The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/0ada2dc10f34649e99b6087ca7fb03e27379b5cd

commit 0ada2dc10f34649e99b6087ca7fb03e27379b5cd
Author: Guenter Roeck <groeck@chromium.org>
Date: Wed Aug 15 21:56:04 2018

CHROMIUM: Merge 'v4.4.148' into chromeos-4.4

Merge of v4.4.148 into chromeos-4.4

Conflicts:
    drivers/char/tpm/tpm-dev.c

Changelog:
----------------------------------------------------------------
Al Viro (3):
      root dentries need RCU-delayed freeing
      fix mntput/mntput race
      fix __legitimize_mnt()/mntput() race

Andi Kleen (10):
      x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT
      x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation
      x86/speculation/l1tf: Make sure the first page is always reserved
      x86/speculation/l1tf: Add sysfs reporting for l1tf
      x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings
      x86/speculation/l1tf: Limit swap file size to MAX_PA/2
      x86/speculation/l1tf: Invert all not present mappings
      x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert
      x86/mm/pat: Make set_memory_np() L1TF safe
      x86/mm/kmmio: Make the tracer robust against L1TF

Andy Lutomirski (1):
      mm: Add vm_insert_pfn_prot()

Bart Van Assche (1):
      scsi: sr: Avoid that opening a CD-ROM hangs with runtime power management enabled

Dan Williams (1):
      mm: fix cache mode tracking in vm_insert_mixed()

Dave Hansen (2):
      x86/mm: Move swap offset/type up in PTE to work around erratum
      x86/mm: Fix swap entry comment and macro

Greg Kroah-Hartman (1):
      Linux 4.4.148

Guenter Roeck (2):
      x86/speculation/l1tf: Fix up CPU feature flags
      Merge remote-tracking branch 'origin/linux/v4.4.148' into merge/chromeos-4.4-v4.4.148

Hans de Goede (1):
      ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices

Helge Deller (1):
      parisc: Enable CONFIG_MLONGCALLS by default

Jack Morgenstein (2):
      IB/core: Make testing MR flags for writability a static inline function
      IB/mlx4: Mark user MR as writable if actual virtual memory is writable

Jiri Kosina (2):
      x86/speculation: Protect against userspace-userspace spectreRSB
      x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures

John David Anglin (1):
      parisc: Define mb() and add memory barriers to assembler unlock sequences

Juergen Gross (1):
      xen/netfront: don't cache skb_shinfo()

Kees Cook (1):
      fork: unconditionally clear stack on fork

Konrad Rzeszutek Wilk (2):
      x86/bugs: Move the l1tf function and define pr_fmt properly
      x86/cpufeatures: Add detection of L1D cache flush support.

Linus Torvalds (2):
      x86/speculation/l1tf: Change order of offset/type in swap entry
      x86/speculation/l1tf: Protect swap entries against L1TF

Masami Hiramatsu (1):
      kprobes/x86: Fix %p uses in error messages

Michael Mera (1):
      IB/ocrdma: fix out of bounds access to local buffer

Michal Hocko (1):
      x86/speculation/l1tf: Fix up pte->pfn conversion for PAE

Naoya Horiguchi (1):
      mm: x86: move _PAGE_SWP_SOFT_DIRTY from bit 7 to bit 1

Nick Desaulniers (1):
      x86/irqflags: Provide a declaration for native_save_fl

Oleksij Rempel (1):
      ARM: dts: imx6sx: fix irq for pcie bridge

Peter Zijlstra (1):
      x86/paravirt: Fix spectre-v2 mitigations for paravirt guests

Tadeusz Struk (1):
      tpm: fix race condition in tpm_common_write()

Theodore Ts'o (1):
      ext4: fix check to prevent initializing reserved inodes

Thomas Egerer (1):
      ipv4+ipv6: Make INET*_ESP select CRYPTO_ECHAINIV

Vlastimil Babka (3):
      x86/speculation/l1tf: Extend 64bit swap file size limit
      x86/speculation/l1tf: Protect PAE swap entries against L1TF
      x86/init: fix build with CONFIG_SWAP=n

 Makefile                                    |  2 +-
 arch/arm/boot/dts/imx6sx.dtsi               |  2 +-
 arch/parisc/Kconfig                         |  2 +-
 arch/parisc/include/asm/barrier.h           | 32 +++++++++++
 arch/parisc/kernel/entry.S                  |  2 +
 arch/parisc/kernel/pacache.S                |  1 +
 arch/parisc/kernel/syscall.S                |  4 ++
 arch/x86/include/asm/cpufeatures.h          | 10 ++--
 arch/x86/include/asm/irqflags.h             |  2 +
 arch/x86/include/asm/page_32_types.h        |  9 +++-
 arch/x86/include/asm/pgtable-2level.h       | 17 ++++++
 arch/x86/include/asm/pgtable-3level.h       | 37 ++++++++++++-
 arch/x86/include/asm/pgtable-invert.h       | 32 +++++++++++
 arch/x86/include/asm/pgtable.h              | 84 +++++++++++++++++++++++------
 arch/x86/include/asm/pgtable_64.h           | 54 +++++++++++++++----
 arch/x86/include/asm/pgtable_types.h        | 10 ++--
 arch/x86/include/asm/processor.h            |  5 ++
 arch/x86/kernel/cpu/bugs.c                  | 81 +++++++++++++++++-----------
 arch/x86/kernel/cpu/common.c                | 20 +++++++
 arch/x86/kernel/kprobes/core.c              |  4 +-
 arch/x86/kernel/paravirt.c                  | 14 +++--
 arch/x86/kernel/setup.c                     |  6 +++
 arch/x86/mm/init.c                          | 25 +++++++++
 arch/x86/mm/kmmio.c                         | 25 +++++----
 arch/x86/mm/mmap.c                          | 21 ++++++++
 arch/x86/mm/pageattr.c                      |  8 +--
 drivers/acpi/acpi_lpss.c                    |  2 +
 drivers/base/cpu.c                          |  8 +++
 drivers/char/tpm/tpm-dev.c                  | 43 +++++++--------
 drivers/infiniband/core/umem.c              | 11 +---
 drivers/infiniband/hw/mlx4/mr.c             | 50 ++++++++++++++---
 drivers/infiniband/hw/ocrdma/ocrdma_stats.c |  2 +-
 drivers/net/xen-netfront.c                  |  8 +--
 drivers/scsi/sr.c                           | 29 +++++++---
 fs/dcache.c                                 |  6 ++-
 fs/ext4/ialloc.c                            |  5 +-
 fs/ext4/super.c                             |  8 +--
 fs/namespace.c                              | 28 +++++++++-
 include/asm-generic/pgtable.h               | 12 +++++
 include/linux/cpu.h                         |  2 +
 include/linux/mm.h                          |  2 +
 include/linux/swapfile.h                    |  2 +
 include/linux/thread_info.h                 |  6 +--
 include/rdma/ib_verbs.h                     | 14 +++++
 mm/memory.c                                 | 62 +++++++++++++++++----
 mm/mprotect.c                               | 49 +++++++++++++++++
 mm/swapfile.c                               | 46 ++++++++++------
 net/ipv4/Kconfig                            |  1 +
 net/ipv6/Kconfig                            |  1 +
 49 files changed, 715 insertions(+), 191 deletions(-)
 create mode 100644 arch/parisc/include/asm/barrier.h
 create mode 100644 arch/x86/include/asm/pgtable-invert.h

BUG= chromium:873810 ,  chromium:874617 ,  chromium:874614 ,  chromium:874613 
TEST=Build and test on various affected systems

Change-Id: Ibd224d2fad9f9572915f753aed0981a15a36cc74
Signed-off-by: Guenter Roeck <groeck@chromium.org>

[modify] https://crrev.com/0ada2dc10f34649e99b6087ca7fb03e27379b5cd/drivers/char/tpm/tpm-dev.c