The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/01a5470167396fb124e629b4ccf355e084e5f69c

commit 01a5470167396fb124e629b4ccf355e084e5f69c
Author: Suren Baghdasaryan <surenb@google.com>
Date: Fri Jan 19 01:40:32 2018

BACKPORT: dm bufio: fix shrinker scans when (nr_to_scan < retain_target)

When system is under memory pressure it is observed that dm bufio
shrinker often reclaims only one buffer per scan. This change fixes
the following two issues in dm bufio shrinker that cause this behavior:

1. ((nr_to_scan - freed) <= retain_target) condition is used to
terminate slab scan process. This assumes that nr_to_scan is equal
to the LRU size, which might not be correct because do_shrink_slab()
in vmscan.c calculates nr_to_scan using multiple inputs.
As a result when nr_to_scan is less than retain_target (64) the scan
will terminate after the first iteration, effectively reclaiming one
buffer per scan and making scans very inefficient. This hurts vmscan
performance especially because mutex is acquired/released every time
dm_bufio_shrink_scan() is called.
New implementation uses ((LRU size - freed) <= retain_target)
condition for scan termination. LRU size can be safely determined
inside __scan() because this function is called after dm_bufio_lock().

2. do_shrink_slab() uses value returned by dm_bufio_shrink_count() to
determine number of freeable objects in the slab. However dm_bufio
always retains retain_target buffers in its LRU and will terminate
a scan when this mark is reached. Therefore returning the entire LRU size
from dm_bufio_shrink_count() is misleading because that does not
represent the number of freeable objects that slab will reclaim during
a scan. Returning (LRU size - retain_target) better represents the
number of freeable objects in the slab. This way do_shrink_slab()
returns 0 when (LRU size < retain_target) and vmscan will not try to
scan this shrinker avoiding scans that will not reclaim any memory.

Test: tested using Android device running
<AOSP>/system/extras/alloc-stress that generates memory pressure
and causes intensive shrinker scans

BUG= chromium:802351 
TEST=Build and run

Change-Id: Id8ddd613b7a42b58680a2d2e96666b74be07f938
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit fbc7c07ec23c0)
Reviewed-on: https://chromium-review.googlesource.com/871040
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>

[modify] https://crrev.com/01a5470167396fb124e629b4ccf355e084e5f69c/drivers/md/dm-bufio.c

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/b560293023c78c2a59483b517cd077c758562c82

commit b560293023c78c2a59483b517cd077c758562c82
Author: Guenter Roeck <groeck@chromium.org>
Date: Wed Jan 17 19:23:27 2018

CHROMIUM: Merge 'v4.4.112' into chromeos-4.4

Merge of v4.4.112 into chromeos-4.4

Changes applied on top of 'v4.4.112' prior to merge:
    8792c48d39cd Revert "dm bufio: fix shrinker scans when (nr_to_scan < retain_target)"
    98afee6856ea Revert "locking/mutex: Allow next waiter lockless wakeup"
    390be098213a Revert "r8152: adjust ALDPS function"
    261849811c25 Revert "r8152: use test_and_clear_bit"
    f25f22725b9a Revert "r8152: fix the wake event"

Changelog:
----------------------------------------------------------------
Alexei Starovoitov (4):
      bpf: move fixup_bpf_calls() function
      bpf: refactor fixup_bpf_calls()
      bpf: adjust insn_aux_data when patching insns
      bpf: prevent out-of-bounds speculation

Andrew Honig (1):
      KVM: x86: Add memory barrier on vmcs field lookup

Andrey Ryabinin (2):
      net/mac80211/debugfs.c: prevent build failure with CONFIG_UBSAN=y
      mm/page-writeback: fix dirty_ratelimit calculation

Andrii Vladyka (1):
      net: core: fix module type in sock_diag_bind

Andy Lutomirski (3):
      x86/vsdo: Fix build on PARAVIRT_CLOCK=y, KVM_GUEST=n
      x86/cpu: Factor out application of forced CPU caps
      selftests/x86: Add test_vsyscall

Ani Sinha (1):
      sysrq: Fix warning in sysrq generated crash.

Bart Van Assche (1):
      IB/srpt: Disable RDMA access by the initiator

Ben Hutchings (1):
      xhci: Fix ring leak in failure path of xhci_alloc_virt_device()

Ben Seri (1):
      Bluetooth: Prevent stack info leak from the EFS element.

Benjamin Poirier (1):
      e1000e: Fix e1000_check_for_copper_link_ich8lan return value.

Borislav Petkov (2):
      x86/cpu: Merge bugs.c and bugs_64.c
      x86/alternatives: Fix optimize_nops() checking

Christian Holl (1):
      USB: serial: cp210x: add new device ID ELV ALC 8xxx

Cong Wang (1):
      8021q: fix a memory leak for VLAN 0 device

Dan Carpenter (1):
      drm/vmwgfx: Potential off by one in vmw_view_add()

Dan Streetman (2):
      mm/zswap: use workqueue to destroy pool
      zswap: don't param_set_charp while holding spinlock

Daniel Borkmann (2):
      bpf: add bpf_patch_insn_single helper
      bpf, array: fix overflow in max_entries and undefined behavior in index_mask

Dave Hansen (1):
      x86/Documentation: Add PTI description

David Woodhouse (3):
      x86/cpufeatures: Add X86_BUG_SPECTRE_V[12]
      sysfs/cpu: Fix typos in vulnerability documentation
      x86/alternatives: Add missing '\n' at end of ALTERNATIVE inline asm

Davidlohr Bueso (1):
      locking/mutex: Allow next waiter lockless wakeup

Diego Elio Pettenò (1):
      USB: serial: cp210x: add IDs for LifeScan OneTouch Verio IQ

Eli Cooper (1):
      ip6_tunnel: disable dst caching if tunnel is dual-stack

Eric Biggers (1):
      crypto: algapi - fix NULL dereference in crypto_remove_spawns()

Eric Dumazet (5):
      lan78xx: use skb_cow_head() to deal with cloned skbs
      sr9700: use skb_cow_head() to deal with cloned skbs
      smsc75xx: use skb_cow_head() to deal with cloned skbs
      cx82310_eth: use skb_cow_head() to deal with cloned skbs
      ipv6: fix possible mem leaks in ipv6_make_skb()

Greg Kroah-Hartman (2):
      Revert "userfaultfd: selftest: vm: allow to build in vm/ directory"
      Linux 4.4.112

Guenter Roeck (6):
      Revert "r8152: fix the wake event"
      Revert "r8152: use test_and_clear_bit"
      Revert "r8152: adjust ALDPS function"
      Revert "locking/mutex: Allow next waiter lockless wakeup"
      Revert "dm bufio: fix shrinker scans when (nr_to_scan < retain_target)"
      Merge remote-tracking branch 'origin/linux/v4.4.112' into merge/chromeos-4.4-v4.4.112

Icenowy Zheng (1):
      uas: ignore UAS for Norelsys NS1068(X) chips

Ilya Dryomov (1):
      rbd: set max_segments to USHRT_MAX

Jakub Kicinski (1):
      bpf: don't (ab)use instructions to store state

Jean-Philippe Brucker (1):
      iommu/arm-smmu-v3: Don't free page table ops twice

Jeff Layton (1):
      locks: don't check for race with close when setting OFD lock

Jerome Brunet (1):
      net: stmmac: enable EEE in MII, GMII or RGMII only

Jia Zhang (1):
      x86/microcode/intel: Extend BDW late-loading with a revision check

Jianyu Zhan (1):
      futex: Replace barrier() in unqueue_me() with READ_ONCE()

Jim Mattson (1):
      kvm: vmx: Scrub hardware GPRs at VM-exit

Jiri Kosina (1):
      x86/mm/pat, /dev/mem: Remove superfluous error message

Jiri Slaby (1):
      hwrng: core - sleep interruptible in read

Joonsoo Kim (2):
      mm/compaction: fix invalid free_pfn and compact_cached_free_pfn
      mm/compaction: pass only pageblock aligned range to pageblock_pfn_to_page

Lepton Wu (1):
      kaiser: Set _PAGE_NX only if supported

Maciej W. Rozycki (7):
      MIPS: Validate PR_SET_FP_MODE prctl(2) requests against the ABI of the task
      MIPS: Factor out NT_PRFPREG regset access helpers
      MIPS: Guard against any partial write attempt with PTRACE_SETREGSET
      MIPS: Consistently handle buffer counter with PTRACE_SETREGSET
      MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA
      MIPS: Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET
      MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses

Mohamed Ghannam (2):
      RDS: Heap OOB write in rds_message_alloc_sgs()
      RDS: null pointer dereference in rds_atomic_free_op

Nicholas Bellinger (2):
      iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref
      target: Avoid early CMD_T_PRE_EXECUTE failures during ABORT_TASK

Oliver Neukum (1):
      usbvision fix overflow of interfaces array

Pavel Tatashin (1):
      x86/pti/efi: broken conversion from efi to kernel page table

Pete Zaitcev (1):
      USB: fix usbmon BUG trigger

Sergei Shtylyov (2):
      sh_eth: fix TSU resource handling
      sh_eth: fix SH7757 GEther initialization

Shuah Khan (1):
      usbip: remove kernel addresses from usb device and urb debug msgs

Stefan Agner (1):
      usb: misc: usb3503: make sure reset is low for at least 100us

Suren Baghdasaryan (1):
      dm bufio: fix shrinker scans when (nr_to_scan < retain_target)

Takashi Iwai (7):
      ALSA: pcm: Remove incorrect snd_BUG_ON() usages
      ALSA: pcm: Add missing error checks in OSS emulation plugin builder
      ALSA: pcm: Abort properly at pending signal in OSS read/write loops
      ALSA: pcm: Allow aborting mutex lock at OSS read/write loops
      ALSA: aloop: Release cable upon open error path
      ALSA: aloop: Fix inconsistent format due to incomplete rule
      ALSA: aloop: Fix racy hw constraints adjustment

Thomas Gleixner (5):
      x86/cpufeatures: Make CPU bugs sticky
      x86/cpufeatures: Add X86_BUG_CPU_INSECURE
      x86/pti: Rename BUG_CPU_INSECURE to BUG_CPU_MELTDOWN
      sysfs/cpu: Add vulnerability folder
      x86/cpu: Implement CPU vulnerabilites sysfs functions

Ulf Hansson (1):
      usb: musb: ux500: Fix NULL pointer dereference at system PM

Vikas C Sajjan (2):
      x86/acpi: Handle SCI interrupts above legacy space gracefully
      x86/acpi: Reduce code duplication in mp_override_legacy_irq()

Viktor Slavkovic (1):
      staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl

Wanpeng Li (1):
      KVM: Fix stack-out-of-bounds read in write_mmio

Wolfgang Grandegger (1):
      can: gs_usb: fix return value of the "set_bittiming" callback

hayeswang (3):
      r8152: fix the wake event
      r8152: use test_and_clear_bit
      r8152: adjust ALDPS function

 Documentation/ABI/testing/sysfs-devices-system-cpu |  16 +
 Documentation/kernel-parameters.txt                |  21 +-
 Documentation/x86/pti.txt                          | 186 ++++++++
 Makefile                                           |   2 +-
 arch/arm/kvm/mmio.c                                |   6 +-
 arch/mips/kernel/process.c                         |  12 +
 arch/mips/kernel/ptrace.c                          | 147 ++++--
 arch/x86/Kconfig                                   |   1 +
 arch/x86/include/asm/alternative.h                 |   4 +-
 arch/x86/include/asm/cpufeature.h                  |   5 +
 arch/x86/include/asm/kaiser.h                      |  10 +
 arch/x86/include/asm/processor.h                   |   4 +-
 arch/x86/include/asm/pvclock.h                     |   2 +-
 arch/x86/kernel/acpi/boot.c                        |  61 ++-
 arch/x86/kernel/alternative.c                      |   7 +-
 arch/x86/kernel/cpu/Makefile                       |   4 +-
 arch/x86/kernel/cpu/bugs.c                         |  55 ++-
 arch/x86/kernel/cpu/bugs_64.c                      |  33 --
 arch/x86/kernel/cpu/common.c                       |  33 +-
 arch/x86/kernel/cpu/microcode/intel.c              |  14 +-
 arch/x86/kvm/svm.c                                 |  19 +
 arch/x86/kvm/vmx.c                                 |  26 +-
 arch/x86/kvm/x86.c                                 |   8 +-
 arch/x86/mm/kaiser.c                               |   2 +
 arch/x86/mm/pat.c                                  |   5 +-
 arch/x86/realmode/init.c                           |   4 +-
 arch/x86/realmode/rm/trampoline_64.S               |   3 +-
 crypto/algapi.c                                    |  12 +
 drivers/base/Kconfig                               |   3 +
 drivers/base/cpu.c                                 |  48 ++
 drivers/block/rbd.c                                |   2 +-
 drivers/char/hw_random/core.c                      |   6 +-
 drivers/char/mem.c                                 |   6 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c            |   2 +
 drivers/infiniband/ulp/srpt/ib_srpt.c              |   3 +-
 drivers/iommu/arm-smmu-v3.c                        |   8 +-
 drivers/media/usb/usbvision/usbvision-video.c      |   7 +
 drivers/net/can/usb/gs_usb.c                       |   2 +-
 drivers/net/ethernet/intel/e1000e/ich8lan.c        |  11 +-
 drivers/net/ethernet/renesas/sh_eth.c              |  29 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   6 +
 drivers/net/usb/cx82310_eth.c                      |   7 +-
 drivers/net/usb/lan78xx.c                          |   9 +-
 drivers/net/usb/smsc75xx.c                         |   8 +-
 drivers/net/usb/sr9700.c                           |   9 +-
 drivers/target/iscsi/iscsi_target.c                |  20 +-
 drivers/target/target_core_tmr.c                   |   9 +
 drivers/target/target_core_transport.c             |   2 +
 drivers/tty/sysrq.c                                |   6 +
 drivers/usb/host/xhci-mem.c                        |   3 +-
 drivers/usb/misc/usb3503.c                         |   2 +
 drivers/usb/mon/mon_bin.c                          |   8 +-
 drivers/usb/musb/ux500.c                           |   7 +-
 drivers/usb/serial/cp210x.c                        |   2 +
 drivers/usb/storage/unusual_uas.h                  |   7 +
 drivers/usb/usbip/usbip_common.c                   |  17 +-
 fs/locks.c                                         |  16 +-
 include/linux/bpf.h                                |   2 +
 include/linux/cpu.h                                |   7 +
 include/linux/filter.h                             |   3 +
 include/linux/phy.h                                |  11 +
 include/linux/sh_eth.h                             |   1 -
 include/target/target_core_base.h                  |   1 +
 include/trace/events/kvm.h                         |   7 +-
 kernel/bpf/arraymap.c                              |  37 +-
 kernel/bpf/core.c                                  |  71 +++
 kernel/bpf/syscall.c                               |  54 ---
 kernel/bpf/verifier.c                              | 217 ++++++---
 kernel/futex.c                                     |   8 +-
 mm/compaction.c                                    |  50 ++-
 mm/page-writeback.c                                |  11 +-
 mm/zswap.c                                         |  24 +-
 net/8021q/vlan.c                                   |   7 +-
 net/core/sock_diag.c                               |   2 +-
 net/ipv6/ip6_output.c                              |   4 +-
 net/ipv6/ip6_tunnel.c                              |   9 +-
 net/mac80211/debugfs.c                             |   7 +-
 net/rds/rdma.c                                     |   4 +
 sound/core/oss/pcm_oss.c                           |  41 +-
 sound/core/oss/pcm_plugin.c                        |  14 +-
 sound/core/pcm_lib.c                               |   4 +-
 sound/drivers/aloop.c                              |  98 ++--
 tools/testing/selftests/vm/Makefile                |   4 -
 tools/testing/selftests/x86/Makefile               |   3 +-
 tools/testing/selftests/x86/test_vsyscall.c        | 500 +++++++++++++++++++++
 85 files changed, 1711 insertions(+), 457 deletions(-)
 create mode 100644 Documentation/x86/pti.txt
 delete mode 100644 arch/x86/kernel/cpu/bugs_64.c
 create mode 100644 tools/testing/selftests/x86/test_vsyscall.c

BUG= chromium:802351 
TEST=Build and test on various affected systems

Change-Id: I2ba9055d500ac24e87d375aaa3d1ec6a10ebb38b
Signed-off-by: Guenter Roeck <groeck@chromium.org>