This is the 4.9.127 stable release

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlucuBEACgkQONu9yGCS
 aT4HlBAAnXzLh/c8dKPdWzU3Bx6L9If7syeW0Gl06AtGsUrVqrggOnumdXRgPV3y
 /4Br6piwrpjHP9P7m/pS03Ol3+DvD4JKhMRFr0VzGwk4e32wZ8cNd7qx5RF/4z9s
 tpebYJVJoRRmefi1EJyj+NAGgDCk+7A1pzW3W2NK/mirQdkHywfLJHhQDyHgmWQy
 jyDpz2ihNdorKHN8ogK7FYQ7JZC9tnooB4GZFObaB8nkaeMaRGD2V2jrHRi8a4tv
 5Bm9HmlGJOqtsstsr1Em6W+UNRKfztfDmYuk+H9xCo8odCSHeyx30nUDxjp6Bo2f
 OvC/x1x6JIVNsoAgzlRZKMJR1Lv0IK3SEVPrecOOSWeardtt92JUQjoLaLmW03xR
 dlnXZyDeO75Qbdgo/5b/d6RiVNGSv0CPDOQSREDMX6Rvf9P8ezceF/iDz0SrH9Zm
 GkjQCQ2yyqrrSID5baB562AHszBa+rdqgp4RBheE+M5s7UALL09tFJquaijZ8jvO
 dMs6f847MeMARFIGLNKff9cvWI2zanTwOPX+E3rcj88rN79jvIsyD/hDzkqHoR7J
 Rhb2K7478gC1N2XTOu97hNmB9qTNIn9U1hvS/f2d7SGyjOU9WR+XgCgDUWZsZnPP
 H4eeblr9iaCUHI/4Q+nWUuQPKnCdGb9Ay9lyq9uqHIQBz+uVZ4I=
 =hV8i
 -----END PGP SIGNATURE-----

Merge 4.9.127 into android-4.9

Changes in 4.9.127
	x86/speculation/l1tf: Fix up pte->pfn conversion for PAE
	act_ife: fix a potential use-after-free
	ipv4: tcp: send zero IPID for RST and ACK sent in SYN-RECV and TIME-WAIT state
	net: bcmgenet: use MAC link status for fixed phy
	net: sched: Fix memory exposure from short TCA_U32_SEL
	qlge: Fix netdev features configuration.
	r8169: add support for NCube 8168 network card
	tcp: do not restart timewait timer on rst reception
	vti6: remove !skb->ignore_df check from vti6_xmit()
	sctp: hold transport before accessing its asoc in sctp_transport_get_next
	vhost: correctly check the iova range when waking virtqueue
	hv_netvsc: ignore devices that are not PCI
	act_ife: move tcfa_lock down to where necessary
	act_ife: fix a potential deadlock
	net: sched: action_ife: take reference to meta module
	cifs: check if SMB2 PDU size has been padded and suppress the warning
	hfsplus: don't return 0 when fill_super() failed
	hfs: prevent crash on exit from failed search
	sunrpc: Don't use stack buffer with scatterlist
	fork: don't copy inconsistent signal handler state to child
	reiserfs: change j_timestamp type to time64_t
	hfsplus: fix NULL dereference in hfsplus_lookup()
	fat: validate ->i_start before using
	scripts: modpost: check memory allocation results
	virtio: pci-legacy: Validate queue pfn
	mm/fadvise.c: fix signed overflow UBSAN complaint
	fs/dcache.c: fix kmemcheck splat at take_dentry_name_snapshot()
	platform/x86: intel_punit_ipc: fix build errors
	s390/kdump: Fix memleak in nt_vmcoreinfo
	ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()
	mfd: sm501: Set coherent_dma_mask when creating subdevices
	platform/x86: asus-nb-wmi: Add keymap entry for lid flip action on UX360
	RDMA/hns: Fix usage of bitmap allocation functions return values
	irqchip/bcm7038-l1: Hide cpu offline callback when building for !SMP
	net/9p/trans_fd.c: fix race by holding the lock
	net/9p: fix error path of p9_virtio_probe
	powerpc: Fix size calculation using resource_size()
	perf probe powerpc: Fix trace event post-processing
	block: bvec_nr_vecs() returns value for wrong slab
	s390/dasd: fix hanging offline processing due to canceled worker
	s390/dasd: fix panic for failed online processing
	ACPI / scan: Initialize status to ACPI_STA_DEFAULT
	scsi: aic94xx: fix an error code in aic94xx_init()
	PCI: mvebu: Fix I/O space end address calculation
	dm kcopyd: avoid softlockup in run_complete_job
	staging: comedi: ni_mio_common: fix subdevice flags for PFI subdevice
	selftests/powerpc: Kill child processes on SIGINT
	RDS: IB: fix 'passing zero to ERR_PTR()' warning
	smb3: fix reset of bytes read and written stats
	SMB3: Number of requests sent should be displayed for SMB3 not just CIFS
	powerpc/pseries: Avoid using the size greater than RTAS_ERROR_LOG_MAX.
	clk: rockchip: Add pclk_rkpwm_pmu to PMU critical clocks in rk3399
	btrfs: replace: Reset on-disk dev stats value after replace
	btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized
	btrfs: Don't remove block group that still has pinned down bytes
	arm64: rockchip: Force CONFIG_PM on Rockchip systems
	ARM: rockchip: Force CONFIG_PM on Rockchip systems
	drm/edid: Add 6 bpc quirk for SDC panel in Lenovo B50-80
	tcp: Revert "tcp: tcp_probe: use spin_lock_bh()"
	debugobjects: Make stack check warning more informative
	x86/pae: use 64 bit atomic xchg function in native_ptep_get_and_clear
	kbuild: make missing $DEPMOD a Warning instead of an Error
	irda: Fix memory leak caused by repeated binds of irda socket
	irda: Only insert new objects into the global database via setsockopt
	Revert "ARM: imx_v6_v7_defconfig: Select ULPI support"
	enic: do not call enic_change_mtu in enic_probe
	Fixes: Commit 2aa6d036b7 ("mm: numa: avoid waiting on freed migrated pages")
	sch_htb: fix crash on init failure
	sch_multiq: fix double free on init failure
	sch_hhf: fix null pointer dereference on init failure
	sch_netem: avoid null pointer deref on init failure
	sch_tbf: fix two null pointer dereferences on init failure
	mei: me: allow runtime pm for platform with D0i3
	s390/lib: use expoline for all bcr instructions
	ASoC: wm8994: Fix missing break in switch
	btrfs: use correct compare function of dirty_metadata_bytes
	arm64: Fix mismatched cache line size detection
	arm64: Handle mismatched cache type
	Linux 4.9.127

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Makefile

@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 126
+SUBLEVEL = 127
 EXTRAVERSION =
 NAME = Roaring Lionus
 

arch/arm/configs/imx_v6_v7_defconfig

@@ -271,7 +271,6 @@ CONFIG_USB_STORAGE=y
 CONFIG_USB_CHIPIDEA=y
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
-CONFIG_USB_CHIPIDEA_ULPI=y
 CONFIG_USB_SERIAL=m
 CONFIG_USB_SERIAL_GENERIC=y
 CONFIG_USB_SERIAL_FTDI_SIO=m
@@ -308,7 +307,6 @@ CONFIG_USB_GADGETFS=m
 CONFIG_USB_FUNCTIONFS=m
 CONFIG_USB_MASS_STORAGE=m
 CONFIG_USB_G_SERIAL=m
-CONFIG_USB_ULPI_BUS=y
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y

arch/arm/mach-rockchip/Kconfig

@@ -16,6 +16,7 @@ config ARCH_ROCKCHIP
 	select ROCKCHIP_TIMER
 	select ARM_GLOBAL_TIMER
 	select CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK
+	select PM
 	help
 	  Support for Rockchip's Cortex-A9 Single-to-Quad-Core-SoCs
 	  containing the RK2928, RK30xx and RK31xx series.

arch/arm64/Kconfig.platforms

@@ -125,6 +125,7 @@ config ARCH_ROCKCHIP
 	select GPIOLIB
 	select PINCTRL
 	select PINCTRL_ROCKCHIP
+	select PM
 	select ROCKCHIP_TIMER
 	help
 	  This enables support for the ARMv8 based Rockchip chipsets,

arch/arm64/include/asm/cachetype.h

@@ -22,6 +22,11 @@
 #define CTR_L1IP_MASK		3
 #define CTR_CWG_SHIFT		24
 #define CTR_CWG_MASK		15
+#define CTR_DMINLINE_SHIFT	16
+#define CTR_IMINLINE_SHIFT	0
+
+#define CTR_CACHE_MINLINE_MASK	\
+	((0xf << CTR_DMINLINE_SHIFT) | (0xf << CTR_IMINLINE_SHIFT))
 
 #define ICACHE_POLICY_RESERVED	0
 #define ICACHE_POLICY_AIVIVT	1

arch/arm64/include/asm/cpucaps.h

@@ -37,7 +37,8 @@
 #define ARM64_UNMAP_KERNEL_AT_EL0		16
 #define ARM64_HARDEN_BRANCH_PREDICTOR		17
 #define ARM64_SSBD				18
+#define ARM64_MISMATCHED_CACHE_TYPE		19
 
-#define ARM64_NCAPS				19
+#define ARM64_NCAPS				20
 
 #endif /* __ASM_CPUCAPS_H */

arch/arm64/kernel/cpu_errata.c

@@ -17,6 +17,7 @@
  */
 
 #include <linux/types.h>
+#include <asm/cachetype.h>
 #include <asm/cpu.h>
 #include <asm/cputype.h>
 #include <asm/cpufeature.h>
@@ -31,12 +32,18 @@ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope)
 }
 
 static bool
-has_mismatched_cache_line_size(const struct arm64_cpu_capabilities *entry,
-				int scope)
+has_mismatched_cache_type(const struct arm64_cpu_capabilities *entry,
+			  int scope)
 {
+	u64 mask = CTR_CACHE_MINLINE_MASK;
+
+	/* Skip matching the min line sizes for cache type check */
+	if (entry->capability == ARM64_MISMATCHED_CACHE_TYPE)
+		mask ^= arm64_ftr_reg_ctrel0.strict_mask;
+
 	WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible());
-	return (read_cpuid_cachetype() & arm64_ftr_reg_ctrel0.strict_mask) !=
-		(arm64_ftr_reg_ctrel0.sys_val & arm64_ftr_reg_ctrel0.strict_mask);
+	return (read_cpuid_cachetype() & mask) !=
+	       (arm64_ftr_reg_ctrel0.sys_val & mask);
 }
 
 static int cpu_enable_trap_ctr_access(void *__unused)
@@ -446,7 +453,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = {
 	{
 		.desc = "Mismatched cache line size",
 		.capability = ARM64_MISMATCHED_CACHE_LINE_SIZE,
-		.matches = has_mismatched_cache_line_size,
+		.matches = has_mismatched_cache_type,
+		.def_scope = SCOPE_LOCAL_CPU,
+		.enable = cpu_enable_trap_ctr_access,
+	},
+	{
+		.desc = "Mismatched cache type",
+		.capability = ARM64_MISMATCHED_CACHE_TYPE,
+		.matches = has_mismatched_cache_type,
 		.def_scope = SCOPE_LOCAL_CPU,
 		.enable = cpu_enable_trap_ctr_access,
 	},

arch/arm64/kernel/cpufeature.c

@@ -153,7 +153,7 @@ static const struct arm64_ftr_bits ftr_ctr[] = {
 	ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 28, 3, 0),
 	ARM64_FTR_BITS(FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0),	/* CWG */
 	ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0),	/* ERG */
-	ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1),	/* DminLine */
+	ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, CTR_DMINLINE_SHIFT, 4, 1),
 	/*
 	 * Linux can handle differing I-cache policies. Userspace JITs will
 	 * make use of *minLine.
@@ -161,7 +161,7 @@ static const struct arm64_ftr_bits ftr_ctr[] = {
 	 */
 	ARM64_FTR_BITS(FTR_NONSTRICT, FTR_EXACT, 14, 2, ICACHE_POLICY_AIVIVT),	/* L1Ip */
 	ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 4, 10, 0),	/* RAZ */
-	ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 0, 4, 0),	/* IminLine */
+	ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, CTR_IMINLINE_SHIFT, 4, 0),
 	ARM64_FTR_END,
 };
 

arch/powerpc/platforms/pseries/ras.c

@@ -357,7 +357,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs)
 		int len, error_log_length;
 
 		error_log_length = 8 + rtas_error_extended_log_length(h);
-		len = max_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
+		len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
 		memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX);
 		memcpy(global_mce_data_buf, h, len);
 		errhdr = (struct rtas_error_log *)global_mce_data_buf;

arch/powerpc/sysdev/mpic_msgr.c

@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev)
 
 	/* IO map the message register block. */
 	of_address_to_resource(np, 0, &rsrc);
-	msgr_block_addr = ioremap(rsrc.start, rsrc.end - rsrc.start);
+	msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc));
 	if (!msgr_block_addr) {
 		dev_err(&dev->dev, "Failed to iomap MPIC message registers");
 		return -EFAULT;

arch/s390/kernel/crash_dump.c

@@ -401,11 +401,13 @@ static void *get_vmcoreinfo_old(unsigned long *size)
 	if (copy_oldmem_kernel(nt_name, addr + sizeof(note),
 			       sizeof(nt_name) - 1))
 		return NULL;
-	if (strcmp(nt_name, "VMCOREINFO") != 0)
+	if (strcmp(nt_name, VMCOREINFO_NOTE_NAME) != 0)
 		return NULL;
 	vmcoreinfo = kzalloc_panic(note.n_descsz);
-	if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz))
+	if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz)) {
+		kfree(vmcoreinfo);
 		return NULL;
+	}
 	*size = note.n_descsz;
 	return vmcoreinfo;
 }
@@ -415,15 +417,20 @@ static void *get_vmcoreinfo_old(unsigned long *size)
  */
 static void *nt_vmcoreinfo(void *ptr)
 {
+	const char *name = VMCOREINFO_NOTE_NAME;
 	unsigned long size;
 	void *vmcoreinfo;
 
 	vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size);
-	if (!vmcoreinfo)
-		vmcoreinfo = get_vmcoreinfo_old(&size);
+	if (vmcoreinfo)
+		return nt_init_name(ptr, 0, vmcoreinfo, size, name);
+
+	vmcoreinfo = get_vmcoreinfo_old(&size);
 	if (!vmcoreinfo)
 		return ptr;
-	return nt_init_name(ptr, 0, vmcoreinfo, size, "VMCOREINFO");
+	ptr = nt_init_name(ptr, 0, vmcoreinfo, size, name);
+	kfree(vmcoreinfo);
+	return ptr;
 }
 
 /*

arch/s390/lib/mem.S

@@ -27,7 +27,7 @@
  */
 ENTRY(memset)
 	ltgr	%r4,%r4
-	bzr	%r14
+	jz	.Lmemset_exit
 	ltgr	%r3,%r3
 	jnz	.Lmemset_fill
 	aghi	%r4,-1
@@ -42,12 +42,13 @@ ENTRY(memset)
 .Lmemset_clear_rest:
 	larl	%r3,.Lmemset_xc
 	ex	%r4,0(%r3)
+.Lmemset_exit:
 	BR_EX	%r14
 .Lmemset_fill:
 	stc	%r3,0(%r2)
 	cghi	%r4,1
 	lgr	%r1,%r2
-	ber	%r14
+	je	.Lmemset_fill_exit
 	aghi	%r4,-2
 	srlg	%r3,%r4,8
 	ltgr	%r3,%r3
@@ -59,6 +60,7 @@ ENTRY(memset)
 .Lmemset_fill_rest:
 	larl	%r3,.Lmemset_mvc
 	ex	%r4,0(%r3)
+.Lmemset_fill_exit:
 	BR_EX	%r14
 .Lmemset_xc:
 	xc	0(1,%r1),0(%r1)
@@ -73,7 +75,7 @@ EXPORT_SYMBOL(memset)
  */
 ENTRY(memcpy)
 	ltgr	%r4,%r4
-	bzr	%r14
+	jz	.Lmemcpy_exit
 	aghi	%r4,-1
 	srlg	%r5,%r4,8
 	ltgr	%r5,%r5
@@ -82,6 +84,7 @@ ENTRY(memcpy)
 .Lmemcpy_rest:
 	larl	%r5,.Lmemcpy_mvc
 	ex	%r4,0(%r5)
+.Lmemcpy_exit:
 	BR_EX	%r14
 .Lmemcpy_loop:
 	mvc	0(256,%r1),0(%r3)

arch/x86/include/asm/pgtable-3level.h

@@ -1,6 +1,8 @@
 #ifndef _ASM_X86_PGTABLE_3LEVEL_H
 #define _ASM_X86_PGTABLE_3LEVEL_H
 
+#include <asm/atomic64_32.h>
+
 /*
  * Intel Physical Address Extension (PAE) Mode - three-level page
  * tables on PPro+ CPUs.
@@ -142,10 +144,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep)
 {
 	pte_t res;
 
-	/* xchg acts as a barrier before the setting of the high bits */
-	res.pte_low = xchg(&ptep->pte_low, 0);
-	res.pte_high = ptep->pte_high;
-	ptep->pte_high = 0;
+	res.pte = (pteval_t)atomic64_xchg((atomic64_t *)ptep, 0);
 
 	return res;
 }

arch/x86/include/asm/pgtable.h

@@ -420,7 +420,7 @@ static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
 
 static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot)
 {
-	phys_addr_t pfn = page_nr << PAGE_SHIFT;
+	phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
 	pfn ^= protnone_mask(pgprot_val(pgprot));
 	pfn &= PHYSICAL_PUD_PAGE_MASK;
 	return __pud(pfn | massage_pgprot(pgprot));

block/bio.c

@@ -155,7 +155,7 @@ out:
 
 unsigned int bvec_nr_vecs(unsigned short idx)
 {
-	return bvec_slabs[idx].nr_vecs;
+	return bvec_slabs[--idx].nr_vecs;
 }
 
 void bvec_free(mempool_t *pool, struct bio_vec *bv, unsigned int idx)

drivers/acpi/scan.c

@@ -1453,7 +1453,8 @@ static int acpi_add_single_object(struct acpi_device **child,
 	 * Note this must be done before the get power-/wakeup_dev-flags calls.
 	 */
 	if (type == ACPI_BUS_TYPE_DEVICE)
-		acpi_bus_get_status(device);
+		if (acpi_bus_get_status(device) < 0)
+			acpi_set_device_status(device, 0);
 
 	acpi_bus_get_power_flags(device);
 	acpi_bus_get_wakeup_device_flags(device);
@@ -1531,7 +1532,7 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type,
 		 * acpi_add_single_object updates this once we've an acpi_device
 		 * so that acpi_bus_get_status' quirk handling can be used.
 		 */
-		*sta = 0;
+		*sta = ACPI_STA_DEFAULT;
 		break;
 	case ACPI_TYPE_PROCESSOR:
 		*type = ACPI_BUS_TYPE_PROCESSOR;

drivers/clk/rockchip/clk-rk3399.c

@@ -1521,6 +1521,7 @@ static const char *const rk3399_pmucru_critical_clocks[] __initconst = {
 	"pclk_pmu_src",
 	"fclk_cm0s_src_pmu",
 	"clk_timer_src_pmu",
+	"pclk_rkpwm_pmu",
 };
 
 static void __init rk3399_clk_init(struct device_node *np)

drivers/gpu/drm/drm_edid.c

@@ -110,6 +110,9 @@ static const struct edid_quirk {
 	/* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */
 	{ "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC },
 
+	/* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */
+	{ "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC },
+
 	/* Belinea 10 15 55 */
 	{ "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
 	{ "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },

drivers/infiniband/hw/hns/hns_roce_pd.c

@@ -35,7 +35,7 @@
 
 static int hns_roce_pd_alloc(struct hns_roce_dev *hr_dev, unsigned long *pdn)
 {
-	return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn);
+	return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn) ? -ENOMEM : 0;
 }
 
 static void hns_roce_pd_free(struct hns_roce_dev *hr_dev, unsigned long pdn)

drivers/infiniband/hw/hns/hns_roce_qp.c

@@ -114,7 +114,10 @@ static int hns_roce_reserve_range_qp(struct hns_roce_dev *hr_dev, int cnt,
 {
 	struct hns_roce_qp_table *qp_table = &hr_dev->qp_table;
 
-	return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align, base);
+	return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align,
+					   base) ?
+		       -ENOMEM :
+		       0;
 }
 
 enum hns_roce_qp_state to_hns_roce_state(enum ib_qp_state state)