[PATCH 4.9 000/105] 4.9.55-stable review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 4.9.55 release.
There are 105 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu Oct 12 19:24:56 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.55-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.9.55-rc1

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: fix singlestepping over syscall

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: don't allow encrypted operations without keys

Theodore Ts'o <tytso@mit.edu>
    ext4: don't allow encrypted operations without keys

Jan Kara <jack@suse.cz>
    ext4: Don't clear SGID when inheriting ACLs

Jan Kara <jack@suse.cz>
    ext4: fix data corruption for mmap writes

Amir Goldstein <amir73il@gmail.com>
    vfs: deny copy_file_range() for non regular files

Peter Zijlstra <peterz@infradead.org>
    sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs

Chanho Min <chanho.min@lge.com>
    mmc: core: add driver strength selection when selecting hs400es

Christoph Hellwig <hch@lst.de>
    nvme-pci: Use PCI bus address for data/queues in CMB

Jani Nikula <jani.nikula@intel.com>
    drm/i915/bios: ignore HDMI on port A

Arend Van Spriel <arend.vanspriel@broadcom.com>
    brcmfmac: setup passive scan if requested by user-space

Arend Van Spriel <arend.vanspriel@broadcom.com>
    brcmfmac: add length check in brcmf_cfg80211_escan_handler()

Martin K. Petersen <martin.petersen@oracle.com>
    scsi: sd: Do not override max_sectors_kb sysfs setting

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: add workaround to disable wide channels in 5GHz

Luca Coelho <luciano.coelho@intel.com>
    iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD

Arnd Bergmann <arnd@arndb.de>
    netlink: fix nla_put_{u8,u16,u32} for KASAN

Arnd Bergmann <arnd@arndb.de>
    rocker: fix rocker_tlv_put_* functions for KASAN

Ping Cheng <pinglinux@gmail.com>
    HID: wacom: bits shifted too much for 9th and 10th buttons

Jason Gerecke <killertofu@gmail.com>
    HID: wacom: Always increment hdev refcount within wacom_get_hdev_data

Aaron Armstrong Skomra <skomra@gmail.com>
    HID: wacom: leds: Don't try to control the EKR's read-only LEDs

Adrian Salido <salidoa@google.com>
    HID: i2c-hid: allocate hid buffers for real worst case

Shu Wang <shuwang@redhat.com>
    ftrace: Fix kmemleak in unregister_ftrace_graph

Alexander Shishkin <alexander.shishkin@linux.intel.com>
    stm class: Fix a use-after-free

Olaf Hering <olaf@aepfle.de>
    Drivers: hv: fcopy: restore correct transfer length

Nicolai Stange <nstange@suse.de>
    driver core: platform: Don't read past the end of "driver_override" buffer

Mark Rutland <mark.rutland@arm.com>
    percpu: make this_cpu_generic_read() atomic w.r.t. interrupts

Gustavo Romero <gromero@linux.vnet.ibm.com>
    powerpc/tm: Fix illegal TM state in signal handler

Cyril Bur <cyrilbur@gmail.com>
    powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks

Eric Dumazet <edumazet@google.com>
    socket, bpf: fix possible use after free

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    net: rtnetlink: fix info leak in RTM_GETSTATS call

Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
    tipc: use only positive error codes in messages

Xin Long <lucien.xin@gmail.com>
    ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path

Xin Long <lucien.xin@gmail.com>
    ip6_gre: ip6gre_tap device should keep dst

Jason A. Donenfeld <Jason@zx2c4.com>
    netlink: do not proceed if dump's start() errs

Christoph Paasch <cpaasch@apple.com>
    net: Set sk_prot_creator when cloning sockets to the right proto

Willem de Bruijn <willemb@google.com>
    packet: only test po->has_vnet_hdr once in packet_snd

Willem de Bruijn <willemb@google.com>
    packet: in packet_do_bind, test fanout with bind_lock held

Florian Fainelli <f.fainelli@gmail.com>
    net: dsa: Fix network device registration order

Alexander Potapenko <glider@google.com>
    tun: bail out from tun_get_user() if the skb is empty

Sabrina Dubroca <sd@queasysnail.net>
    l2tp: fix race condition in l2tp_tunnel_delete

Ridge Kennedy <ridge.kennedy@alliedtelesis.co.nz>
    l2tp: Avoid schedule while atomic in exit_net

Alexey Kodanev <alexey.kodanev@oracle.com>
    vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit

Timur Tabi <timur@codeaurora.org>
    net: qcom/emac: specify the correct size when mapping a DMA buffer

Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
    net_sched: always reset qdisc backlog in qdisc_reset()

Meng Xu <mengxu.gatech@gmail.com>
    isdn/i4l: fetch the ppp_write buffer in one shot

Yonghong Song <yhs@fb.com>
    bpf: one perf event close won't free bpf program attached by another perf event

Willem de Bruijn <willemb@google.com>
    packet: hold bind lock when rebinding to fanout hook

Christian Lamparter <chunkeey@googlemail.com>
    net: emac: Fix napi poll list corruption

Eric Dumazet <edumazet@google.com>
    tcp: fastopen: fix on syn-data transmit failure

Davide Caratti <dcaratti@redhat.com>
    net/sched: cls_matchall: fix crash when used with classful qdisc

Xin Long <lucien.xin@gmail.com>
    ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline

Fahad Kunnathadi <fahad.kunnathadi@dexceldesigns.com>
    net: phy: Fix mask value write on gmii2rgmii converter speed register

Xin Long <lucien.xin@gmail.com>
    ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header

Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
    udpv6: Fix the checksum computation when HW checksum does not apply

Eric Dumazet <edumazet@google.com>
    tcp: fix data delivery rate

Edward Cree <ecree@solarflare.com>
    bpf/verifier: reject BPF_ALU64|BPF_END

Eric Dumazet <edumazet@googl.com>
    tcp: update skb->skb_mstamp more carefully

Dan Carpenter <dan.carpenter@oracle.com>
    sctp: potential read out of bounds in sctp_ulpevent_type_enabled()

Jiri Pirko <jiri@mellanox.com>
    net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker

Yuval Mintz <yuvalm@mellanox.com>
    mlxsw: spectrum: Prevent mirred-related crash on removal

Takashi Iwai <tiwai@suse.de>
    ALSA: usx2y: Suppress kernel warning at page allocation failures

Takashi Sakamoto <o-takashi@sakamocchi.jp>
    Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"

Guneshwor Singh <guneshwor.o.singh@intel.com>
    ALSA: compress: Remove unused variable

Casey Schaufler <casey@schaufler-ca.com>
    lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
    lib/ratelimit.c: use deferred printk() version

Michal Hocko <mhocko@suse.com>
    mm, oom_reaper: skip mm structs with mmu notifiers

Stefan Wahren <stefan.wahren@i2se.com>
    staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist

Andrey Konovalov <andreyknvl@google.com>
    uwb: ensure that endpoint is interrupt

Andrey Konovalov <andreyknvl@google.com>
    uwb: properly check kthread_run return value

Lukas Wunner <lukas@wunner.de>
    iio: adc: mcp320x: Fix oops on module unload

Lukas Wunner <lukas@wunner.de>
    iio: adc: mcp320x: Fix readout of negative voltages

Dragos Bogdan <dragos.bogdan@analog.com>
    iio: ad7793: Fix the serial interface reset

Colin Parker <colin.parker@aclima.io>
    IIO: BME280: Updates to Humidity readings need ctrl_reg write!

Matt Fornero <matt.fornero@mathworks.com>
    iio: core: Return error for failed read_reg

Stefan Popa <stefan.popa@analog.com>
    staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.

Dragos Bogdan <dragos.bogdan@analog.com>
    iio: ad_sigma_delta: Implement a dedicated reset function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'

Kai-Heng Feng <kai.heng.feng@canonical.com>
    Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"

Mathias Nyman <mathias.nyman@linux.intel.com>
    xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor

Mathias Nyman <mathias.nyman@linux.intel.com>
    xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround

Mathias Nyman <mathias.nyman@linux.intel.com>
    xhci: fix finding correct bus_state structure for USB 3.1 hosts

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    USB: fix out-of-bounds in usb_set_configuration

Dmitry Fleytman <dmitry@daynix.com>
    usb: Increase quirk delay for USB devices

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    USB: core: harden cdc_parse_cdc_header

Alan Stern <stern@rowland.harvard.edu>
    USB: uas: fix bug in handling of alternate settings

Alan Stern <stern@rowland.harvard.edu>
    USB: g_mass_storage: Fix deadlock when driver is unbound

Li Jun <jun.li@nxp.com>
    usb: gadget: mass_storage: set msg_registered after msg registered

Dan Carpenter <dan.carpenter@oracle.com>
    USB: devio: Don't corrupt user memory

Alan Stern <stern@rowland.harvard.edu>
    USB: dummy-hcd: Fix erroneous synchronization change

Alan Stern <stern@rowland.harvard.edu>
    USB: dummy-hcd: fix infinite-loop resubmission bug

Alan Stern <stern@rowland.harvard.edu>
    USB: dummy-hcd: fix connection failures (wrong speed)

Bjørn Mork <bjorn@mork.no>
    USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse

Jim Dickerson <jim.dickerson@hpe.com>
    usb: pci-quirks.c: Corrected timeout values used in handshake

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe

Alan Stern <stern@rowland.harvard.edu>
    usb-storage: fix bogus hardware error messages for ATA pass-thru devices

Alan Stern <stern@rowland.harvard.edu>
    usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: gadget: udc: renesas_usb3: fix for no-data control transfer

Nicolas Ferre <nicolas.ferre@microchip.com>
    usb: gadget: udc: atmel: set vbus irqflags explicitly

Alan Stern <stern@rowland.harvard.edu>
    USB: gadgetfs: fix copy_to_user while holding spinlock

Alan Stern <stern@rowland.harvard.edu>
    USB: gadgetfs: Fix crash caused by inadequate synchronization


-------------

Diffstat:

 Makefile                                           |  4 +-
 arch/powerpc/kernel/exceptions-64s.S               | 24 ++++++-
 arch/powerpc/kernel/signal_64.c                    | 13 +++-
 arch/x86/include/asm/kvm_emulate.h                 |  1 +
 arch/x86/kvm/emulate.c                             |  1 +
 arch/x86/kvm/x86.c                                 | 52 +++++++--------
 drivers/base/platform.c                            |  3 +-
 drivers/gpu/drm/i915/intel_bios.c                  |  7 +++
 drivers/hid/i2c-hid/i2c-hid.c                      |  3 +-
 drivers/hid/wacom_sys.c                            |  7 ++-
 drivers/hid/wacom_wac.c                            |  4 +-
 drivers/hv/hv_fcopy.c                              |  4 ++
 drivers/hwtracing/stm/core.c                       |  2 +-
 drivers/iio/adc/ad7793.c                           |  4 +-
 drivers/iio/adc/ad_sigma_delta.c                   | 28 +++++++++
 drivers/iio/adc/mcp320x.c                          | 25 +++++---
 drivers/iio/adc/twl4030-madc.c                     | 10 ++-
 drivers/iio/industrialio-core.c                    |  4 +-
 drivers/iio/pressure/bmp280-core.c                 |  2 +-
 drivers/isdn/i4l/isdn_ppp.c                        | 37 +++++++----
 drivers/mmc/core/mmc.c                             | 36 ++++++-----
 drivers/net/ethernet/ibm/emac/mal.c                |  3 +-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     | 20 +++---
 drivers/net/ethernet/qualcomm/emac/emac-mac.c      |  3 +-
 drivers/net/ethernet/rocker/rocker_tlv.h           | 48 ++++++++------
 drivers/net/phy/xilinx_gmii2rgmii.c                |  2 +-
 drivers/net/tun.c                                  |  8 ++-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 37 +++++------
 .../broadcom/brcm80211/brcmfmac/fwil_types.h       |  5 ++
 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 66 +++++++++++++++----
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  | 10 ++-
 drivers/nvme/host/pci.c                            | 14 ++---
 drivers/scsi/sd.c                                  | 19 ++++--
 drivers/staging/iio/adc/ad7192.c                   |  4 +-
 .../interface/vchiq_arm/vchiq_2835_arm.c           |  6 +-
 drivers/usb/class/cdc-wdm.c                        |  4 +-
 drivers/usb/core/config.c                          | 16 +++--
 drivers/usb/core/devio.c                           |  6 +-
 drivers/usb/core/hub.c                             |  2 +-
 drivers/usb/core/message.c                         |  4 ++
 drivers/usb/gadget/function/f_mass_storage.c       | 27 +++-----
 drivers/usb/gadget/function/f_mass_storage.h       | 14 -----
 drivers/usb/gadget/legacy/inode.c                  | 46 ++++++++++++--
 drivers/usb/gadget/legacy/mass_storage.c           | 20 +-----
 drivers/usb/gadget/udc/atmel_usba_udc.c            |  4 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 | 56 +++++++++++++++--
 drivers/usb/gadget/udc/renesas_usb3.c              | 19 ++++--
 drivers/usb/host/pci-quirks.c                      | 10 +--
 drivers/usb/host/xhci-hub.c                        | 14 +++--
 drivers/usb/host/xhci-pci.c                        | 12 ----
 drivers/usb/host/xhci.h                            |  4 +-
 drivers/usb/renesas_usbhs/fifo.c                   | 21 ++++++-
 drivers/usb/storage/transport.c                    | 14 ++++-
 drivers/usb/storage/uas-detect.h                   | 15 ++---
 drivers/usb/storage/uas.c                          | 10 +--
 drivers/usb/storage/unusual_devs.h                 |  7 +++
 drivers/uwb/hwa-rc.c                               |  2 +
 drivers/uwb/uwbd.c                                 | 12 ++--
 fs/ext4/acl.c                                      | 22 ++++---
 fs/ext4/inode.c                                    | 18 +++++-
 fs/ext4/namei.c                                    | 12 ++++
 fs/f2fs/namei.c                                    | 12 ++++
 fs/read_write.c                                    |  5 ++
 fs/xattr.c                                         |  2 +-
 include/asm-generic/percpu.h                       | 24 ++++++-
 include/linux/cpuset.h                             |  6 ++
 include/linux/iio/adc/ad_sigma_delta.h             |  3 +
 include/linux/mmu_notifier.h                       |  5 ++
 include/linux/trace_events.h                       |  1 +
 include/net/netlink.h                              | 73 ++++++++++++++++------
 include/net/sctp/ulpevent.h                        |  6 +-
 include/uapi/linux/usb/ch9.h                       |  1 +
 kernel/bpf/verifier.c                              |  3 +-
 kernel/cpuset.c                                    | 16 ++++-
 kernel/events/core.c                               |  3 +-
 kernel/power/process.c                             |  5 +-
 kernel/sched/core.c                                |  7 +--
 kernel/trace/ftrace.c                              | 14 -----
 lib/ratelimit.c                                    |  4 +-
 mm/oom_kill.c                                      | 16 +++++
 net/core/filter.c                                  | 15 ++++-
 net/core/rtnetlink.c                               |  3 +
 net/core/sock.c                                    |  7 ++-
 net/dsa/slave.c                                    | 28 +++++----
 net/ipv4/ip_vti.c                                  |  3 +-
 net/ipv4/tcp_output.c                              | 33 +++++++---
 net/ipv6/ip6_gre.c                                 | 22 ++++---
 net/ipv6/ip6_tunnel.c                              |  8 ++-
 net/ipv6/ip6_vti.c                                 |  3 +-
 net/ipv6/udp.c                                     |  1 +
 net/l2tp/l2tp_core.c                               | 14 ++---
 net/l2tp/l2tp_core.h                               |  5 +-
 net/netlink/af_netlink.c                           |  7 ++-
 net/packet/af_packet.c                             | 28 ++++++---
 net/sched/act_api.c                                |  6 +-
 net/sched/cls_matchall.c                           |  1 +
 net/sched/sch_generic.c                            |  1 +
 net/tipc/msg.c                                     |  2 +-
 security/smack/smack_lsm.c                         | 55 ++++++++--------
 sound/core/compress_offload.c                      |  3 +-
 sound/pci/echoaudio/echoaudio.c                    |  6 +-
 sound/usb/card.c                                   | 20 ++++++
 sound/usb/usx2y/usb_stream.c                       |  6 +-
 103 files changed, 953 insertions(+), 437 deletions(-)