[PATCH 3.18 000/124] 3.18.50-stable review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 3.18.50 release.
There are 124 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat Apr 22 06:35:33 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.50-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 3.18.50-rc1

Linus Torvalds <torvalds@linux-foundation.org>
    give up on gcc ilog2() constant optimizations

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Add missing fixups

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Fix src fixup in from user rapf loops

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Set flags before ADDZ

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Zero rest of buffer from copy_from_user

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Add early abort to copy_to_user

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Fix alignment error checking

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Drop unused macros

Huacai Chen <chenhc@lemote.com>
    MIPS: Flush wrong invalid FTLB entry for huge page

Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    ring-buffer: Fix return value check in test_ringbuffer()

Chris Salls <salls@cs.ucsb.edu>
    mm/mempolicy.c: fix error handling in set_mempolicy and mbind.

Rafał Miłecki <rafal@milecki.pl>
    mtd: bcm47xxpart: fix parsing first block after aligned TRX

Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()

Bjorn Andersson <bjorn.andersson@linaro.org>
    pinctrl: qcom: Don't clear status bit on irq_unmask

Ladi Prosek <lprosek@redhat.com>
    virtio_balloon: init 1st buffer in stats vq

Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
    block: allow WRITE_SAME commands with the SG_IO ioctl

Henrik Ingo <henrik.ingo@avoinelama.fi>
    uvcvideo: uvc_scan_fallback() for webcams with broken chain

Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
    serial: 8250_pci: Detach low-level driver during PCI error recovery

Joerg Roedel <jroedel@suse.de>
    ACPI: Do not create a platform_device for IOAPIC/IOxAPIC

Josh Poimboeuf <jpoimboe@redhat.com>
    ACPI: Fix incompatibility with mcount-based function graph tracing

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: clear _XBF_PAGES from buffers when readahead page

Eric Sandeen <sandeen@sandeen.net>
    xfs: fix up xfs_swap_extent_forks inline extent handling

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: don't allow di_size with high bit set

Todd Fujinaka <todd.fujinaka@intel.com>
    igb: add i211 to i210 PHY workaround

Chris J Arges <christopherarges@gmail.com>
    igb: Workaround for igb i210 firmware issue

Koos Vriezen <koos.vriezen@gmail.com>
    iommu/vt-d: Fix NULL pointer dereference in device_to_iommu

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci: Do not disable interrupts while waiting for clock

Eric Biggers <ebiggers@google.com>
    ext4: mark inode dirty after converting inline directory

Michael Engl <michael.engl@wjw-solutions.com>
    iio: adc: ti_am335x_adc: fix fifo overrun recovery

Johan Hovold <johan@kernel.org>
    USB: usbtmc: add missing endpoint sanity check

Johan Hovold <johan@kernel.org>
    uwb: i1480-dfu: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    uwb: hwa-rc: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    mmc: ushc: fix NULL-deref at probe

Eric Dumazet <edumazet@google.com>
    tcp: initialize icsk_ack.lrcvtime at session start time

Daniel Borkmann <daniel@iogearbox.net>
    socket, bpf: fix sk_filter use after free in sk_clone_lock

Andrey Ulanov <andreyu@google.com>
    net: unix: properly re-increment inflight counter of GC discarded candidates

Eric Dumazet <edumazet@google.com>
    net: properly release sk_frag.page

Florian Fainelli <f.fainelli@gmail.com>
    net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled

Maor Gottlieb <maorg@mellanox.com>
    net/mlx5: Increase number of max QPs in default profile

Oliver Neukum <oneukum@suse.com>
    ACM gadget: fix endianness in notifications

Johan Hovold <johan@kernel.org>
    Input: sur40 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: kbtab - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: cm109 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: yealink - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: hanwang - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: ims-pcu - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: iforce - validate number of endpoints before using them

Kai-Heng Feng <kai.heng.feng@canonical.com>
    Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000

Eric Dumazet <edumazet@google.com>
    ipv4: provide stronger user input validation in nl_fib_input()

Tahsin Erdogan <tahsin@google.com>
    percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages

Johan Hovold <johan@kernel.org>
    isdn/gigaset: fix NULL-deref at probe

Max Lohrmann <post@wickenrode.com>
    target: Fix VERIFY_16 handling in sbc_parse_cdb

Shaohua Li <shli@fb.com>
    md/raid1/10: fix potential deadlock

Peter Zijlstra <peterz@infradead.org>
    perf/core: Fix event inheritance on fork()

Marc Zyngier <marc.zyngier@arm.com>
    arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region

David Hildenbrand <david@redhat.com>
    KVM: kvm_io_bus_unregister_dev() should never fail

Peter Xu <peterx@redhat.com>
    KVM: x86: clear bus pointer when destroyed

Thomas Huth <thuth@redhat.com>
    KVM: PPC: Book3S PR: Fix illegal opcode emulation

Roman Mashak <mrv@mojatatu.com>
    net sched actions: decrement module reference count after table flush.

Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    sctp: deny peeloff operation on asocs with threads sleeping on it

Mantas M <grawity@gmail.com>
    net: ipv6: check route protocol when deleting routes

Ben Hutchings <ben@decadent.org.uk>
    catc: Use heap buffer for memory size test

Ben Hutchings <ben@decadent.org.uk>
    catc: Combine failure cleanup code in catc_probe()

Ben Hutchings <ben@decadent.org.uk>
    rtl8150: Use heap buffers for all register access

Ben Hutchings <ben@decadent.org.uk>
    pegasus: Use heap buffers for all register access

Omar Sandoval <osandov@fb.com>
    virtio-console: avoid DMA from stack

Stefan Brüns <stefan.bruens@rwth-aachen.de>
    dvb-usb-firmware: don't do DMA on stack

Mauro Carvalho Chehab <mchehab@s-opensource.com>
    dvb-usb: don't use stack for firmware load

Kees Cook <keescook@chromium.org>
    mm: Tighten x86 /dev/mem with zeroing reads

Thierry Reding <treding@nvidia.com>
    rtc: tegra: Implement clock handling

Lee, Chun-Yi <joeyli.kernel@gmail.com>
    platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event

Arnd Bergmann <arnd@arndb.de>
    dvb-usb-v2: avoid use-after-free

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: ahash - Fix EINPROGRESS notification callback

Benjamin Herrenschmidt <benh@kernel.crashing.org>
    powerpc: Disable HFSCR[TM] if TM is not supported

Minchan Kim <minchan@kernel.org>
    zram: do not use copy_page with non-page aligned address

Richard Genoud <richard.genoud@gmail.com>
    tty/serial: atmel: fix race condition (TX+DMA)

Horia Geantă <horia.geanta@nxp.com>
    crypto: caam - fix RNG deinstantiation error checking

Ankur Arora <ankur.a.arora@oracle.com>
    xen/acpi: upload PM state from init-domain to Xen

John Garry <john.garry@huawei.com>
    scsi: libsas: fix ata xfer length

peter chang <dpf@google.com>
    scsi: sg: check length passed to SG_NEXT_CMD_LEN

Chris Leech <cleech@redhat.com>
    scsi: libiscsi: add lock around task lists to fix list corruption regression

Anton Blanchard <anton@samba.org>
    scsi: lpfc: Add shutdown method for kexec

Nicholas Bellinger <nab@linux-iscsi.org>
    target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/boot: Fix zImage TOC alignment

Paul Mackerras <paulus@ozlabs.org>
    powerpc: Don't try to fix up misaligned load-with-reservation instructions

Frederic Barrat <fbarrat@linux.vnet.ibm.com>
    powerpc/mm: Add missing global TLB invalidate if cxl is active

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix race during FIFO resize

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: improve irq handling

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: implement reset routine as suggested by the reference

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: make sure all members in the output are set

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: fix reading out alarm

Vitaly Kuznetsov <vkuznets@redhat.com>
    Drivers: hv: balloon: don't crash when memory is added in non-sorted order

bsegall@google.com <bsegall@google.com>
    ptrace: fix PTRACE_LISTEN race corrupting task->state

Jan-Marek Glogowski <glogow@fbihome.de>
    Reset TreeId to zero on SMB2 TREE_CONNECT

Heiko Carstens <heiko.carstens@de.ibm.com>
    s390/uaccess: get_user() should zero on failure (again)

Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
    s390/decompressor: fix initrd corruption caused by bss clear

Dave Martin <Dave.Martin@arm.com>
    metag/ptrace: Reject partial NT_METAG_RPIPE writes

Dave Martin <Dave.Martin@arm.com>
    metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS

Dave Martin <Dave.Martin@arm.com>
    metag/ptrace: Preserve previous registers for short regset write

Dave Martin <Dave.Martin@arm.com>
    sparc/ptrace: Preserve previous registers for short regset write

Dave Martin <Dave.Martin@arm.com>
    mips/ptrace: Preserve previous registers for short regset write

Dave Martin <Dave.Martin@arm.com>
    c6x/ptrace: Remove useless PTRACE_SETREGSET implementation

Li Qiang <liq3ea@gmail.com>
    drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

Thomas Hellstrom <thellstrom@vmware.com>
    drm/vmwgfx: Remove getparam error message

Thomas Hellstrom <thellstrom@vmware.com>
    drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

Murray McAllister <murray.mcallister@insomniasec.com>
    drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

Murray McAllister <murray.mcallister@insomniasec.com>
    drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

Thomas Hellstrom <thellstrom@vmware.com>
    drm/vmwgfx: Type-check lookups of fence objects

Paolo Bonzini <pbonzini@redhat.com>
    kvm: fix page struct leak in handle_vmon

Amit Pundir <amit.pundir@linaro.org>
    Revert "ARM: 8457/1: psci-smp is built only for SMP"

Max Bires <jbires@google.com>
    char: lack of bool string made CONFIG_DEVPORT always on

Geert Uytterhoeven <geert@linux-m68k.org>
    char: Drop bogus dependency of DEVPORT on !M68K

Steven Rostedt (VMware) <rostedt@goodmis.org>
    ftrace: Fix removing of second function probe

Juergen Gross <jgross@suse.com>
    xen, fbfront: fix connecting to backend

Martin K. Petersen <martin.petersen@oracle.com>
    scsi: sd: Fix capacity calculation with 32-bit sector_t

Martin K. Petersen <martin.petersen@oracle.com>
    scsi: sr: Sanity check returned mode data

Nicholas Bellinger <nab@linux-iscsi.org>
    iscsi-target: Drop work-around for legacy GlobalSAN initiator

Nicholas Bellinger <nab@linux-iscsi.org>
    iscsi-target: Fix TMR reference leak during session shutdown

Mathias Krause <minipli@googlemail.com>
    x86/vdso: Ensure vdso32_enabled gets set to valid values only

Thomas Gleixner <tglx@linutronix.de>
    x86/vdso: Plug race between mapping and ELF header setup

Peter Zijlstra <peterz@infradead.org>
    perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()

Cameron Gutman <aicommander@gmail.com>
    Input: xpad - add support for Razer Wildcat gamepad

Germano Percossi <germano.percossi@citrix.com>
    CIFS: store results of cifs_reopen_file to avoid infinite wait


-------------

Diffstat:

 Makefile                                       |   4 +-
 arch/arm/include/asm/psci.h                    |   2 +-
 arch/arm/kvm/mmu.c                             |   3 +
 arch/c6x/kernel/ptrace.c                       |  41 ----
 arch/metag/include/asm/uaccess.h               |  15 +-
 arch/metag/kernel/ptrace.c                     |  19 +-
 arch/metag/lib/usercopy.c                      | 312 ++++++++++---------------
 arch/mips/kernel/ptrace.c                      |   3 +-
 arch/mips/mm/tlbex.c                           |  25 +-
 arch/powerpc/boot/zImage.lds.S                 |   1 +
 arch/powerpc/kernel/align.c                    |  27 ++-
 arch/powerpc/kernel/setup_64.c                 |   9 +
 arch/powerpc/kvm/emulate.c                     |   1 -
 arch/powerpc/mm/hash_native_64.c               |   7 +-
 arch/s390/boot/compressed/misc.c               |  35 +--
 arch/s390/include/asm/uaccess.h                |   2 +-
 arch/sparc/kernel/ptrace_64.c                  |   2 +-
 arch/x86/include/asm/elf.h                     |   2 +-
 arch/x86/kernel/cpu/perf_event_intel_lbr.c     |   2 +
 arch/x86/kvm/vmx.c                             |  10 +-
 arch/x86/mm/init.c                             |  40 +++-
 arch/x86/vdso/vdso32-setup.c                   |  11 +-
 block/scsi_ioctl.c                             |   3 +
 crypto/ahash.c                                 |  79 ++++---
 drivers/acpi/Makefile                          |   1 -
 drivers/acpi/acpi_platform.c                   |   8 +-
 drivers/block/zram/zram_drv.c                  |   6 +-
 drivers/char/Kconfig                           |   6 +-
 drivers/char/mem.c                             |  82 ++++---
 drivers/char/virtio_console.c                  |  12 +-
 drivers/crypto/caam/ctrl.c                     |   3 +-
 drivers/gpu/drm/ttm/ttm_object.c               |  10 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c          |  79 ++++---
 drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c          |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c       |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c        |  31 ++-
 drivers/hv/hv_balloon.c                        |   4 +-
 drivers/iio/adc/ti_am335x_adc.c                |  13 +-
 drivers/input/joystick/iforce/iforce-usb.c     |   3 +
 drivers/input/joystick/xpad.c                  |   2 +
 drivers/input/misc/cm109.c                     |   4 +
 drivers/input/misc/ims-pcu.c                   |   4 +
 drivers/input/misc/yealink.c                   |   4 +
 drivers/input/serio/i8042-x86ia64io.h          |   7 +
 drivers/input/tablet/hanwang.c                 |   3 +
 drivers/input/tablet/kbtab.c                   |   3 +
 drivers/input/touchscreen/sur40.c              |   3 +
 drivers/iommu/intel-iommu.c                    |   2 +-
 drivers/isdn/gigaset/bas-gigaset.c             |   3 +
 drivers/md/raid10.c                            |  18 ++
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c    |  10 +-
 drivers/media/usb/dvb-usb/dvb-usb-firmware.c   |  33 ++-
 drivers/media/usb/uvc/uvc_driver.c             | 118 +++++++++-
 drivers/mmc/host/sdhci.c                       |   4 +-
 drivers/mmc/host/ushc.c                        |   3 +
 drivers/mtd/bcm47xxpart.c                      |  10 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c |   6 +-
 drivers/net/ethernet/intel/igb/e1000_phy.c     |   4 +
 drivers/net/ethernet/mellanox/mlx5/core/main.c |   2 +-
 drivers/net/usb/catc.c                         |  56 +++--
 drivers/net/usb/pegasus.c                      |  29 ++-
 drivers/net/usb/rtl8150.c                      |  34 ++-
 drivers/pinctrl/qcom/pinctrl-msm.c             |   4 -
 drivers/platform/x86/acer-wmi.c                |  22 +-
 drivers/rtc/rtc-s35390a.c                      | 167 ++++++++++---
 drivers/rtc/rtc-tegra.c                        |  28 ++-
 drivers/scsi/libiscsi.c                        |  26 ++-
 drivers/scsi/libsas/sas_ata.c                  |   2 +-
 drivers/scsi/lpfc/lpfc_init.c                  |   1 +
 drivers/scsi/sd.c                              |  20 +-
 drivers/scsi/sg.c                              |   2 +
 drivers/scsi/sr.c                              |   6 +-
 drivers/target/iscsi/iscsi_target_parameters.c |  16 --
 drivers/target/iscsi/iscsi_target_util.c       |  12 +-
 drivers/target/target_core_pscsi.c             |  47 +---
 drivers/target/target_core_sbc.c               |  10 +-
 drivers/tty/serial/8250/8250_pci.c             |  23 +-
 drivers/tty/serial/atmel_serial.c              |   5 +
 drivers/usb/class/usbtmc.c                     |   7 +
 drivers/usb/gadget/function/f_acm.c            |   4 +-
 drivers/uwb/hwa-rc.c                           |   3 +
 drivers/uwb/i1480/dfu/usb.c                    |   3 +
 drivers/video/fbdev/xen-fbfront.c              |   4 +-
 drivers/virtio/virtio_balloon.c                |   2 +
 drivers/xen/xen-acpi-processor.c               |  34 ++-
 fs/cifs/file.c                                 |   6 +-
 fs/cifs/smb2pdu.c                              |   4 +
 fs/ext4/inline.c                               |   5 +-
 fs/xfs/libxfs/xfs_inode_buf.c                  |   8 +
 fs/xfs/xfs_bmap_util.c                         |   7 +-
 fs/xfs/xfs_buf.c                               |   1 +
 include/crypto/internal/hash.h                 |  10 +
 include/drm/ttm/ttm_object.h                   |   5 +-
 include/linux/kvm_host.h                       |   4 +-
 include/linux/log2.h                           |  13 +-
 include/scsi/libiscsi.h                        |   1 +
 kernel/events/core.c                           |   5 +-
 kernel/ptrace.c                                |  14 +-
 kernel/trace/ftrace.c                          |  20 +-
 kernel/trace/ring_buffer.c                     |   8 +-
 mm/hugetlb.c                                   |   6 +-
 mm/mempolicy.c                                 |  20 +-
 mm/percpu.c                                    |   5 +-
 net/core/sock.c                                |  16 +-
 net/ipv4/fib_frontend.c                        |   3 +-
 net/ipv4/tcp_input.c                           |   2 +-
 net/ipv4/tcp_minisocks.c                       |   1 +
 net/ipv6/route.c                               |   2 +
 net/sched/act_api.c                            |   5 +-
 net/sctp/socket.c                              |   8 +-
 net/unix/garbage.c                             |  18 +-
 sound/core/seq/seq_clientmgr.c                 |   1 +
 sound/core/seq/seq_fifo.c                      |   7 +
 sound/core/seq/seq_memory.c                    |  17 +-
 sound/core/seq/seq_memory.h                    |   1 +
 virt/kvm/eventfd.c                             |   3 +-
 virt/kvm/kvm_main.c                            |  40 +++-
 117 files changed, 1293 insertions(+), 704 deletions(-)