The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/e35e559c68345972b687ea74ab82cb29e1cadffb

commit e35e559c68345972b687ea74ab82cb29e1cadffb
Author: Guenter Roeck <groeck@chromium.org>
Date: Mon Oct 01 16:48:45 2018

CHROMIUM: Merge 'v4.4.159' into chromeos-4.4

Merge of v4.4.159 into chromeos-4.4

Changelog:
----------------------------------------------------------------
Boris Ostrovsky (1):
      xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code

Catalin Marinas (1):
      arm64: Add trace_hardirqs_off annotation in ret_to_user

Colin Ian King (1):
      net: hp100: fix always-true check for link up state

Eric Dumazet (1):
      ipv6: fix possible use-after-free in ip6_xmit()

Greg Kroah-Hartman (1):
      Linux 4.4.159

Guenter Roeck (1):
      Merge remote-tracking branch 'origin/linux/v4.4.159' into merge/chromeos-4.4-v4.4.159

Gustavo A. R. Silva (1):
      tty: vt_ioctl: fix potential Spectre v1

Joel Fernandes (Google) (1):
      mm: shmem.c: Correctly annotate new inodes for lockdep

Juergen Gross (1):
      xen/netfront: don't bug in case of too many frags

Junxiao Bi (1):
      ocfs2: fix ocfs2 read block panic

Li Dongyang (1):
      ext4: don't mark mmp buffer head dirty

Lyude Paul (1):
      drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()

Mario Limonciello (1):
      platform/x86: alienware-wmi: Correct a memory leak

Roderick Colenbrander (2):
      HID: sony: Update device ids
      HID: sony: Support DS4 dongle

Steve Wise (1):
      iw_cxgb4: only allow 1 flush on user qps

Suren Baghdasaryan (2):
      NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
      NFC: Fix the number of pipes

Sébastien Szymanski (1):
      ASoC: cs4265: fix MMTLR Data switch control

Takashi Sakamoto (1):
      ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping

Theodore Ts'o (4):
      ext4: avoid divide by zero fault when deleting corrupted inline directories
      ext4: recalucate superblock checksum after updating free blocks/inodes
      ext4: fix online resize's handling of a too-small final block group
      ext4: fix online resizing for bigalloc file systems with a 1k block size

Toke Høiland-Jørgensen (1):
      gso_segment: Reset skb->mac_len after modifying network header

Vaibhav Nagarnaik (1):
      ring-buffer: Allow for rescheduling when removing pages

Vasily Khoruzhick (1):
      neighbour: confirm neigh entries when ARP packet is received

Vincent Pelletier (1):
      scsi: target: iscsi: Use hex2bin instead of a re-implementation

Willy Tarreau (2):
      ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
      net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT

 Makefile                                    |  2 +-
 arch/x86/xen/pmu.c                          |  2 +-
 drivers/gpu/drm/nouveau/nouveau_connector.c | 20 ++++++++++---------
 drivers/hid/hid-core.c                      |  3 +++
 drivers/hid/hid-ids.h                       |  2 ++
 drivers/hid/hid-sony.c                      |  6 ++++++
 drivers/infiniband/hw/cxgb4/qp.c            |  6 ++++++
 drivers/net/appletalk/ipddp.c               |  8 ++++++--
 drivers/net/ethernet/hp/hp100.c             |  2 +-
 drivers/net/xen-netfront.c                  |  8 +++++++-
 drivers/platform/x86/alienware-wmi.c        |  1 +
 drivers/target/iscsi/iscsi_target_auth.c    | 30 ++++++++++++++---------------
 drivers/tty/vt/vt_ioctl.c                   |  4 ++++
 fs/ext4/dir.c                               | 20 +++++++++----------
 fs/ext4/inline.c                            |  4 +++-
 fs/ext4/mmp.c                               |  1 -
 fs/ext4/resize.c                            | 23 +++++++++++++++++++++-
 fs/ext4/super.c                             |  2 ++
 fs/ocfs2/buffer_head_io.c                   |  1 +
 include/net/nfc/hci.h                       |  2 +-
 kernel/trace/ring_buffer.c                  |  2 ++
 mm/shmem.c                                  |  2 ++
 net/core/neighbour.c                        | 13 ++++++++-----
 net/ipv4/af_inet.c                          |  1 +
 net/ipv6/ip6_offload.c                      |  1 +
 net/ipv6/ip6_output.c                       |  6 ++----
 net/nfc/hci/core.c                          | 10 ++++++++++
 sound/firewire/bebob/bebob_maudio.c         | 24 +++++++++++++----------
 sound/pci/emu10k1/emufx.c                   |  2 +-
 sound/soc/codecs/cs4265.c                   |  4 ++--
 30 files changed, 144 insertions(+), 68 deletions(-)

BUG= chromium:890623 
TEST=Build and test on various affected systems

Change-Id: I0054d2f4134a6ba73104ee601e485a1a411c15e6
Signed-off-by: Guenter Roeck <groeck@chromium.org>