4.9.55-stable review

This is the start of the stable review cycle for the 4.9.55 release. There are 105 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Thu Oct 12 19:24:56 UTC 2017. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.55-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.9.55-rc1

Paolo Bonzini <[email protected]>
KVM: x86: fix singlestepping over syscall

Jaegeuk Kim <[email protected]>
f2fs: don't allow encrypted operations without keys

Theodore Ts'o <[email protected]>
ext4: don't allow encrypted operations without keys

Jan Kara <[email protected]>
ext4: Don't clear SGID when inheriting ACLs

Jan Kara <[email protected]>
ext4: fix data corruption for mmap writes

Amir Goldstein <[email protected]>
vfs: deny copy_file_range() for non regular files

Peter Zijlstra <[email protected]>
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs

Chanho Min <[email protected]>
mmc: core: add driver strength selection when selecting hs400es

Christoph Hellwig <[email protected]>
nvme-pci: Use PCI bus address for data/queues in CMB

Jani Nikula <[email protected]>
drm/i915/bios: ignore HDMI on port A

Arend Van Spriel <[email protected]>
brcmfmac: setup passive scan if requested by user-space

Arend Van Spriel <[email protected]>
brcmfmac: add length check in brcmf_cfg80211_escan_handler()

Martin K. Petersen <[email protected]>
scsi: sd: Do not override max_sectors_kb sysfs setting

Luca Coelho <[email protected]>
iwlwifi: add workaround to disable wide channels in 5GHz

Luca Coelho <[email protected]>
iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD

Arnd Bergmann <[email protected]>

    netlink: fix nla_put_{u8,u16,u32} for KASAN

Arnd Bergmann <[email protected]>
rocker: fix rocker_tlv_put_* functions for KASAN

Ping Cheng <[email protected]>
HID: wacom: bits shifted too much for 9th and 10th buttons

Jason Gerecke <[email protected]>
HID: wacom: Always increment hdev refcount within wacom_get_hdev_data

Aaron Armstrong Skomra <[email protected]>
HID: wacom: leds: Don't try to control the EKR's read-only LEDs

Adrian Salido <[email protected]>
HID: i2c-hid: allocate hid buffers for real worst case

Shu Wang <[email protected]>
ftrace: Fix kmemleak in unregister_ftrace_graph

Alexander Shishkin <[email protected]>
stm class: Fix a use-after-free

Olaf Hering <[email protected]>
Drivers: hv: fcopy: restore correct transfer length

Nicolai Stange <[email protected]>
driver core: platform: Don't read past the end of "driver_override" buffer

Mark Rutland <[email protected]>
percpu: make this_cpu_generic_read() atomic w.r.t. interrupts

Gustavo Romero <[email protected]>
powerpc/tm: Fix illegal TM state in signal handler

Cyril Bur <[email protected]>
powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks

Eric Dumazet <[email protected]>
socket, bpf: fix possible use after free

Nikolay Aleksandrov <[email protected]>
net: rtnetlink: fix info leak in RTM_GETSTATS call

Parthasarathy Bhuvaragan <[email protected]>
tipc: use only positive error codes in messages

Xin Long <[email protected]>
ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path

Xin Long <[email protected]>
ip6_gre: ip6gre_tap device should keep dst

Jason A. Donenfeld <[email protected]>
netlink: do not proceed if dump's start() errs

Christoph Paasch <[email protected]>
net: Set sk_prot_creator when cloning sockets to the right proto

Willem de Bruijn <[email protected]>

    packet: only test po->has_vnet_hdr once in packet_snd

Willem de Bruijn <[email protected]>
packet: in packet_do_bind, test fanout with bind_lock held

Florian Fainelli <[email protected]>
net: dsa: Fix network device registration order

Alexander Potapenko <[email protected]>
tun: bail out from tun_get_user() if the skb is empty

Sabrina Dubroca <[email protected]>
l2tp: fix race condition in l2tp_tunnel_delete

Ridge Kennedy <[email protected]>
l2tp: Avoid schedule while atomic in exit_net

Alexey Kodanev <[email protected]>
vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit

Timur Tabi <[email protected]>
net: qcom/emac: specify the correct size when mapping a DMA buffer

Konstantin Khlebnikov <[email protected]>
net_sched: always reset qdisc backlog in qdisc_reset()

Meng Xu <[email protected]>
isdn/i4l: fetch the ppp_write buffer in one shot

Yonghong Song <[email protected]>
bpf: one perf event close won't free bpf program attached by another perf event

Willem de Bruijn <[email protected]>
packet: hold bind lock when rebinding to fanout hook

Christian Lamparter <[email protected]>
net: emac: Fix napi poll list corruption

Eric Dumazet <[email protected]>
tcp: fastopen: fix on syn-data transmit failure

Davide Caratti <[email protected]>
net/sched: cls_matchall: fix crash when used with classful qdisc

Xin Long <[email protected]>
ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline

Fahad Kunnathadi <[email protected]>
net: phy: Fix mask value write on gmii2rgmii converter speed register

Xin Long <[email protected]>
ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header

Subash Abhinov Kasiviswanathan <[email protected]>
udpv6: Fix the checksum computation when HW checksum does not apply

Eric Dumazet <[email protected]>
tcp: fix data delivery rate

Edward Cree <[email protected]>
bpf/verifier: reject BPF_ALU64|BPF_END

Eric Dumazet <[email protected]>

    tcp: update skb->skb_mstamp more carefully

Dan Carpenter <[email protected]>
sctp: potential read out of bounds in sctp_ulpevent_type_enabled()

Jiri Pirko <[email protected]>
net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker

Yuval Mintz <[email protected]>
mlxsw: spectrum: Prevent mirred-related crash on removal

Takashi Iwai <[email protected]>
ALSA: usx2y: Suppress kernel warning at page allocation failures

Takashi Sakamoto <[email protected]>
Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"

Guneshwor Singh <[email protected]>
ALSA: compress: Remove unused variable

Casey Schaufler <[email protected]>
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak

Sergey Senozhatsky <[email protected]>
lib/ratelimit.c: use deferred printk() version

Michal Hocko <[email protected]>
mm, oom_reaper: skip mm structs with mmu notifiers

Stefan Wahren <[email protected]>
staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist

Andrey Konovalov <[email protected]>
uwb: ensure that endpoint is interrupt

Andrey Konovalov <[email protected]>
uwb: properly check kthread_run return value

Lukas Wunner <[email protected]>

    iio: adc: mcp320x: Fix oops on module unload

Lukas Wunner <[email protected]>

    iio: adc: mcp320x: Fix readout of negative voltages

Dragos Bogdan <[email protected]>
iio: ad7793: Fix the serial interface reset

Colin Parker <[email protected]>
IIO: BME280: Updates to Humidity readings need ctrl_reg write!

Matt Fornero <[email protected]>
iio: core: Return error for failed read_reg

Stefan Popa <[email protected]>
staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.

Dragos Bogdan <[email protected]>
iio: ad_sigma_delta: Implement a dedicated reset function

Christophe JAILLET <[email protected]>
iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'

Christophe JAILLET <[email protected]>
iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'

Kai-Heng Feng <[email protected]>
Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"

Mathias Nyman <[email protected]>
xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor

Mathias Nyman <[email protected]>
xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround

Mathias Nyman <[email protected]>
xhci: fix finding correct bus_state structure for USB 3.1 hosts

Greg Kroah-Hartman <[email protected]>
USB: fix out-of-bounds in usb_set_configuration

Dmitry Fleytman <[email protected]>
usb: Increase quirk delay for USB devices

Greg Kroah-Hartman <[email protected]>
USB: core: harden cdc_parse_cdc_header

Alan Stern <[email protected]>
USB: uas: fix bug in handling of alternate settings

Alan Stern <[email protected]>
USB: g_mass_storage: Fix deadlock when driver is unbound

Li Jun <[email protected]>
usb: gadget: mass_storage: set msg_registered after msg registered

Dan Carpenter <[email protected]>
USB: devio: Don't corrupt user memory

Alan Stern <[email protected]>
USB: dummy-hcd: Fix erroneous synchronization change

Alan Stern <[email protected]>
USB: dummy-hcd: fix infinite-loop resubmission bug

Alan Stern <[email protected]>
USB: dummy-hcd: fix connection failures (wrong speed)

Bjørn Mork <[email protected]>
USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse

Jim Dickerson <[email protected]>
usb: pci-quirks.c: Corrected timeout values used in handshake

Takashi Iwai <[email protected]>
ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor

Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction

Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe

Alan Stern <[email protected]>
usb-storage: fix bogus hardware error messages for ATA pass-thru devices

Alan Stern <[email protected]>
usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives

Yoshihiro Shimoda <[email protected]>
usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()

Yoshihiro Shimoda <[email protected]>
usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value

Yoshihiro Shimoda <[email protected]>
usb: gadget: udc: renesas_usb3: fix for no-data control transfer

Nicolas Ferre <[email protected]>
usb: gadget: udc: atmel: set vbus irqflags explicitly

Alan Stern <[email protected]>
USB: gadgetfs: fix copy_to_user while holding spinlock

Alan Stern <[email protected]>
USB: gadgetfs: Fix crash caused by inadequate synchronization

-------------

Diffstat:

 Makefile                                           |  4 +-
 arch/powerpc/kernel/exceptions-64s.S               | 24 ++++++-
 arch/powerpc/kernel/signal_64.c                    | 13 +++-
 arch/x86/include/asm/kvm_emulate.h                 |  1 +
 arch/x86/kvm/emulate.c                             |  1 +
 arch/x86/kvm/x86.c                                 | 52 +++++++--------
 drivers/base/platform.c                            |  3 +-
 drivers/gpu/drm/i915/intel_bios.c                  |  7 +++
 drivers/hid/i2c-hid/i2c-hid.c                      |  3 +-
 drivers/hid/wacom_sys.c                            |  7 ++-
 drivers/hid/wacom_wac.c                            |  4 +-
 drivers/hv/hv_fcopy.c                              |  4 ++
 drivers/hwtracing/stm/core.c                       |  2 +-
 drivers/iio/adc/ad7793.c                           |  4 +-
 drivers/iio/adc/ad_sigma_delta.c                   | 28 +++++++++
 drivers/iio/adc/mcp320x.c                          | 25 +++++---
 drivers/iio/adc/twl4030-madc.c                     | 10 ++-
 drivers/iio/industrialio-core.c                    |  4 +-
 drivers/iio/pressure/bmp280-core.c                 |  2 +-
 drivers/isdn/i4l/isdn_ppp.c                        | 37 +++++++----
 drivers/mmc/core/mmc.c                             | 36 ++++++-----
 drivers/net/ethernet/ibm/emac/mal.c                |  3 +-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     | 20 +++---
 drivers/net/ethernet/qualcomm/emac/emac-mac.c      |  3 +-
 drivers/net/ethernet/rocker/rocker_tlv.h           | 48 ++++++++------
 drivers/net/phy/xilinx_gmii2rgmii.c                |  2 +-
 drivers/net/tun.c                                  |  8 ++-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 37 +++++------
 .../broadcom/brcm80211/brcmfmac/fwil_types.h       |  5 ++
 drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 66 +++++++++++++++----
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  | 10 ++-
 drivers/nvme/host/pci.c                            | 14 ++---
 drivers/scsi/sd.c                                  | 19 ++++--
 drivers/staging/iio/adc/ad7192.c                   |  4 +-
 .../interface/vchiq_arm/vchiq_2835_arm.c           |  6 +-
 drivers/usb/class/cdc-wdm.c                        |  4 +-
 drivers/usb/core/config.c                          | 16 +++--
 drivers/usb/core/devio.c                           |  6 +-
 drivers/usb/core/hub.c                             |  2 +-
 drivers/usb/core/message.c                         |  4 ++
 drivers/usb/gadget/function/f_mass_storage.c       | 27 +++-----
 drivers/usb/gadget/function/f_mass_storage.h       | 14 -----
 drivers/usb/gadget/legacy/inode.c                  | 46 ++++++++++++--
 drivers/usb/gadget/legacy/mass_storage.c           | 20 +-----
 drivers/usb/gadget/udc/atmel_usba_udc.c            |  4 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 | 56 +++++++++++++++--
 drivers/usb/gadget/udc/renesas_usb3.c              | 19 ++++--
 drivers/usb/host/pci-quirks.c                      | 10 +--
 drivers/usb/host/xhci-hub.c                        | 14 +++--
 drivers/usb/host/xhci-pci.c                        | 12 ----
 drivers/usb/host/xhci.h                            |  4 +-
 drivers/usb/renesas_usbhs/fifo.c                   | 21 ++++++-
 drivers/usb/storage/transport.c                    | 14 ++++-
 drivers/usb/storage/uas-detect.h                   | 15 ++---
 drivers/usb/storage/uas.c                          | 10 +--
 drivers/usb/storage/unusual_devs.h                 |  7 +++
 drivers/uwb/hwa-rc.c                               |  2 +
 drivers/uwb/uwbd.c                                 | 12 ++--
 fs/ext4/acl.c                                      | 22 ++++---
 fs/ext4/inode.c                                    | 18 +++++-
 fs/ext4/namei.c                                    | 12 ++++
 fs/f2fs/namei.c                                    | 12 ++++
 fs/read_write.c                                    |  5 ++
 fs/xattr.c                                         |  2 +-
 include/asm-generic/percpu.h                       | 24 ++++++-
 include/linux/cpuset.h                             |  6 ++
 include/linux/iio/adc/ad_sigma_delta.h             |  3 +
 include/linux/mmu_notifier.h                       |  5 ++
 include/linux/trace_events.h                       |  1 +
 include/net/netlink.h                              | 73 ++++++++++++++++------
 include/net/sctp/ulpevent.h                        |  6 +-
 include/uapi/linux/usb/ch9.h                       |  1 +
 kernel/bpf/verifier.c                              |  3 +-
 kernel/cpuset.c                                    | 16 ++++-
 kernel/events/core.c                               |  3 +-
 kernel/power/process.c                             |  5 +-
 kernel/sched/core.c                                |  7 +--
 kernel/trace/ftrace.c                              | 14 -----
 lib/ratelimit.c                                    |  4 +-
 mm/oom_kill.c                                      | 16 +++++
 net/core/filter.c                                  | 15 ++++-
 net/core/rtnetlink.c                               |  3 +
 net/core/sock.c                                    |  7 ++-
 net/dsa/slave.c                                    | 28 +++++----
 net/ipv4/ip_vti.c                                  |  3 +-
 net/ipv4/tcp_output.c                              | 33 +++++++---
 net/ipv6/ip6_gre.c                                 | 22 ++++---
 net/ipv6/ip6_tunnel.c                              |  8 ++-
 net/ipv6/ip6_vti.c                                 |  3 +-
 net/ipv6/udp.c                                     |  1 +
 net/l2tp/l2tp_core.c                               | 14 ++---
 net/l2tp/l2tp_core.h                               |  5 +-
 net/netlink/af_netlink.c                           |  7 ++-
 net/packet/af_packet.c                             | 28 ++++++---
 net/sched/act_api.c                                |  6 +-
 net/sched/cls_matchall.c                           |  1 +
 net/sched/sch_generic.c                            |  1 +
 net/tipc/msg.c                                     |  2 +-
 security/smack/smack_lsm.c                         | 55 ++++++++--------
 sound/core/compress_offload.c                      |  3 +-
 sound/pci/echoaudio/echoaudio.c                    |  6 +-
 sound/usb/card.c                                   | 20 ++++++
 sound/usb/usx2y/usb_stream.c                       |  6 +-
 103 files changed, 953 insertions(+), 437 deletions(-)