The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/1a1fd2c59855df8643412d57374e072878783484

commit 1a1fd2c59855df8643412d57374e072878783484
Author: Guenter Roeck <groeck@chromium.org>
Date: Wed Nov 08 15:41:23 2017

CHROMIUM: Merge tag 'v4.4.96' into chromeos-4.4

Merge of v4.4.96 into chromeos-4.4

Conflicts:
	-- none --

Changelog:
----------------------------------------------------------------
Alan Stern (2):
      USB: dummy-hcd: Fix deadlock caused by disconnect detection
      USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()

Alexander Potapenko (1):
      tun: bail out from tun_get_user() if the skb is empty

Alexandre Belloni (1):
      i2c: at91: ensure state is restored after suspending

Alexey Kodanev (1):
      vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit

Andreas Engel (1):
      USB: serial: cp210x: add support for ELV TFD500

Andreas Gruenbacher (1):
      direct-io: Prevent NULL pointer access in submit_page_section

Andrew Gabbasov (1):
      usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options

Arend Van Spriel (1):
      brcmfmac: add length check in brcmf_cfg80211_escan_handler()

Arnd Bergmann (3):
      watchdog: kempld: fix gcc-4.3 build
      cpufreq: CPPC: add ACPI_PROCESSOR dependency
      brcmsmac: make some local variables 'static const' to reduce stack size

Baruch Siach (1):
      spi: uapi: spidev: add missing ioctl header

Ben Hutchings (2):
      ALSA: seq: Enable 'use' locking in all configurations
      scsi: sg: Re-fix off by one in sg_fill_request_table()

Ben Skeggs (1):
      drm/nouveau/mmu: flush tlbs before deleting page tables

Borislav Petkov (1):
      x86/microcode/intel: Disable late loading on model 79

Christian Lamparter (1):
      net: emac: Fix napi poll list corruption

Christoph Paasch (1):
      net: Set sk_prot_creator when cloning sockets to the right proto

Christophe JAILLET (1):
      iio: adc: xilinx: Fix error handling

Dan Carpenter (2):
      sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
      scsi: scsi_dh_emc: return success in clariion_std_inquiry()

Darrick J. Wong (1):
      ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets

David Howells (3):
      KEYS: don't let add_key() update an uninstantiated key
      KEYS: Fix race between updating and finding a negative key
      assoc_array: Fix a buggy node-splitting case

David Kozub (1):
      clockevents/drivers/cs5535: Improve resilience to spurious interrupts

Dmitry Torokhov (1):
      Input: gtco - fix potential out-of-bound access

Dmitry V. Levin (2):
      uapi: fix linux/rds.h userspace compilation errors
      uapi: fix linux/mroute6.h userspace compilation errors

Edward Cree (1):
      bpf/verifier: reject BPF_ALU64|BPF_END

Emmanuel Grumbach (1):
      mac80211: fix power saving clients handling in iwlwifi

Eric Biggers (6):
      KEYS: encrypted: fix dereference of NULL user_key_payload
      lib/digsig: fix dereference of NULL user_key_payload
      fscrypt: fix dereference of NULL user_key_payload
      fscrypto: require write access to mount to set encryption policy
      FS-Cache: fix dereference of NULL user_key_payload
      ecryptfs: fix dereference of NULL user_key_payload

Eric Dumazet (1):
      net/mlx4_en: fix overflow in mlx4_en_init_timestamp()

Eric Ren (1):
      ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock

Eric Sesterhenn (1):
      pkcs7: Prevent NULL pointer dereference, since sinfo is not always set.

Felipe Balbi (1):
      usb: quirks: add quirk for WORLDE MINI MIDI keyboard

Franck Demathieu (1):
      irqchip/crossbar: Fix incorrect type of local variables

Gerhard Bertelsmann (1):
      can: sun4i: fix loopback mode

Greg Kroah-Hartman (7):
      Linux 4.4.93
      Revert "bsg-lib: don't free job in bsg_prepare_job"
      Revert "tty: goldfish: Fix a parameter of a call to free_irq"
      Linux 4.4.94
      Linux 4.4.95
      Revert "drm: bridge: add DT bindings for TI ths8135"
      Linux 4.4.96

Grygorii Maistrenko (1):
      slub: do not merge cache if slub_debug contains a never-merge flag

Guenter Roeck (1):
      CHROMIUM: Merge tag 'v4.4.96' into chromeos-4.4

Guillaume Tucker (1):
      regulator: fan53555: fix I2C device ids

Hans de Goede (1):
      USB: devio: Revert "USB: devio: Don't corrupt user memory"

Haozhong Zhang (1):
      KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit

Harry Wentland (1):
      drm/dp/mst: save vcpi with payloads

Henryk Heisig (1):
      USB: serial: option: add support for TP-Link LTE module

Herbert Xu (1):
      crypto: shash - Fix zero-length shash ahash digest crash

Hui Wang (1):
      ALSA: hda - fix headset mic problem for Dell machines with alc236

Ilia Mirkin (1):
      drm/nouveau/bsp/g92: disable by default

Jaegeuk Kim (3):
      f2fs: do not wait for writeback in write_begin
      f2fs crypto: replace some BUG_ON()'s with error checks
      f2fs crypto: add missing locking for keyring_key access

Jaejoong Kim (1):
      HID: usbhid: fix out-of-bounds bug

Jan Luebbe (1):
      bus: mbus: fix window size calculation for 4GB windows

Jarno Rajahalme (1):
      netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value.

Jeff Layton (2):
      ceph: clean up unsafe d_parent accesses in build_dentry_path
      ceph: unlock dangling spinlock in try_flush_caps()

Jeffrey Chu (1):
      USB: serial: ftdi_sio: add id for Cypress WICED dev board

Jimmy Assarsson (2):
      can: kvaser_usb: Correct return value in printout
      can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages

Joerg Roedel (1):
      iommu/amd: Finish TLB flush in amd_iommu_unmap()

Johan Hovold (2):
      USB: serial: console: fix use-after-free after failed setup
      USB: serial: metro-usb: add MS7820 device id

Johannes Berg (1):
      mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length

John David Anglin (2):
      parisc: Avoid trashing sr2 and sr3 in LWS code
      parisc: Fix double-word compare and exchange in LWS code on 32-bit kernels

Jonathan Liu (2):
      usb: musb: sunxi: Explicitly release USB PHY on exit
      usb: musb: Check for host-mode using is_host_active() on reset interrupt

Juergen Gross (1):
      xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap()

Jussi Laako (1):
      ALSA: usb-audio: Add native DSD support for Pro-Ject Pre Box S2 Digital

Kai-Heng Feng (1):
      Input: elan_i2c - add ELAN0611 to the ACPI table

Kailang Yang (1):
      ALSA: hda/realtek - Add support for ALC236/ALC3204

Kazuya Mizuguchi (1):
      usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet

Kinglong Mee (1):
      nfsd/callback: Cleanup callback cred on shutdown

Larry Finger (1):
      rtlwifi: rtl8821ae: Fix connection lost problem

Luca Coelho (1):
      iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD

Majd Dibbiny (1):
      net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs

Maksim Salau (1):
      usb: cdc_acm: Add quirk for Elatec TWN3

Mark Rutland (1):
      percpu: make this_cpu_generic_read() atomic w.r.t. interrupts

Mathias Krause (1):
      x86/alternatives: Fix alt_max_short macro to really be a max()

Mathias Nyman (1):
      usb: hub: Allow reset retry for USB2 devices on connect bounce

Matt Redfearn (1):
      MIPS: Fix minimum alignment requirement of IRQ stack

Mayank Rana (1):
      usb: xhci: Handle error condition in xhci_stop_device()

Meng Xu (1):
      isdn/i4l: fetch the ppp_write buffer in one shot

Miklos Szeredi (1):
      fuse: fix READDIRPLUS skipping an entry

Milan Broz (1):
      crypto: xts - Add ECB dependency

Oleg Nesterov (1):
      sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task()

Parthasarathy Bhuvaragan (1):
      tipc: use only positive error codes in messages

Paul Burton (1):
      MIPS: math-emu: Remove pr_err() calls from fpu_emu()

Paul E. McKenney (1):
      rcu: Allow for page faults in NMI handlers

Pavel Shilovsky (1):
      CIFS: Reconnect expired SMB sessions

Peng Xu (1):
      nl80211: Define policy for packet pattern attributes

Peter Ujfalusi (1):
      dmaengine: edma: Align the memcpy acnt array size with the transfer

Peter Zijlstra (1):
      locking/lockdep: Add nest_lock integrity test

Pontus Andersson (1):
      i2c: ismt: Separate I2C block read from SMBus block read

Ridge Kennedy (1):
      l2tp: Avoid schedule while atomic in exit_net

Robbie Ko (1):
      Btrfs: send, fix failure to rename top level inode due to name collision

Sabrina Dubroca (1):
      l2tp: fix race condition in l2tp_tunnel_delete

Shaohua Li (1):
      md/linear: shutup lockdep warnning

Shrirang Bagul (1):
      USB: serial: qcserial: add Dell DW5818, DW5819

Stefan Mätje (1):
      can: esd_usb2: Fix can_dlc value for received RTR, frames

Steffen Maier (1):
      scsi: zfcp: fix erp_action use-before-initialize in REC action trace

Subash Abhinov Kasiviswanathan (1):
      udpv6: Fix the checksum computation when HW checksum does not apply

Takashi Iwai (6):
      ALSA: usb-audio: Kill stray URB at exiting
      ALSA: seq: Fix use-after-free at creating a port
      ALSA: seq: Fix copy_from_user() call inside lock
      ALSA: caiaq: Fix stray URB at probe error path
      ALSA: line6: Fix leftover URB at error-path during probe
      ALSA: hda: Remove superfluous '-' added by printk conversion

Tejun Heo (1):
      workqueue: replace pool->manager_arb mutex with a flag

Thomas Petazzoni (1):
      net: mvpp2: release reference to txq_cpu[] entry after unmapping

Varun Prakash (1):
      target/iscsi: Fix unsolicited data seq_end_offset calculation

Vijay Kumar (1):
      sparc64: Migrate hvcons irq to panicked cpu

Vitaly Mayatskikh (1):
      fix unbalanced page refcounting in bio_map_user_iov

Willem de Bruijn (3):
      packet: hold bind lock when rebinding to fanout hook
      packet: in packet_do_bind, test fanout with bind_lock held
      packet: only test po->has_vnet_hdr once in packet_snd

Wolfgang Grandegger (1):
      can: gs_usb: fix busy loop if no more TX context is available

Xin Long (1):
      ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header

Yonghong Song (1):
      bpf: one perf event close won't free bpf program attached by another perf event

 .../bindings/display/bridge/ti,ths8135.txt         |  46 -----
 Makefile                                           |   2 +-
 arch/mips/include/asm/irq.h                        |   2 +-
 arch/mips/math-emu/cp1emu.c                        |   2 -
 arch/parisc/kernel/syscall.S                       |  55 +++---
 arch/sparc/include/asm/setup.h                     |   5 +-
 arch/sparc/kernel/smp_64.c                         |   6 +-
 arch/x86/include/asm/alternative-asm.h             |   4 +-
 arch/x86/include/asm/alternative.h                 |   6 +-
 arch/x86/kernel/cpu/microcode/intel.c              |  18 ++
 arch/x86/kvm/vmx.c                                 |   2 +-
 block/bio.c                                        |   8 +
 block/bsg-lib.c                                    |   1 +
 crypto/Kconfig                                     |   1 +
 crypto/asymmetric_keys/pkcs7_parser.c              |   3 +
 crypto/shash.c                                     |   8 +-
 drivers/bus/mvebu-mbus.c                           |   2 +-
 drivers/clocksource/cs5535-clockevt.c              |   3 +-
 drivers/cpufreq/Kconfig.arm                        |   2 +-
 drivers/dma/edma.c                                 |  19 +-
 drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c      |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c     |   2 +
 drivers/hid/usbhid/hid-core.c                      |  12 +-
 drivers/i2c/busses/i2c-at91.c                      |   3 +
 drivers/i2c/busses/i2c-ismt.c                      |   5 +-
 drivers/iio/adc/xilinx-xadc-core.c                 |   6 +-
 drivers/input/mouse/elan_i2c_core.c                |   1 +
 drivers/input/tablet/gtco.c                        |  17 +-
 drivers/iommu/amd_iommu.c                          |   1 +
 drivers/irqchip/irq-crossbar.c                     |   3 +-
 drivers/isdn/i4l/isdn_ppp.c                        |  37 ++--
 drivers/md/linear.c                                |   3 +-
 drivers/net/can/sun4i_can.c                        |   3 +-
 drivers/net/can/usb/esd_usb2.c                     |   2 +-
 drivers/net/can/usb/gs_usb.c                       |  10 +-
 drivers/net/can/usb/kvaser_usb.c                   |   9 +-
 drivers/net/ethernet/ibm/emac/mal.c                |   3 +-
 drivers/net/ethernet/marvell/mvpp2.c               |   9 +-
 drivers/net/ethernet/mellanox/mlx4/en_clock.c      |  18 +-
 drivers/net/ethernet/mellanox/mlx4/main.c          |   2 -
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h       |   1 -
 drivers/net/tun.c                                  |   8 +-
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |  18 +-
 .../broadcom/brcm80211/brcmsmac/phy/phy_n.c        | 197 ++++++++++-----------
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |  10 +-
 drivers/net/wireless/mac80211_hwsim.c              |  28 ++-
 .../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c    |   2 +-
 drivers/regulator/fan53555.c                       |   5 +-
 drivers/s390/scsi/zfcp_aux.c                       |   5 +
 drivers/s390/scsi/zfcp_erp.c                       |  18 +-
 drivers/s390/scsi/zfcp_scsi.c                      |   5 +
 drivers/scsi/device_handler/scsi_dh_emc.c          |   2 +-
 drivers/scsi/sg.c                                  |   2 +-
 drivers/target/iscsi/iscsi_target_erl0.c           |   6 +-
 drivers/tty/goldfish.c                             |   2 +-
 drivers/tty/serial/sunhv.c                         |   6 +
 drivers/usb/class/cdc-acm.c                        |   3 +
 drivers/usb/core/config.c                          |   6 +-
 drivers/usb/core/devio.c                           |   6 +-
 drivers/usb/core/hub.c                             |  11 +-
 drivers/usb/core/quirks.c                          |   4 +
 drivers/usb/gadget/composite.c                     |   5 +
 drivers/usb/gadget/udc/dummy_hcd.c                 |   9 +-
 drivers/usb/host/xhci-hub.c                        |  22 ++-
 drivers/usb/musb/musb_core.c                       |   6 +-
 drivers/usb/musb/sunxi.c                           |   2 +
 drivers/usb/renesas_usbhs/fifo.c                   |   2 +-
 drivers/usb/serial/console.c                       |   1 +
 drivers/usb/serial/cp210x.c                        |   1 +
 drivers/usb/serial/ftdi_sio.c                      |   2 +
 drivers/usb/serial/ftdi_sio_ids.h                  |   7 +
 drivers/usb/serial/metro-usb.c                     |   1 +
 drivers/usb/serial/option.c                        |   2 +
 drivers/usb/serial/qcserial.c                      |   4 +
 drivers/watchdog/kempld_wdt.c                      |   9 +-
 drivers/xen/gntdev.c                               |   2 +-
 fs/btrfs/send.c                                    |   5 +-
 fs/ceph/caps.c                                     |   5 +-
 fs/ceph/mds_client.c                               |   9 +-
 fs/cifs/cifsglob.h                                 |   2 +
 fs/cifs/cifssmb.c                                  |   7 +
 fs/cifs/connect.c                                  |   7 +
 fs/cifs/smb2ops.c                                  |  16 ++
 fs/direct-io.c                                     |   3 +-
 fs/ecryptfs/ecryptfs_kernel.h                      |  24 ++-
 fs/ecryptfs/keystore.c                             |   9 +-
 fs/ext4/crypto_key.c                               |   6 +
 fs/ext4/file.c                                     |   4 +-
 fs/f2fs/crypto.c                                   |   1 -
 fs/f2fs/crypto_fname.c                             |   2 -
 fs/f2fs/crypto_key.c                               |  25 ++-
 fs/f2fs/data.c                                     |   7 +-
 fs/f2fs/file.c                                     |   6 +
 fs/fscache/object-list.c                           |   7 +
 fs/fuse/dir.c                                      |   3 +-
 fs/nfsd/nfs4callback.c                             |   8 +
 fs/nfsd/nfs4state.c                                |  10 +-
 fs/nfsd/state.h                                    |   1 +
 fs/ocfs2/dlmglue.c                                 | 105 ++++++++++-
 fs/ocfs2/dlmglue.h                                 |  18 ++
 fs/ocfs2/ocfs2.h                                   |   1 +
 include/asm-generic/percpu.h                       |  24 ++-
 include/linux/key.h                                |  49 +++--
 include/linux/mbus.h                               |   4 +-
 include/linux/trace_events.h                       |   1 +
 include/net/sctp/ulpevent.h                        |   6 +-
 include/sound/seq_virmidi.h                        |   1 +
 include/uapi/linux/mroute6.h                       |   1 +
 include/uapi/linux/rds.h                           |   3 +-
 include/uapi/linux/spi/spidev.h                    |   1 +
 kernel/bpf/verifier.c                              |   3 +-
 kernel/events/core.c                               |   3 +-
 kernel/locking/lockdep.c                           |  11 +-
 kernel/rcu/tree.c                                  |  12 ++
 kernel/sched/auto_group.c                          |  23 +--
 kernel/workqueue.c                                 |  37 ++--
 lib/assoc_array.c                                  |  51 ++----
 lib/digsig.c                                       |   6 +
 mm/slab_common.c                                   |   5 +-
 net/core/sock.c                                    |   2 +
 net/dns_resolver/dns_key.c                         |   2 +-
 net/ipv4/ip_vti.c                                  |   3 +-
 net/ipv6/ip6_gre.c                                 |  21 +--
 net/ipv6/ip6_vti.c                                 |   3 +-
 net/ipv6/udp.c                                     |   1 +
 net/l2tp/l2tp_core.c                               |  14 +-
 net/l2tp/l2tp_core.h                               |   5 +-
 net/mac80211/sta_info.c                            |   2 +-
 net/netfilter/nf_conntrack_expect.c                |   4 +-
 net/packet/af_packet.c                             |  28 ++-
 net/tipc/msg.c                                     |   2 +-
 net/wireless/nl80211.c                             |  12 +-
 security/keys/big_key.c                            |   4 +-
 security/keys/encrypted-keys/encrypted.c           |   9 +-
 security/keys/gc.c                                 |   8 +-
 security/keys/key.c                                |  41 +++--
 security/keys/keyctl.c                             |   9 +-
 security/keys/keyring.c                            |  10 +-
 security/keys/proc.c                               |   7 +-
 security/keys/process_keys.c                       |   2 +-
 security/keys/request_key.c                        |   7 +-
 security/keys/request_key_auth.c                   |   2 +-
 security/keys/trusted.c                            |   2 +-
 security/keys/user_defined.c                       |   4 +-
 sound/core/seq/seq_lock.c                          |   4 -
 sound/core/seq/seq_lock.h                          |  12 --
 sound/core/seq/seq_virmidi.c                       |  27 ++-
 sound/pci/hda/hda_codec.c                          |   2 +-
 sound/pci/hda/patch_realtek.c                      |  19 ++
 sound/usb/caiaq/device.c                           |  12 +-
 sound/usb/line6/driver.c                           |   7 +-
 sound/usb/mixer.c                                  |  12 +-
 sound/usb/mixer.h                                  |   2 +
 sound/usb/quirks.c                                 |   1 +
 154 files changed, 1052 insertions(+), 545 deletions(-)
 delete mode 100644 Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt

BUG= chromium:781440 
TEST=Build and test on Eve, Kevin, Caroline with 4.4 kernel

Change-Id: Ic87ede5ab4a234c76c1867c0e12fe4eea93edb95
Signed-off-by: Guenter Roeck <groeck@chromium.org>

[modify] https://crrev.com/1a1fd2c59855df8643412d57374e072878783484/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
[delete] https://crrev.com/7f737d13e4b2aa5c1640706d10d177d7aefdcaba/drivers/net/wireless/iwlwifi/mvm/mac80211.c
[delete] https://crrev.com/7f737d13e4b2aa5c1640706d10d177d7aefdcaba/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
[modify] https://crrev.com/1a1fd2c59855df8643412d57374e072878783484/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
[modify] https://crrev.com/1a1fd2c59855df8643412d57374e072878783484/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_n.c
[delete] https://crrev.com/7f737d13e4b2aa5c1640706d10d177d7aefdcaba/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c