernel.org
    Reported-by: Ramon Fried <rfried@codeaurora.org>
    Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Signed-off-by: Andy Gross <andy.gross@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 15c5e601b7ccd1c2f6785eee4f69822329a90961
Author: Eugene Syromiatnikov <esyr@redhat.com>
Date:   Mon Jan 15 20:38:17 2018 +0100

    s390: fix handling of -1 in set{,fs}[gu]id16 syscalls
    
    commit 6dd0d2d22aa363fec075cb2577ba273ac8462e94 upstream.
    
    For some reason, the implementation of some 16-bit ID system calls
    (namely, setuid16/setgid16 and setfsuid16/setfsgid16) used type cast
    instead of low2highgid/low2highuid macros for converting [GU]IDs, which
    led to incorrect handling of value of -1 (which ought to be considered
    invalid).
    
    Discovered by strace test suite.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Eugene Syromiatnikov <esyr@redhat.com>
    Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9cb1674008e435d2c0145b352bc66b964d7b37ff
Author: Gang He <ghe@suse.com>
Date:   Wed Jan 31 16:14:48 2018 -0800

    ocfs2: try a blocking lock before return AOP_TRUNCATED_PAGE
    
    commit ff26cc10aec128c3f86b5611fd5f59c71d49c0e3 upstream.
    
    If we can't get inode lock immediately in the function
    ocfs2_inode_lock_with_page() when reading a page, we should not return
    directly here, since this will lead to a softlockup problem when the
    kernel is configured with CONFIG_PREEMPT is not set.  The method is to
    get a blocking lock and immediately unlock before returning, this can
    avoid CPU resource waste due to lots of retries, and benefits fairness
    in getting lock among multiple nodes, increase efficiency in case
    modifying the same file frequently from multiple nodes.
    
    The softlockup crash (when set /proc/sys/kernel/softlockup_panic to 1)
    looks like:
    
      Kernel panic - not syncing: softlockup: hung tasks
      CPU: 0 PID: 885 Comm: multi_mmap Tainted: G L 4.12.14-6.1-default #1
      Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
      Call Trace:
        <IRQ>
        dump_stack+0x5c/0x82
        panic+0xd5/0x21e
        watchdog_timer_fn+0x208/0x210
        __hrtimer_run_queues+0xcc/0x200
        hrtimer_interrupt+0xa6/0x1f0
        smp_apic_timer_interrupt+0x34/0x50
        apic_timer_interrupt+0x96/0xa0
        </IRQ>
       RIP: 0010:unlock_page+0x17/0x30
       RSP: 0000:ffffaf154080bc88 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10
       RAX: dead000000000100 RBX: fffff21e009f5300 RCX: 0000000000000004
       RDX: dead0000000000ff RSI: 0000000000000202 RDI: fffff21e009f5300
       RBP: 0000000000000000 R08: 0000000000000000 R09: ffffaf154080bb00
       R10: ffffaf154080bc30 R11: 0000000000000040 R12: ffff993749a39518
       R13: 0000000000000000 R14: fffff21e009f5300 R15: fffff21e009f5300
        ocfs2_inode_lock_with_page+0x25/0x30 [ocfs2]
        ocfs2_readpage+0x41/0x2d0 [ocfs2]
        filemap_fault+0x12b/0x5c0
        ocfs2_fault+0x29/0xb0 [ocfs2]
        __do_fault+0x1a/0xa0
        __handle_mm_fault+0xbe8/0x1090
        handle_mm_fault+0xaa/0x1f0
        __do_page_fault+0x235/0x4b0
        trace_do_page_fault+0x3c/0x110
        async_page_fault+0x28/0x30
       RIP: 0033:0x7fa75ded638e
       RSP: 002b:00007ffd6657db18 EFLAGS: 00010287
       RAX: 000055c7662fb700 RBX: 0000000000000001 RCX: 000055c7662fb700
       RDX: 0000000000001770 RSI: 00007fa75e909000 RDI: 000055c7662fb700
       RBP: 0000000000000003 R08: 000000000000000e R09: 0000000000000000
       R10: 0000000000000483 R11: 00007fa75ded61b0 R12: 00007fa75e90a770
       R13: 000000000000000e R14: 0000000000001770 R15: 0000000000000000
    
    About performance improvement, we can see the testing time is reduced,
    and CPU utilization decreases, the detailed data is as follows.  I ran
    multi_mmap test case in ocfs2-test package in a three nodes cluster.
    
    Before applying this patch:
        PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
       2754 ocfs2te+  20   0  170248   6980   4856 D 80.73 0.341   0:18.71 multi_mmap
       1505 root      rt   0  222236 123060  97224 S 2.658 6.015   0:01.44 corosync
          5 root      20   0       0      0      0 S 1.329 0.000   0:00.19 kworker/u8:0
         95 root      20   0       0      0      0 S 1.329 0.000   0:00.25 kworker/u8:1
       2728 root      20   0       0      0      0 S 0.997 0.000   0:00.24 jbd2/sda1-33
       2721 root      20   0       0      0      0 S 0.664 0.000   0:00.07 ocfs2dc-3C8CFD4
       2750 ocfs2te+  20   0  142976   4652   3532 S 0.664 0.227   0:00.28 mpirun
    
      ocfs2test@tb-node2:~>multiple_run.sh -i ens3 -k ~/linux-4.4.21-69.tar.gz -o ~/ocfs2mullog -C hacluster -s pcmk -n tb-node2,tb-node1,tb-node3 -d /dev/sda1 -b 4096 -c 32768 -t multi_mmap /mnt/shared
      Tests with "-b 4096 -C 32768"
      Thu Dec 28 14:44:52 CST 2017
      multi_mmap..................................................Passed.
      Runtime 783 seconds.
    
    After apply this patch:
    
        PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
       2508 ocfs2te+  20   0  170248   6804   4680 R 54.00 0.333   0:55.37 multi_mmap
        155 root      20   0       0      0      0 S 2.667 0.000   0:01.20 kworker/u8:3
         95 root      20   0       0      0      0 S 2.000 0.000   0:01.58 kworker/u8:1
       2504 ocfs2te+  20   0  142976   4604   3480 R 1.667 0.225   0:01.65 mpirun
          5 root      20   0       0      0      0 S 1.000 0.000   0:01.36 kworker/u8:0
       2482 root      20   0       0      0      0 S 1.000 0.000   0:00.86 jbd2/sda1-33
        299 root       0 -20       0      0      0 S 0.333 0.000   0:00.13 kworker/2:1H
        335 root       0 -20       0      0      0 S 0.333 0.000   0:00.17 kworker/1:1H
        535 root      20   0   12140   7268   1456 S 0.333 0.355   0:00.34 haveged
       1282 root      rt   0  222284 123108  97224 S 0.333 6.017   0:01.33 corosync
    
      ocfs2test@tb-node2:~>multiple_run.sh -i ens3 -k ~/linux-4.4.21-69.tar.gz -o ~/ocfs2mullog -C hacluster -s pcmk -n tb-node2,tb-node1,tb-node3 -d /dev/sda1 -b 4096 -c 32768 -t multi_mmap /mnt/shared
      Tests with "-b 4096 -C 32768"
      Thu Dec 28 15:04:12 CST 2017
      multi_mmap..................................................Passed.
      Runtime 487 seconds.
    
    Link: http://lkml.kernel.org/r/1514447305-30814-1-git-send-email-ghe@suse.com
    Fixes: 1cce4df04f37 ("ocfs2: do not lock/unlock() inode DLM lock")
    Signed-off-by: Gang He <ghe@suse.com>
    Reviewed-by: Eric Ren <zren@suse.com>
    Acked-by: alex chen <alex.chen@huawei.com>
    Acked-by: piaojun <piaojun@huawei.com>
    Cc: Mark Fasheh <mfasheh@versity.com>
    Cc: Joel Becker <jlbec@evilplan.org>
    Cc: Junxiao Bi <junxiao.bi@oracle.com>
    Cc: Joseph Qi <jiangqi903@gmail.com>
    Cc: Changwei Ge <ge.changwei@h3c.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b3685e8e2b6ddec107f62f03ada6302cfc3a7bce
Author: Bjorn Andersson <bjorn.andersson@linaro.org>
Date:   Sun Nov 5 21:27:41 2017 -0800

    PM / devfreq: Propagate error from devfreq_add_device()
    
    commit d1bf2d30728f310f72296b54f0651ecdb09cbb12 upstream.
    
    Propagate the error of devfreq_add_device() in devm_devfreq_add_device()
    rather than statically returning ENOMEM. This makes it slightly faster
    to pinpoint the cause of a returned error.
    
    Fixes: 8cd84092d35e ("PM / devfreq: Add resource-managed function for devfreq device")
    Cc: stable@vger.kernel.org
    Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
    Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9708d4743f317bd0eb12d76f52fc27e2c59d9b6d
Author: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>
Date:   Fri Jan 12 12:43:53 2018 +0530

    cpufreq: powernv: Dont assume distinct pstate values for nominal and pmin
    
    commit 3fa4680b860bf48b437d6a2c039789c4abe202ae upstream.
    
    Some OpenPOWER boxes can have same pstate values for nominal and
    pmin pstates. In these boxes the current code will not initialize
    'powernv_pstate_info.min' variable and result in erroneous CPU
    frequency reporting. This patch fixes this problem.
    
    Fixes: 09ca4c9b5958 (cpufreq: powernv: Replacing pstate_id with frequency table index)
    Reported-by: Alvin Wang <wangat@tw.ibm.com>
    Signed-off-by: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>
    Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
    Cc: 4.8+ <stable@vger.kernel.org> # 4.8+
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ae34caee36c6d34322c5afdc54c6a92881a224e4
Author: Bart Van Assche <bart.vanassche@wdc.com>
Date:   Tue Jan 9 11:23:40 2018 -0800

    RDMA/rxe: Fix a race condition related to the QP error state
    
    commit 6f301e06de4cf9ab7303f5acd43e64fcd4aa04be upstream.
    
    The following sequence:
    * Change queue pair state into IB_QPS_ERR.
    * Post a work request on the queue pair.
    
    Triggers the following race condition in the rdma_rxe driver:
    * rxe_qp_error() triggers an asynchronous call of rxe_completer(), the function
      that examines the QP send queue.
    * rxe_post_send() posts a work request on the QP send queue.
    
    If rxe_completer() runs prior to rxe_post_send(), it will drain the send
    queue and the driver will assume no further action is necessary.
    However, once we post the send to the send queue, because the queue is
    in error, no send completion will ever happen and the send will get
    stuck.  In order to process the send, we need to make sure that
    rxe_completer() gets run after a send is posted to a queue pair in an
    error state.  This patch ensures that happens.
    
    Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
    Cc: Moni Shoua <monis@mellanox.com>
    Cc: <stable@vger.kernel.org> # v4.8
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1d808f828f4cc97bd2f7dbafce2e9a33f3d8a86d
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Tue Jan 9 17:26:24 2018 +0100

    kselftest: fix OOM in memory compaction test
    
    commit 4c1baad223906943b595a887305f2e8124821dad upstream.
    
    Running the compaction_test sometimes results in out-of-memory
    failures. When I debugged this, it turned out that the code to
    reset the number of hugepages to the initial value is simply
    broken since we write into an open sysctl file descriptor
    multiple times without seeking back to the start.
    
    Adding the lseek here fixes the problem.
    
    Cc: stable@vger.kernel.org
    Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
    Link: https://bugs.linaro.org/show_bug.cgi?id=3145
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ee3d989b3d59dbbb3b5c3eb33434b5ef38b3023e
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Fri Jan 12 07:58:40 2018 +0200

    IB/mlx4: Fix incorrectly releasing steerable UD QPs when have only ETH ports
    
    commit 852f6927594d0d3e8632c889b2ab38cbc46476ad upstream.
    
    Allocating steerable UD QPs depends on having at least one IB port,
    while releasing those QPs does not.
    
    As a result, when there are only ETH ports, the IB (RoCE) driver
    requests releasing a qp range whose base qp is zero, with
    qp count zero.
    
    When SR-IOV is enabled, and the VF driver is running on a VM over
    a hypervisor which treats such qp release calls as errors
    (rather than NOPs), we see lines in the VM message log like:
    
     mlx4_core 0002:00:02.0: Failed to release qp range base:0 cnt:0
    
    Fix this by adding a check for a zero count in mlx4_release_qp_range()
    (which thus treats releasing 0 qps as a nop), and eliminating the
    check for device managed flow steering when releasing steerable UD QPs.
    (Freeing ib_uc_qpns_bitmap unconditionally is also OK, since it
    remains NULL when steerable UD QPs are not allocated).
    
    Fixes: 4196670be786 ("IB/mlx4: Don't allocate range of steerable UD QPs for Ethernet-only device")
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5c1c0b9267dd288aa7fa0356590111a89cfd6f90
Author: Mike Marciniszyn <mike.marciniszyn@intel.com>
Date:   Tue Nov 14 04:34:52 2017 -0800

    IB/qib: Fix comparison error with qperf compare/swap test
    
    commit 87b3524cb5058fdc7c2afdb92bdb2e079661ddc4 upstream.
    
    This failure exists with qib:
    
    ver_rc_compare_swap:
    mismatch, sequence 2, expected 123456789abcdef, got 0
    
    The request builder was using the incorrect inlines to
    build the request header resulting in incorrect data
    in the atomic header.
    
    Fix by using the appropriate inlines to create the request.
    
    Fixes: 261a4351844b ("IB/qib,IB/hfi: Use core common header file")
    Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e41b3b8972ff3d2a2b6233dbd852241988d1356d
Author: Nicholas Piggin <npiggin@gmail.com>
Date:   Wed Jan 10 03:07:15 2018 +1100

    powerpc: fix build errors in stable tree
    
    This is just the first chunk of commit
    222f20f140623ef6033491d0103ee0875fe87d35 upstream.
    
    to fix a build error in the powerpc tree due to other backports
    happening (and this full patch not being backported).
    
    Reported-by: Guenter Roeck <linux@roeck-us.net>
    Reported-by: Yves-Alexis Perez <corsac@debian.org>
    Cc: Nicholas Piggin <npiggin@gmail.com>
    Cc: Michael Ellerman <mpe@ellerman.id.au>
    Cc: Yves-Alexis Perez <corsac@debian.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e6701adbbabbb078bf332bf99bd05eae7a4c64ac
Author: NeilBrown <neilb@suse.com>
Date:   Thu Feb 15 20:00:15 2018 +1100

    dm: correctly handle chained bios in dec_pending()
    
    commit 8dd601fa8317243be887458c49f6c29c2f3d719f upstream.
    
    dec_pending() is given an error status (possibly 0) to be recorded
    against a bio.  It can be called several times on the one 'struct
    dm_io', and it is careful to only assign a non-zero error to
    io->status.  However when it then assigned io->status to bio->bi_status,
    it is not careful and could overwrite a genuine error status with 0.
    
    This can happen when chained bios are in use.  If a bio is chained
    beneath the bio that this dm_io is handling, the child bio might
    complete and set bio->bi_status before the dm_io completes.
    
    This has been possible since chained bios were introduced in 3.14, and
    has become a lot easier to trigger with commit 18a25da84354 ("dm: ensure
    bio submission follows a depth-first tree walk") as that commit caused
    dm to start using chained bios itself.
    
    A particular failure mode is that if a bio spans an 'error' target and a
    working target, the 'error' fragment will complete instantly and set the
    ->bi_status, and the other fragment will normally complete a little
    later, and will clear ->bi_status.
    
    The fix is simply to only assign io_error to bio->bi_status when
    io_error is not zero.
    
    Reported-and-tested-by: Milan Broz <gmazyland@gmail.com>
    Cc: stable@vger.kernel.org (v3.14+)
    Signed-off-by: NeilBrown <neilb@suse.com>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b2a6141782cd9934e8810e1b73b13e5252811e0c
Author: James Hogan <jhogan@kernel.org>
Date:   Wed Jan 31 22:24:45 2018 +0000

    usb: Move USB_UHCI_BIG_ENDIAN_* out of USB_SUPPORT
    
    commit ec897569ad7dbc6d595873a487c3fac23f463f76 upstream.
    
    Move the Kconfig symbols USB_UHCI_BIG_ENDIAN_MMIO and
    USB_UHCI_BIG_ENDIAN_DESC out of drivers/usb/host/Kconfig, which is
    conditional upon USB && USB_SUPPORT, so that it can be freely selected
    by platform Kconfig symbols in architecture code.
    
    For example once the MIPS_GENERIC platform selects are fixed in commit
    2e6522c56552 ("MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN"), the MIPS
    32r6_defconfig warns like so:
    
    warning: (MIPS_GENERIC) selects USB_UHCI_BIG_ENDIAN_MMIO which has unmet direct dependencies (USB_SUPPORT && USB)
    warning: (MIPS_GENERIC) selects USB_UHCI_BIG_ENDIAN_DESC which has unmet direct dependencies (USB_SUPPORT && USB)
    
    Fixes: 2e6522c56552 ("MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN")
    Signed-off-by: James Hogan <jhogan@kernel.org>
    Cc: Corentin Labbe <clabbe.montjoie@gmail.com>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: Paul Burton <paul.burton@mips.com>
    Cc: linux-usb@vger.kernel.org
    Cc: linux-mips@linux-mips.org
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Patchwork: https://patchwork.linux-mips.org/patch/18559/
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c9aca68ee52c86ce7b5037b76808dd0519edd110
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Sun Feb 11 18:10:28 2018 -0500

    mvpp2: fix multicast address filter
    
    commit 7ac8ff95f48cbfa609a060fd6a1e361dd62feeb3 upstream.
    
    IPv6 doesn't work on the MacchiatoBIN board. It is caused by broken
    multicast address filter in the mvpp2 driver.
    
    The driver loads doesn't load any multicast entries if "allmulti" is not
    set. This condition should be reversed.
    
    The condition !netdev_mc_empty(dev) is useless (because
    netdev_for_each_mc_addr is nop if the list is empty).
    
    This patch also fixes a possible overflow of the multicast list - if
    mvpp2_prs_mac_da_accept fails, we set the allmulti flag and retry.
    
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 869182f45e38e4c62722b20a5c6f4bc48b2e60c3
Author: Takashi Iwai <tiwai@suse.de>
Date:   Mon Feb 12 15:20:51 2018 +0100

    ALSA: seq: Fix racy pool initializations
    
    commit d15d662e89fc667b90cd294b0eb45694e33144da upstream.
    
    ALSA sequencer core initializes the event pool on demand by invoking
    snd_seq_pool_init() when the first write happens and the pool is
    empty.  Meanwhile user can reset the pool size manually via ioctl
    concurrently, and this may lead to UAF or out-of-bound accesses since
    the function tries to vmalloc / vfree the buffer.
    
    A simple fix is to just wrap the snd_seq_pool_init() call with the
    recently introduced client->ioctl_mutex; as the calls for
    snd_seq_pool_init() from other side are always protected with this
    mutex, we can avoid the race.
    
    Reported-by: 范龙飞 <long7573@126.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 344c9ac65ea678fafaff5074361dead24a038c27
Author: Lassi Ylikojola <lassi.ylikojola@gmail.com>
Date:   Fri Feb 9 16:51:36 2018 +0200

    ALSA: usb-audio: add implicit fb quirk for Behringer UFX1204
    
    commit 5e35dc0338d85ccebacf3f77eca1e5dea73155e8 upstream.
    
    Add quirk to ensure a sync endpoint is properly configured.
    This patch is a fix for same symptoms on Behringer UFX1204 as patch
    from Albertto Aquirre on Dec 8 2016 for Axe-Fx II.
    
    Signed-off-by: Lassi Ylikojola <lassi.ylikojola@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bb1a422bd6e93fa0899e0e2ea1ce488ac651d0b4
Author: Jan-Marek Glogowski <glogow@fbihome.de>
Date:   Wed Feb 14 11:29:15 2018 +0100

    ALSA: hda/realtek: PCI quirk for Fujitsu U7x7
    
    commit fdcc968a3b290407bcba9d4c90e2fba6d8d928f1 upstream.
    
    These laptops have a combined jack to attach headsets, the U727 on
    the left, the U757 on the right, but a headsets microphone doesn't
    work. Using hdajacksensetest I found that pin 0x19 changed the
    present state when plugging the headset, in addition to 0x21, but
    didn't have the correct configuration (shown as "Not connected").
    
    So this sets the configuration to the same values as the headphone
    pin 0x21 except for the device type microphone, which makes it
    work correctly. With the patch the configured pins for U727 are
    
    Pin 0x12 (Internal Mic, Mobile-In): present = No
    Pin 0x14 (Internal Speaker): present = No
    Pin 0x19 (Black Mic, Left side): present = No
    Pin 0x1d (Internal Aux): present = No
    Pin 0x21 (Black Headphone, Left side): present = No
    
    Signed-off-by: Jan-Marek Glogowski <glogow@fbihome.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d8fff0e75a0b229c42360a22866768e1b863e079
Author: Kailang Yang <kailang@realtek.com>
Date:   Fri Feb 2 15:26:46 2018 +0800

    ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform
    
    commit 61fcf8ece9b6b09450250c4ca40cc3b81a96a68d upstream.
    
    Thinkpad Dock device support for ALC298 platform.
    It need to use SSID for the quirk table.
    Because IdeaPad also has ALC298 platform.
    Use verb for the quirk table will confuse.
    
    Signed-off-by: Kailang Yang <kailang@realtek.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 31cb8df3f8ea21d1d33d371b160fddd903888e19
Author: Kirill Marinushkin <k.marinushkin@gmail.com>
Date:   Mon Jan 29 06:37:55 2018 +0100

    ALSA: usb-audio: Fix UAC2 get_ctl request with a RANGE attribute
    
    commit 447cae58cecd69392b74a4a42cd0ab9cabd816af upstream.
    
    The layout of the UAC2 Control request and response varies depending on
    the request type. With the current implementation, only the Layout 2
    Parameter Block (with the 2-byte sized RANGE attribute) is handled
    properly. For the Control requests with the 1-byte sized RANGE attribute
    (Bass Control, Mid Control, Tremble Control), the response is parsed
    incorrectly.
    
    This commit:
    * fixes the wLength field value in the request
    * fixes parsing the range values from the response
    
    Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
    Signed-off-by: Kirill Marinushkin <k.marinushkin@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3dc694f4a436ec5f8017161ff8e8a8e49856014d
Author: Hui Wang <hui.wang@canonical.com>
Date:   Mon Jan 29 14:23:15 2018 +0800

    ALSA: hda - Fix headset mic detection problem for two Dell machines
    
    commit 3f2f7c553d077be6a30cb96b2976a2c940bf5335 upstream.
    
    One of them has the codec of alc256 and the other one has the codec
    of alc289.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Hui Wang <hui.wang@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 921f860ade863666b8b4be9ec5d0347bb8891ea4
Author: Stefan Agner <stefan@agner.ch>
Date:   Fri Feb 9 13:21:42 2018 +0100

    mtd: nand: vf610: set correct ooblayout
    
    commit ea56fb282368ea08c2a313af6b55cb597aec4db1 upstream.
    
    With commit 3cf32d180227 ("mtd: nand: vf610: switch to
    mtd_ooblayout_ops") the driver started to use the NAND cores
    default large page ooblayout. However, shortly after commit
    6a623e076944 ("mtd: nand: add ooblayout for old hamming layout")
    changed the default layout to the old hamming layout, which is
    not what vf610_nfc is using. Specify the default large page
    layout explicitly.
    
    Fixes: 6a623e076944 ("mtd: nand: add ooblayout for old hamming layout")
    Cc: <stable@vger.kernel.org> # v4.12+
    Signed-off-by: Stefan Agner <stefan@agner.ch>
    Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 39e0a6bd07182815062c74fc73ce0ea94578ce00
Author: Greg Kurz <groug@kaod.org>
Date:   Mon Jan 22 22:02:05 2018 +0100

    9p/trans_virtio: discard zero-length reply
    
    commit 26d99834f89e76514076d9cd06f61e56e6a509b8 upstream.
    
    When a 9p request is successfully flushed, the server is expected to just
    mark it as used without sending a 9p reply (ie, without writing data into
    the buffer). In this case, virtqueue_get_buf() will return len == 0 and
    we must not report a REQ_STATUS_RCVD status to the client, otherwise the
    client will erroneously assume the request has not been flushed.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kurz <groug@kaod.org>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit efb1cbc229f122bc1d1b5e85bdd2da971c953f2e
Author: Liu Bo <bo.li.liu@oracle.com>
Date:   Thu Jan 25 11:02:56 2018 -0700

    Btrfs: fix unexpected -EEXIST when creating new inode
    
    commit 900c9981680067573671ecc5cbfa7c5770be3a40 upstream.
    
    The highest objectid, which is assigned to new inode, is decided at
    the time of initializing fs roots.  However, in cases where log replay
    gets processed, the btree which fs root owns might be changed, so we
    have to search it again for the highest objectid, otherwise creating
    new inode would end up with -EEXIST.
    
    cc: <stable@vger.kernel.org> v4.4-rc6+
    Fixes: f32e48e92596 ("Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots")
    Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
    Reviewed-by: Josef Bacik <jbacik@fb.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b48edd6d7658a9fdb05c162f1f099245e7cd22e5
Author: Liu Bo <bo.li.liu@oracle.com>
Date:   Thu Jan 25 11:02:53 2018 -0700

    Btrfs: fix btrfs_evict_inode to handle abnormal inodes correctly
    
    commit e8f1bc1493855e32b7a2a019decc3c353d94daf6 upstream.
    
    This regression is introduced in
    commit 3d48d9810de4 ("btrfs: Handle uninitialised inode eviction").
    
    There are two problems,
    
    a) it is ->destroy_inode() that does the final free on inode, not
       ->evict_inode(),
    b) clear_inode() must be called before ->evict_inode() returns.
    
    This could end up hitting BUG_ON(inode->i_state != (I_FREEING | I_CLEAR));
    in evict() because I_CLEAR is set in clear_inode().
    
    Fixes: commit 3d48d9810de4 ("btrfs: Handle uninitialised inode eviction")
    Cc: <stable@vger.kernel.org> # v4.7-rc6+
    Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
    Reviewed-by: Nikolay Borisov <nborisov@suse.com>
    Reviewed-by: Josef Bacik <jbacik@fb.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit bc0d431e74adb5967fe39bc07aad68a6a865612d
Author: Liu Bo <bo.li.liu@oracle.com>
Date:   Thu Jan 25 11:02:52 2018 -0700

    Btrfs: fix extent state leak from tree log
    
    commit 55237a5f2431a72435e3ed39e4306e973c0446b7 upstream.
    
    It's possible that btrfs_sync_log() bails out after one of the two
    btrfs_write_marked_extents() which convert extent state's state bit into
    EXTENT_NEED_WAIT from EXTENT_DIRTY/EXTENT_NEW, however only EXTENT_DIRTY
    and EXTENT_NEW are searched by free_log_tree() so that those extent states
    with EXTENT_NEED_WAIT lead to memory leak.
    
    cc: <stable@vger.kernel.org>
    Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
    Reviewed-by: Josef Bacik <jbacik@fb.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0f4adc1468fe5495e25e6da520d438f947f6cd7e
Author: Liu Bo <bo.li.liu@oracle.com>
Date:   Thu Jan 25 11:02:51 2018 -0700

    Btrfs: fix crash due to not cleaning up tree log block's dirty bits
    
    commit 1846430c24d66e85cc58286b3319c82cd54debb2 upstream.
    
    In cases that the whole fs flips into readonly status due to failures in
    critical sections, then log tree's blocks are still dirty, and this leads
    to a crash during umount time, the crash is about use-after-free,
    
    umount
     -> close_ctree
        -> stop workers
        -> iput(btree_inode)
           -> iput_final
              -> write_inode_now
                 -> ...
                   -> queue job on stop'd workers
    
    cc: <stable@vger.kernel.org> v3.12+
    Fixes: 681ae50917df ("Btrfs: cleanup reserved space when freeing tree log on error")
    Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
    Reviewed-by: Josef Bacik <jbacik@fb.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ecd72fd604b1f3aa3ec03962e4676760a8e1a1b4
Author: Liu Bo <bo.li.liu@oracle.com>
Date:   Thu Jan 25 11:02:50 2018 -0700

    Btrfs: fix deadlock in run_delalloc_nocow
    
    commit e89166990f11c3f21e1649d760dd35f9e410321c upstream.
    
    @cur_offset is not set back to what it should be (@cow_start) if
    btrfs_next_leaf() returns something wrong, and the range [cow_start,
    cur_offset) remains locked forever.
    
    cc: <stable@vger.kernel.org>
    Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
    Reviewed-by: Josef Bacik <jbacik@fb.com>
    Signed-off-by: David Sterba <dsterba@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit fffc0fcaebebefd06b07838e4aad5ef5f30803fd
Author: David Disseldorp <ddiss@suse.de>
Date:   Wed Dec 13 18:22:30 2017 +0100

    target/iscsi: avoid NULL dereference in CHAP auth error path
    
    commit ce512d79d0466a604793addb6b769d12ee326822 upstream.
    
    If chap_server_compute_md5() fails early, e.g. via CHAP_N mismatch, then
    crypto_free_shash() is called with a NULL pointer which gets
    dereferenced in crypto_shash_tfm().
    
    Fixes: 69110e3cedbb ("iscsi-target: Use shash and ahash")
    Suggested-by: Markus Elfring <elfring@users.sourceforge.net>
    Signed-off-by: David Disseldorp <ddiss@suse.de>
    Cc: stable@vger.kernel.org # 4.6+
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 28130f4d2340a87ea4b84e55f43016ebf86b9a2e
Author: Larry Finger <Larry.Finger@lwfinger.net>
Date:   Mon Feb 5 12:38:11 2018 -0600

    rtlwifi: rtl8821ae: Fix connection lost problem correctly
    
    commit c713fb071edc0efc01a955f65a006b0e1795d2eb upstream.
    
    There has been a coding error in rtl8821ae since it was first introduced,
    namely that an 8-bit register was read using a 16-bit read in
    _rtl8821ae_dbi_read(). This error was fixed with commit 40b368af4b75
    ("rtlwifi: Fix alignment issues"); however, this change led to
    instability in the connection. To restore stability, this change
    was reverted in commit b8b8b16352cd ("rtlwifi: rtl8821ae: Fix connection
    lost problem").
    
    Unfortunately, the unaligned access causes machine checks in ARM
    architecture, and we were finally forced to find the actual cause of the
    problem on x86 platforms. Following a suggestion from Pkshih
    <pkshih@realtek.com>, it was found that increasing the ASPM L1
    latency from 0 to 7 fixed the instability. This parameter was varied to
    see if a smaller value would work; however, it appears that 7 is the
    safest value. A new symbol is defined for this quantity, thus it can be
    easily changed if necessary.
    
    Fixes: b8b8b16352cd ("rtlwifi: rtl8821ae: Fix connection lost problem")
    Cc: Stable <stable@vger.kernel.org> # 4.14+
    Fix-suggested-by: Pkshih <pkshih@realtek.com>
    Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
    Tested-by: James Cameron <quozl@laptop.org>  # x86_64 OLPC NL3
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 81c1ef9a0fcf696f443346ff2315e698a1d2b69e
Author: Nicolas Pitre <nicolas.pitre@linaro.org>
Date:   Mon Jan 15 17:04:22 2018 +0100

    console/dummy: leave .con_font_get set to NULL
    
    commit 724ba8b30b044aa0d94b1cd374fc15806cdd6f18 upstream.
    
    When this method is set, the caller expects struct console_font fields
    to be properly initialized when it returns. Leave it unset otherwise
    nonsensical (leaked kernel stack) values are returned to user space.
    
    Signed-off-by: Nicolas Pitre <nico@linaro.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dca0dc604aa37fda4681227250522dd9abe47298
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Dec 29 19:48:43 2017 +0100

    video: fbdev: atmel_lcdfb: fix display-timings lookup
    
    commit 9cb18db0701f6b74f0c45c23ad767b3ebebe37f6 upstream.
    
    Fix child-node lookup during probe, which ended up searching the whole
    device tree depth-first starting at the parent rather than just matching
    on its children.
    
    To make things worse, the parent display node was also prematurely
    freed.
    
    Note that the display and timings node references are never put after a
    successful dt-initialisation so the nodes would leak on later probe
    deferrals and on driver unbind.
    
    Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport")
    Cc: stable <stable@vger.kernel.org>     # 3.13
    Cc: Jean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
    Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
    Cc: Alexandre Belloni <alexandre.belloni@free-electrons.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e1afa7bb38d5379f29fa015e9402e946a226afe8
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Nov 17 14:38:31 2017 +0100

    PCI: keystone: Fix interrupt-controller-node lookup
    
    commit eac56aa3bc8af3d9b9850345d0f2da9d83529134 upstream.
    
    Fix child-node lookup during initialisation which was using the wrong
    OF-helper and ended up searching the whole device tree depth-first
    starting at the parent rather than just matching on its children.
    
    To make things worse, the parent pci node could end up being prematurely
    freed as of_find_node_by_name() drops a reference to its first argument.
    Any matching child interrupt-controller node was also leaked.
    
    Fixes: 0c4ffcfe1fbc ("PCI: keystone: Add TI Keystone PCIe driver")
    Cc: stable <stable@vger.kernel.org>     # 3.18
    Acked-by: Murali Karicheri <m-karicheri2@ti.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    [lorenzo.pieralisi@arm.com: updated commit subject]
    Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3d95c4faf85e3c5b67cda113d13bf701a40ee1d0
Author: Corentin Labbe <clabbe.montjoie@gmail.com>
Date:   Wed Jan 17 19:56:38 2018 +0100

    MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN
    
    commit 2e6522c565522a2e18409c315c49d78c8b74807b upstream.
    
    MIPS_GENERIC selects some options conditional on BIG_ENDIAN which does
    not exist.
    
    Replace BIG_ENDIAN with CPU_BIG_ENDIAN which is the correct kconfig
    name. Note that BMIPS_GENERIC does the same which confirms that this
    patch is needed.
    
    Fixes: eed0eabd12ef0 ("MIPS: generic: Introduce generic DT-based board support")
    Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
    Reviewed-by: James Hogan <jhogan@kernel.org>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: linux-mips@linux-mips.org
    Cc: <stable@vger.kernel.org> # 4.9+
    Patchwork: https://patchwork.linux-mips.org/patch/18495/
    [jhogan@kernel.org: Clean up commit message]
    Signed-off-by: James Hogan <jhogan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit cbd0c0fc54e2fa27d05779cb984fe9c989652be8
Author: Jan H. Schönherr <jschoenh@amazon.de>
Date:   Fri Jan 19 16:27:54 2018 -0800

    mm: Fix memory size alignment in devm_memremap_pages_release()
    
    commit 10a0cd6e4932b5078215b1ec2c896597eec0eff9 upstream.
    
    The functions devm_memremap_pages() and devm_memremap_pages_release() use
    different ways to calculate the section-aligned amount of memory. The
    latter function may use an incorrect size if the memory region is small
    but straddles a section border.
    
    Use the same code for both.
    
    Cc: <stable@vger.kernel.org>
    Fixes: 5f29a77cd957 ("mm: fix mixed zone detection in devm_memremap_pages")
    Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7318454518ad56ad38b60dbb3d185fd14d0d0b93
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Fri Feb 16 16:25:53 2018 +0100

    mm: hide a #warning for COMPILE_TEST
    
    commit af27d9403f5b80685b79c88425086edccecaf711 upstream.
    
    We get a warning about some slow configurations in randconfig kernels:
    
      mm/memory.c:83:2: error: #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid. [-Werror=cpp]
    
    The warning is reasonable by itself, but gets in the way of randconfig
    build testing, so I'm hiding it whenever CONFIG_COMPILE_TEST is set.
    
    The warning was added in 2013 in commit 75980e97dacc ("mm: fold
    page->_last_nid into page->flags where possible").
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f0b59c20145b4d8a0739960b2ad2b292fa365ef7
Author: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
Date:   Thu Jan 11 13:43:33 2018 -0500

    ext4: correct documentation for grpid mount option
    
    commit 9f0372488cc9243018a812e8cfbf27de650b187b upstream.
    
    The grpid option is currently described as being the same as nogrpid.
    
    Signed-off-by: Ernesto A. Fernández <ernesto.mnd.fernandez@gmail.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4a36f437bed1305495196274b08cf5b8d9b4a76d
Author: Zhouyi Zhou <zhouzhouyi@gmail.com>
Date:   Wed Jan 10 00:34:19 2018 -0500

    ext4: save error to disk in __ext4_grp_locked_error()
    
    commit 06f29cc81f0350261f59643a505010531130eea0 upstream.
    
    In the function __ext4_grp_locked_error(), __save_error_info()
    is called to save error info in super block block, but does not sync
    that information to disk to info the subsequence fsck after reboot.
    
    This patch writes the error information to disk.  After this patch,
    I think there is no obvious EXT4 error handle branches which leads to
    "Remounting filesystem read-only" will leave the disk partition miss
    the subsequence fsck.
    
    Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 539deabfccb0a5d7e17daa432b385ffe608e0ccb
Author: Harshad Shirwadkar <harshads@google.com>
Date:   Wed Jan 10 00:13:13 2018 -0500

    ext4: fix a race in the ext4 shutdown path
    
    commit abbc3f9395c76d554a9ed27d4b1ebfb5d9b0e4ca upstream.
    
    This patch fixes a race between the shutdown path and bio completion
    handling. In the ext4 direct io path with async io, after submitting a
    bio to the block layer, if journal starting fails,
    ext4_direct_IO_write() would bail out pretending that the IO
    failed. The caller would have had no way of knowing whether or not the
    IO was successfully submitted. So instead, we return -EIOCBQUEUED in
    this case. Now, the caller knows that the IO was submitted.  The bio
    completion handler takes care of the error.
    
    Tested: Ran the shutdown xfstest test 461 in loop for over 2 hours across
    4 machines resulting in over 400 runs. Verified that the race didn't
    occur. Usually the race was seen in about 20-30 iterations.
    
    Signed-off-by: Harshad Shirwadkar <harshads@google.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 99a89d8fb506abaaf5f88e99cd29bb288d805c8e
Author: Tobin C. Harding <me@tobin.cc>
Date:   Wed Jan 10 00:27:29 2018 -0500

    jbd2: fix sphinx kernel-doc build warnings
    
    commit f69120ce6c024aa634a8fc25787205e42f0ccbe6 upstream.
    
    Sphinx emits various (26) warnings when building make target 'htmldocs'.
    Currently struct definitions contain duplicate documentation, some as
    kernel-docs and some as standard c89 comments.  We can reduce
    duplication while cleaning up the kernel docs.
    
    Move all kernel-docs to right above each struct member.  Use the set of
    all existing comments (kernel-doc and c89).  Add documentation for
    missing struct members and function arguments.
    
    Signed-off-by: Tobin C. Harding <me@tobin.cc>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9cb2d0bc289e8edfdd6b5fb9962fd41b4c6e9b16
Author: Alexander Potapenko <glider@google.com>
Date:   Sun Jan 7 16:22:35 2018 -0500

    mbcache: initialize entry->e_referenced in mb_cache_entry_create()
    
    commit 3876bbe27d04b848750d5310a37d6b76b593f648 upstream.
    
    KMSAN reported use of uninitialized |entry->e_referenced| in a condition
    in mb_cache_shrink():
    
    ==================================================================
    BUG: KMSAN: use of uninitialized memory in mb_cache_shrink+0x3b4/0xc50 fs/mbcache.c:287
    CPU: 2 PID: 816 Comm: kswapd1 Not tainted 4.11.0-rc5+ #2877
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
    01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:16 [inline]
     dump_stack+0x172/0x1c0 lib/dump_stack.c:52
     kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927
     __msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469
     mb_cache_shrink+0x3b4/0xc50 fs/mbcache.c:287
     mb_cache_scan+0x67/0x80 fs/mbcache.c:321
     do_shrink_slab mm/vmscan.c:397 [inline]
     shrink_slab+0xc3d/0x12d0 mm/vmscan.c:500
     shrink_node+0x208f/0x2fd0 mm/vmscan.c:2603
     kswapd_shrink_node mm/vmscan.c:3172 [inline]
     balance_pgdat mm/vmscan.c:3289 [inline]
     kswapd+0x160f/0x2850 mm/vmscan.c:3478
     kthread+0x46c/0x5f0 kernel/kthread.c:230
     ret_from_fork+0x29/0x40 arch/x86/entry/entry_64.S:430
    chained origin:
     save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
     kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302 [inline]
     kmsan_save_stack mm/kmsan/kmsan.c:317 [inline]
     kmsan_internal_chain_origin+0x12a/0x1f0 mm/kmsan/kmsan.c:547
     __msan_store_shadow_origin_1+0xac/0x110 mm/kmsan/kmsan_instr.c:257
     mb_cache_entry_create+0x3b3/0xc60 fs/mbcache.c:95
     ext4_xattr_cache_insert fs/ext4/xattr.c:1647 [inline]
     ext4_xattr_block_set+0x4c82/0x5530 fs/ext4/xattr.c:1022
     ext4_xattr_set_handle+0x1332/0x20a0 fs/ext4/xattr.c:1252
     ext4_xattr_set+0x4d2/0x680 fs/ext4/xattr.c:1306
     ext4_xattr_trusted_set+0x8d/0xa0 fs/ext4/xattr_trusted.c:36
     __vfs_setxattr+0x703/0x790 fs/xattr.c:149
     __vfs_setxattr_noperm+0x27a/0x6f0 fs/xattr.c:180
     vfs_setxattr fs/xattr.c:223 [inline]
     setxattr+0x6ae/0x790 fs/xattr.c:449
     path_setxattr+0x1eb/0x380 fs/xattr.c:468
     SYSC_lsetxattr+0x8d/0xb0 fs/xattr.c:490
     SyS_lsetxattr+0x77/0xa0 fs/xattr.c:486
     entry_SYSCALL_64_fastpath+0x13/0x94
    origin:
     save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
     kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302 [inline]
     kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198
     kmsan_kmalloc+0x7f/0xe0 mm/kmsan/kmsan.c:337
     kmem_cache_alloc+0x1c2/0x1e0 mm/slub.c:2766
     mb_cache_entry_create+0x283/0xc60 fs/mbcache.c:86
     ext4_xattr_cache_insert fs/ext4/xattr.c:1647 [inline]
     ext4_xattr_block_set+0x4c82/0x5530 fs/ext4/xattr.c:1022
     ext4_xattr_set_handle+0x1332/0x20a0 fs/ext4/xattr.c:1252
     ext4_xattr_set+0x4d2/0x680 fs/ext4/xattr.c:1306
     ext4_xattr_trusted_set+0x8d/0xa0 fs/ext4/xattr_trusted.c:36
     __vfs_setxattr+0x703/0x790 fs/xattr.c:149
     __vfs_setxattr_noperm+0x27a/0x6f0 fs/xattr.c:180
     vfs_setxattr fs/xattr.c:223 [inline]
     setxattr+0x6ae/0x790 fs/xattr.c:449
     path_setxattr+0x1eb/0x380 fs/xattr.c:468
     SYSC_lsetxattr+0x8d/0xb0 fs/xattr.c:490
     SyS_lsetxattr+0x77/0xa0 fs/xattr.c:486
     entry_SYSCALL_64_fastpath+0x13/0x94
    ==================================================================
    
    Signed-off-by: Alexander Potapenko <glider@google.com>
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Cc: stable@vger.kernel.org # v4.6
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b7dc0f532107ec150ccaf381d926c07f6c3fa30d
Author: Stewart Smith <stewart@linux.vnet.ibm.com>
Date:   Tue Aug 2 11:50:16 2016 +1000

    rtc-opal: Fix handling of firmware error codes, prevent busy loops
    
    commit 5b8b58063029f02da573120ef4dc9079822e3cda upstream.
    
    According to the OPAL docs:
      skiboot-5.2.5/doc/opal-api/opal-rtc-read-3.txt
      skiboot-5.2.5/doc/opal-api/opal-rtc-write-4.txt
    
    OPAL_HARDWARE may be returned from OPAL_RTC_READ or OPAL_RTC_WRITE and
    this indicates either a transient or permanent error.
    
    Prior to this patch, Linux was not dealing with OPAL_HARDWARE being a
    permanent error particularly well, in that you could end up in a busy
    loop.
    
    This was not too hard to trigger on an AMI BMC based OpenPOWER machine
    doing a continuous "ipmitool mc reset cold" to the BMC, the result of
    that being that we'd get stuck in an infinite loop in
    opal_get_rtc_time().
    
    We now retry a few times before returning the error higher up the
    stack.
    
    Fixes: 16b1d26e77b1 ("rtc/tpo: Driver to support rtc and wakeup on PowerNV platform")
    Cc: stable@vger.kernel.org # v3.19+
    Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9172bbcdef221d76976c8df9caafe8ada07c3389
Author: Julia Lawall <Julia.Lawall@lip6.fr>
Date:   Sat Jan 27 15:28:15 2018 +0100

    drm/radeon: adjust tested variable
    
    commit 3a61b527b4e1f285d21b6e9e623dc45cf8bb391f upstream.
    
    Check the variable that was most recently initialized.
    
    The semantic match that finds this problem is as follows:
    (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @@
    expression x, y, f, g, e, m;
    statement S1,S2,S3,S4;
    @@
    
    x = f(...);
    if (\(<+...x...+>\&e\)) S1 else S2
    (
    x = g(...);
    |
    m = g(...,&x,...);
    |
    y = g(...);
    *if (e)
     S3 else S4
    )
    // </smpl>
    
    Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d7b2a68485787a655a4e7f71def1d08289f644e6
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Nov 21 12:09:38 2017 -0500

    drm/radeon: Add dpm quirk for Jet PRO (v2)
    
    commit 239b5f64e12b1f09f506c164dff0374924782979 upstream.
    
    Fixes stability issues.
    
    v2: clamp sclk to 600 Mhz
    
    Bug: https://bugs.freedesktop.org/show_bug.cgi?id=103370
    Acked-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit aed3b970e68235dcf465b18f4c12a7efd09fb177
Author: Steffen Weber <steffen.weber@gmail.com>
Date:   Tue Jan 2 19:24:09 2018 +0100

    scsi: smartpqi: allow static build ("built-in")
    
    commit dc2db1dc5fb9ab3a43b305c2720fee5278dbee2a upstream.
    
    If CONFIG_SCSI_SMARTPQI=y then don't build this driver as a module.
    
    Signed-off-by: Steffen Weber <steffen.weber@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>