The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/43ffad94201413286e4e2623a00e0e2429d74509

commit 43ffad94201413286e4e2623a00e0e2429d74509
Author: Guenter Roeck <groeck@chromium.org>
Date: Wed May 23 18:32:03 2018

CHROMIUM: Merge 'v4.14.43' into chromeos-4.14

Merge of v4.14.43 into chromeos-4.14

Conflicts:
    kernel/sys.c
    include/uapi/linux/prctl.h
    drivers/net/hyperv/netvsc_drv.c
    drivers/gpu/drm/i915/intel_engine_cs.c

Changelog:
----------------------------------------------------------------
Adi Nissim (1):
      net/mlx5: E-Switch, Include VF RDMA stats in vport statistics

Alexander Monakov (1):
      i2c: designware: fix poll-after-enable regression

Anand Jain (1):
      btrfs: fix crash when trying to resume balance without the resume flag

Andre Przywara (2):
      KVM: arm/arm64: VGIC/ITS save/restore: protect kvm_read_guest() calls
      KVM: arm/arm64: VGIC/ITS: protect kvm_read_guest() calls with SRCU lock

Andre Tomt (1):
      net/tls: Fix connection stall on partial tls record

Andrey Ignatov (1):
      ipv4: fix memory leaks in udp_sendmsg, ping_v4_sendmsg

Andy Shevchenko (1):
      spi: pxa2xx: Allow 64-bit DMA

Antony Antony (1):
      xfrm: fix xfrm_do_migrate() with AEAD e.g(AES-GCM)

Ard Biesheuvel (1):
      efi: Avoid potential crashes, fix the 'struct efi_pci_io_protocol_32' definition for mixed mode

Benjamin Herrenschmidt (1):
      powerpc: Don't preempt_disable() in show_cpuinfo()

Bjørn Mork (1):
      qmi_wwan: do not steal interfaces from class drivers

Borislav Petkov (3):
      Documentation/spec_ctrl: Do some minor cleanups
      x86/speculation: Use synthetic bits for IBRS/IBPB/STIBP
      x86/bugs: Unify x86_spec_ctrl_{set_guest,restore_host}

Christophe JAILLET (1):
      net/mlx4_en: Fix an error handling path in 'mlx4_en_init_netdev()'

Dave Carroll (1):
      scsi: aacraid: Correct hba_send to include iu_type

Dave Hansen (2):
      x86/pkeys: Override pkey when moving away from PROT_EXEC
      x86/pkeys: Do not special case protection key 0

Dave Watson (1):
      net/tls: Don't recursively call push_record during tls_write_space callbacks

Debabrata Banerjee (2):
      bonding: do not allow rlb updates to invalid mac
      bonding: send learning packets for vlans on slave

Dexuan Cui (1):
      tick/broadcast: Use for_each_cpu() specially on UP kernels

Dmitry Safonov (1):
      x86/mm: Drop TS_COMPAT on 64-bit exec() syscall

Eric Dumazet (6):
      dccp: fix tasklet usage
      llc: better deal with too small mtu
      net_sched: fq: take care of throttled flows before reuse
      rds: do not leak kernel memory to user land
      ipv6: fix uninit-value in ip6_multipath_l3_keys()
      nsh: fix infinite loop

Federico Cuello (1):
      ALSA: usb: mixer: volume quirk for CM102-A+/102S+

Filipe Manana (1):
      Btrfs: fix xattr loss after power failure

Florian Westphal (2):
      netfilter: nf_tables: free set name in error path
      netfilter: nf_tables: can't fail after linking rule into active rule list

Greg Kroah-Hartman (2):
      Linux 4.14.42
      Linux 4.14.43

Grygorii Strashko (1):
      net: ethernet: ti: cpsw: fix packet leaking in dual_mac mode

Guenter Roeck (1):
      Merge remote-tracking branch 'origin/linux/v4.14.43' into merge/chromeos-4.14-v4.14.43

Halil Pasic (1):
      vfio: ccw: fix cleanup if cp_prefetch fails

Haneen Mohammed (1):
      drm: Match sysfs name in link removal to link creation

Hangbin Liu (1):
      bridge: check iface upper dev when setting master via ioctl

Hans de Goede (1):
      ALSA: hda: Add Lenovo C50 All in one to the power_save blacklist

Heiner Kallweit (1):
      r8169: fix powering up RTL8168h

Hendrik Brueckner (1):
      s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero

Herbert Xu (1):
      xfrm: Use __skb_queue_tail in xfrm_trans_queue

Ingo Molnar (1):
      8139too: Use disable_irq_nosync() in rtl8139_poll_controller()

James Chapman (1):
      l2tp: revert "l2tp: fix missing print session offset info"

Jann Horn (1):
      tee: shm: fix use-after-free via temporarily dropped reference

Jianbo Liu (1):
      net/mlx5e: Allow offloading ipv4 header re-write for icmp

Jim Mattson (1):
      x86/cpu: Make alternative_msr_write work for 32-bit code

Jiri Kosina (2):
      x86/bugs: Fix __ssb_select_mitigation() return type
      x86/bugs: Make cpu_show_common() static

Jiri Pirko (1):
      net: sched: fix error path in tcf_proto_create() when modules are not configured

Julian Anastasov (1):
      ipv4: fix fnhe usage by non-cached routes

Julian Wiedmann (2):
      s390/qdio: fix access to uninitialized qdio_q fields
      s390/qdio: don't release memory in qdio_setup_irq()

Kamal Dasu (2):
      spi: bcm-qspi: Avoid setting MSPI_CDRAM_PCS for spi-nor master
      spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL

Kees Cook (6):
      nospec: Allow getting/setting on non-current task
      proc: Provide details on speculation flaw mitigations
      seccomp: Enable speculation flaw mitigations
      x86/bugs: Make boot modes __ro_after_init
      seccomp: Add filter flag to opt-out of SSB mitigation
      x86/speculation: Make "seccomp" the default mode for Speculative Store Bypass

Konrad Rzeszutek Wilk (15):
      x86/bugs: Concentrate bug detection into a separate function
      x86/bugs: Concentrate bug reporting into a separate function
      x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits
      x86/bugs, KVM: Support the combination of guest and host IBRS
      x86/bugs: Expose /sys/../spec_store_bypass
      x86/cpufeatures: Add X86_FEATURE_RDS
      x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation
      x86/bugs/intel: Set proper CPU features and setup RDS
      x86/bugs: Whitelist allowed SPEC_CTRL MSR values
      x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if requested
      x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest
      x86/bugs: Rename _RDS to _SSBD
      proc: Use underscores for SSBD in 'status'
      x86/bugs: Fix the parameters alignment and missing void
      x86/bugs: Rename SSBD_NO to SSB_NO

Lance Richardson (1):
      net: support compat 64-bit time in {s,g}etsockopt

Linus Torvalds (1):
      x86/nospec: Simplify alternative_msr_write()

Liu Bo (1):
      btrfs: fix reading stale metadata blocks after degraded raid1 mounts

Martin Schwidefsky (1):
      s390: remove indirect branch from do_softirq_own_stack

Masami Hiramatsu (4):
      ARM: 8771/1: kprobes: Prohibit kprobes on do_undefinstr
      ARM: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed
      ARM: 8770/1: kprobes: Prohibit probing on optimized_callback
      ARM: 8772/1: kprobes: Prohibit kprobes on get_user functions

Matthew Wilcox (1):
      lib/test_bitmap.c: fix bitmap optimisation tests to report errors correctly

Michael Chan (1):
      tg3: Fix vunmap() BUG_ON() triggered from tg3_free_consistent().

Michel Thierry (1):
      drm/i915/gen9: Add WaClearHIZ_WM_CHICKEN3 for bxt and glk

Misono Tomohiro (1):
      btrfs: property: Set incompat flag if lzo/zstd compression is set

Moshe Shemesh (1):
      net/mlx4_en: Verify coalescing parameters are in range

Neal Cardwell (1):
      tcp_bbr: fix to zero idle_restart only upon S/ACKed data

Nicholas Piggin (1):
      powerpc/powernv: Fix NVRAM sleep in invalid context when crashing

Nikolay Borisov (2):
      btrfs: Split btrfs_del_delalloc_inode into 2 functions
      btrfs: Fix delalloc inodes invalidation during transaction abort

Paolo Abeni (1):
      udp: fix SO_BINDTODEVICE

Pavel Tatashin (1):
      mm: don't allow deferred pages with NEED_PER_CPU_KM

Rob Taglang (1):
      net: ethernet: sun: niu set correct packet size in skb

Robbie Ko (1):
      Btrfs: send, fix invalid access to commit roots due to concurrent snapshotting

Roi Dayan (1):
      net/mlx5e: Err if asked to offload TC match on frag being first

Roman Mashak (1):
      net sched actions: fix refcnt leak in skbmod

Ross Zwisler (1):
      radix tree: fix multi-order iteration race

Shuah Khan (1):
      usbip: usbip_host: refine probe and disconnect debug msgs to be useful

Shuah Khan (Samsung OSG) (4):
      usbip: usbip_host: delete device from busid_table after rebind
      usbip: usbip_host: run rebind from exit when module is removed
      usbip: usbip_host: fix NULL-ptr deref and use-after-free errors
      usbip: usbip_host: fix bad unlock balance during stub_probe()

Stefano Brivio (1):
      openvswitch: Don't swap table in nlattr_set() after OVS_ATTR_NESTED is found

Stephen Hemminger (1):
      hv_netvsc: set master device

Steven Rostedt (VMware) (1):
      tracing/x86/xen: Remove zero data size trace events trace_xen_mmu_flush_tlb{_all}

Subash Abhinov Kasiviswanathan (1):
      netfilter: nf_socket: Fix out of bounds access in nf_sk_lookup_slow_v{4,6}

Talat Batheesh (1):
      net/mlx5: Avoid cleaning flow steering table twice during error flow

Tariq Toukan (1):
      net/mlx5e: TX, Use correct counter in dma_map error flow

Thomas Gleixner (18):
      x86/speculation: Create spec-ctrl.h to avoid include hell
      prctl: Add speculation control prctls
      x86/process: Allow runtime control of Speculative Store Bypass
      x86/speculation: Add prctl for Speculative Store Bypass mitigation
      prctl: Add force disable speculation
      seccomp: Use PR_SPEC_FORCE_DISABLE
      seccomp: Move speculation migitation control to arch code
      KVM: SVM: Move spec control call after restore of GS
      x86/cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS
      x86/cpufeatures: Disentangle SSBD enumeration
      x86/cpufeatures: Add FEATURE_ZEN
      x86/speculation: Handle HT correctly on AMD
      x86/bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL
      x86/speculation: Rework speculative_store_bypass_update()
      x86/bugs: Expose x86_spec_ctrl_base directly
      x86/bugs: Remove x86_spec_ctrl_set()
      x86/bugs: Rework spec_ctrl base and mask logic
      x86/speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG

Tom Lendacky (2):
      x86/speculation: Add virtualized speculative store bypass disable support
      KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD

Wenwen Wang (1):
      ALSA: control: fix a redundant-copy issue

Willy Tarreau (1):
      proc: do not access cmdline nor environ from file-backed areas

Xin Long (5):
      sctp: delay the authentication for the duplicated cookie-echo chunk
      sctp: fix the issue that the cookie-ack with auth can't get processed
      sctp: handle two v4 addrs comparison in sctp_inet6_cmp_addr
      sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg
      sctp: use the old asoc when making the cookie-ack chunk in dupcook_d

Yuchung Cheng (1):
      tcp: ignore Fast Open on repair mode

ethanwu (1):
      btrfs: Take trans lock before access running trans in check_delayed_ref

 Documentation/ABI/testing/sysfs-devices-system-cpu |   1 +
 Documentation/admin-guide/kernel-parameters.txt    |  45 +++
 Documentation/userspace-api/index.rst              |   1 +
 Documentation/userspace-api/spec_ctrl.rst          |  94 +++++
 Makefile                                           |   2 +-
 arch/arm/include/asm/assembler.h                   |  10 +
 arch/arm/include/asm/kvm_mmu.h                     |  16 +
 arch/arm/kernel/traps.c                            |   5 +-
 arch/arm/lib/getuser.S                             |  10 +
 arch/arm/probes/kprobes/opt-arm.c                  |   4 +-
 arch/arm64/include/asm/kvm_mmu.h                   |  16 +
 arch/powerpc/kernel/setup-common.c                 |  11 -
 arch/powerpc/platforms/powernv/opal-nvram.c        |  14 +-
 arch/s390/kernel/irq.c                             |   5 +-
 arch/s390/kernel/perf_cpum_sf.c                    |   4 +
 arch/x86/boot/compressed/eboot.c                   |   6 +-
 arch/x86/include/asm/cpufeatures.h                 |  18 +-
 arch/x86/include/asm/kvm_host.h                    |   2 +-
 arch/x86/include/asm/mmu_context.h                 |   2 +-
 arch/x86/include/asm/msr-index.h                   |   9 +
 arch/x86/include/asm/nospec-branch.h               |  43 ++-
 arch/x86/include/asm/pkeys.h                       |  18 +-
 arch/x86/include/asm/spec-ctrl.h                   |  80 +++++
 arch/x86/include/asm/thread_info.h                 |   4 +-
 arch/x86/kernel/cpu/amd.c                          |  22 ++
 arch/x86/kernel/cpu/bugs.c                         | 397 ++++++++++++++++++++-
 arch/x86/kernel/cpu/common.c                       |  77 +++-
 arch/x86/kernel/cpu/cpu.h                          |   2 +
 arch/x86/kernel/cpu/intel.c                        |   3 +
 arch/x86/kernel/process.c                          | 146 ++++++++
 arch/x86/kernel/process_64.c                       |   1 +
 arch/x86/kernel/smpboot.c                          |   5 +
 arch/x86/kvm/cpuid.c                               |  21 +-
 arch/x86/kvm/svm.c                                 |  66 ++--
 arch/x86/kvm/vmx.c                                 |  32 +-
 arch/x86/kvm/x86.c                                 |  13 +-
 arch/x86/mm/pkeys.c                                |  21 +-
 arch/x86/xen/mmu.c                                 |   4 +-
 arch/x86/xen/mmu_pv.c                              |   4 +-
 drivers/base/cpu.c                                 |   8 +
 drivers/gpu/drm/drm_drv.c                          |   2 +-
 drivers/gpu/drm/i915/i915_reg.h                    |   3 +
 drivers/gpu/drm/i915/intel_engine_cs.c             |   4 +
 drivers/i2c/busses/i2c-designware-master.c         |   5 +-
 drivers/net/bonding/bond_alb.c                     |  15 +-
 drivers/net/bonding/bond_main.c                    |   2 +
 drivers/net/ethernet/broadcom/tg3.c                |   9 +-
 drivers/net/ethernet/mellanox/mlx4/en_ethtool.c    |  16 +
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c     |   8 +-
 drivers/net/ethernet/mellanox/mlx4/mlx4_en.h       |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c    |  20 +-
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c  |  11 +-
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c  |  23 +-
 drivers/net/ethernet/realtek/8139too.c             |   2 +-
 drivers/net/ethernet/realtek/r8169.c               |   3 +
 drivers/net/ethernet/sun/niu.c                     |   5 +-
 drivers/net/ethernet/ti/cpsw.c                     |   2 +
 drivers/net/hyperv/netvsc_drv.c                    |   3 +-
 drivers/net/usb/qmi_wwan.c                         |  12 +
 drivers/s390/cio/qdio_setup.c                      |  12 +-
 drivers/s390/cio/vfio_ccw_cp.c                     |  13 +-
 drivers/scsi/aacraid/commsup.c                     |   8 +-
 drivers/spi/spi-bcm-qspi.c                         |  28 +-
 drivers/spi/spi-pxa2xx.h                           |   2 +-
 drivers/tee/tee_shm.c                              |   5 +-
 drivers/usb/usbip/stub.h                           |   2 +
 drivers/usb/usbip/stub_dev.c                       |  43 ++-
 drivers/usb/usbip/stub_main.c                      | 105 +++++-
 fs/btrfs/ctree.c                                   |  22 +-
 fs/btrfs/ctree.h                                   |   2 +
 fs/btrfs/disk-io.c                                 |  26 +-
 fs/btrfs/extent-tree.c                             |   7 +
 fs/btrfs/inode.c                                   |  13 +-
 fs/btrfs/props.c                                   |  12 +-
 fs/btrfs/tree-log.c                                |   7 +
 fs/btrfs/volumes.c                                 |   9 +
 fs/proc/array.c                                    |  25 ++
 fs/proc/base.c                                     |   8 +-
 include/linux/cpu.h                                |   2 +
 include/linux/efi.h                                |   8 +-
 include/linux/mm.h                                 |   1 +
 include/linux/nospec.h                             |  10 +
 include/linux/sched.h                              |  10 +-
 include/linux/seccomp.h                            |   5 +-
 include/net/bonding.h                              |   1 +
 include/net/tls.h                                  |   1 +
 include/trace/events/xen.h                         |  16 -
 include/uapi/linux/prctl.h                         |  12 +
 include/uapi/linux/seccomp.h                       |   5 +-
 kernel/seccomp.c                                   |  21 +-
 kernel/sys.c                                       |  23 ++
 kernel/time/tick-broadcast.c                       |   8 +
 lib/radix-tree.c                                   |   6 +-
 lib/test_bitmap.c                                  |  21 +-
 mm/Kconfig                                         |   1 +
 mm/gup.c                                           |   3 +
 net/bridge/br_if.c                                 |   4 +-
 net/compat.c                                       |   6 +-
 net/dccp/ccids/ccid2.c                             |  14 +-
 net/dccp/timer.c                                   |   2 +-
 net/ipv4/netfilter/nf_socket_ipv4.c                |   6 +-
 net/ipv4/ping.c                                    |   7 +-
 net/ipv4/route.c                                   | 118 +++---
 net/ipv4/tcp.c                                     |   3 +-
 net/ipv4/tcp_bbr.c                                 |   4 +-
 net/ipv4/udp.c                                     |  11 +-
 net/ipv6/netfilter/nf_socket_ipv6.c                |   6 +-
 net/ipv6/route.c                                   |   7 +-
 net/ipv6/udp.c                                     |   4 +-
 net/l2tp/l2tp_netlink.c                            |   2 -
 net/llc/af_llc.c                                   |   3 +
 net/netfilter/nf_tables_api.c                      |  67 ++--
 net/nsh/nsh.c                                      |   2 +
 net/openvswitch/flow_netlink.c                     |   9 +-
 net/rds/recv.c                                     |   1 +
 net/sched/act_skbmod.c                             |   5 +-
 net/sched/cls_api.c                                |   2 +-
 net/sched/sch_fq.c                                 |  37 +-
 net/sctp/associola.c                               |  30 +-
 net/sctp/inqueue.c                                 |   2 +-
 net/sctp/ipv6.c                                    |   3 +
 net/sctp/sm_statefuns.c                            |  88 ++---
 net/sctp/ulpevent.c                                |   1 -
 net/tls/tls_main.c                                 |   8 +
 net/xfrm/xfrm_input.c                              |   2 +-
 net/xfrm/xfrm_state.c                              |   1 +
 sound/core/control_compat.c                        |   3 +-
 sound/pci/hda/hda_intel.c                          |   2 +
 sound/usb/mixer.c                                  |   8 +
 tools/testing/selftests/seccomp/seccomp_bpf.c      |  22 +-
 virt/kvm/arm/vgic/vgic-its.c                       |  19 +-
 virt/kvm/arm/vgic/vgic-v3.c                        |   4 +-
 133 files changed, 1903 insertions(+), 514 deletions(-)
 create mode 100644 Documentation/userspace-api/spec_ctrl.rst
 create mode 100644 arch/x86/include/asm/spec-ctrl.h

BUG= chromium:845991 
TEST=Build and test on various affected systems

Change-Id: Ib94bca9a2f98461e132480b8fbce0d74c2ddc657
Signed-off-by: Guenter Roeck <groeck@chromium.org>

[modify] https://crrev.com/43ffad94201413286e4e2623a00e0e2429d74509/kernel/sys.c
[modify] https://crrev.com/43ffad94201413286e4e2623a00e0e2429d74509/drivers/gpu/drm/i915/intel_engine_cs.c
[modify] https://crrev.com/43ffad94201413286e4e2623a00e0e2429d74509/include/uapi/linux/prctl.h
[modify] https://crrev.com/43ffad94201413286e4e2623a00e0e2429d74509/drivers/net/hyperv/netvsc_drv.c