The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/e4e68c9ea8106eff534321d2171dfd38f9f3a53c

commit e4e68c9ea8106eff534321d2171dfd38f9f3a53c
Author: Guenter Roeck <groeck@chromium.org>
Date: Sat Nov 10 20:14:51 2018

CHROMIUM: Merge 'v4.4.163' into chromeos-4.4

Merge of v4.4.163 into chromeos-4.4

Conflicts:
    drivers/char/tpm/tpm-chip.c

Changelog:
----------------------------------------------------------------
Al Viro (1):
      cachefiles: fix the race between cachefiles_bury_object() and rmdir(2)

Alan Stern (2):
      usb-storage: fix bogus hardware error messages for ATA pass-thru devices
      USB: fix the usbfs flag sanitization for control transfers

Alexander Duyck (1):
      gro: Allow tunnel stacking in the case of FOU/GUE

Alexander Shishkin (1):
      perf/core: Don't leak event in the syscall error path

Andrei Otcheretianski (2):
      mac80211: Always report TX status
      cfg80211: reg: Init wiphy_idx in regulatory_hint_core()

Andrey Ryabinin (1):
      radix-tree: fix radix_tree_iter_retry() for tagged iterators.

Ard Biesheuvel (1):
      ahci: don't ignore result code of ahci_reset_controller()

Arnd Bergmann (2):
      thermal: allow spear-thermal driver to be a module
      thermal: allow u8500-thermal driver to be a module

Ashish Samant (1):
      fuse: Dont call set_page_dirty_lock() for ITER_BVEC pages for async_dio

Catalin Marinas (2):
      arm64: Fix potential race with hardware DBM in ptep_set_access_flags()
      cpuidle: Do not access cpuidle_devices when !CONFIG_CPU_IDLE

Christian Grönke (1):
      igb: Remove superfluous reset to PHY and page 0 selection

Cong Wang (1):
      net: drop skb on failure in ip_check_defrag()

Daniel Borkmann (1):
      bpf: generally move prog destruction to RCU deferral

David Ahern (1):
      net/ipv6: Fix index counter for unicast addresses in in6_dump_addrs

David Herrmann (1):
      net: drop write-only stack variable

David S. Miller (1):
      sparc64: Fix exception handling in UltraSPARC-III memcpy.

Emil Tantilov (1):
      ixgbe: fix RSS limit for X550

Eric Biggers (1):
      KEYS: put keyring if install_session_keyring_to_cred() fails

Eric Dumazet (2):
      ipv6: orphan skbs in reassembly unit
      ipv6: mcast: fix a use-after-free in inet6_mc_check

Eugenia Emantayev (1):
      net/mlx4_en: Resolve dividing by zero in 32-bit system

Ewan D. Milne (1):
      scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state

Florian Fainelli (8):
      asix: Check for supported Wake-on-LAN modes
      ax88179_178a: Check for supported Wake-on-LAN modes
      lan78xx: Check for supported Wake-on-LAN modes
      sr9800: Check for supported Wake-on-LAN modes
      r8152: Check for supported Wake-on-LAN Modes
      smsc75xx: Check for Wake-on-LAN modes
      smsc95xx: Check for Wake-on-LAN modes
      um: Avoid longjmp/setjmp symbol clashes with libpthread.a

Geert Uytterhoeven (2):
      ASoC: ak4613: Enable cache usage to fix crashes on resume
      ASoC: wm8940: Enable cache usage to fix crashes on resume

Greg Kroah-Hartman (1):
      Linux 4.4.163

Guenter Roeck (1):
      Merge remote-tracking branch 'origin/linux/v4.4.163' into merge/chromeos-4.4-v4.4.163

Guillaume Nault (2):
      l2tp: hold socket before dropping lock in l2tp_ip{, 6}_recv()
      l2tp: hold tunnel socket when handling control frames in l2tp_ip and l2tp_ip6

Gustavo A. R. Silva (16):
      tty: serial: sprd: fix error return code in sprd_probe()
      video: fbdev: pxa3xx_gcu: fix error return code in pxa3xx_gcu_probe()
      gpu: host1x: fix error return code in host1x_probe()
      gpio: msic: fix error return code in platform_msic_gpio_probe()
      usb: imx21-hcd: fix error return code in imx21_probe()
      usb: ehci-omap: fix error return code in ehci_hcd_omap_probe()
      usb: dwc3: omap: fix error return code in dwc3_omap_probe()
      spi/bcm63xx-hspi: fix error return code in bcm63xx_hsspi_probe()
      spi/bcm63xx: fix error return code in bcm63xx_spi_probe()
      spi: xlp: fix error return code in xlp_spi_probe()
      ASoC: spear: fix error return code in spdif_in_probe()
      PM / devfreq: tegra: fix error return code in tegra_devfreq_probe()
      ptp: fix Spectre v1 vulnerability
      RDMA/ucma: Fix Spectre v1 vulnerability
      IB/ucm: Fix Spectre v1 vulnerability
      usb: gadget: storage: Fix Spectre v1 vulnerability

Hangbin Liu (1):
      bridge: do not add port to router list when receives query with source 0.0.0.0

Heiner Kallweit (1):
      r8169: fix NAPI handling under high load

Ido Schimmel (1):
      rtnetlink: Disallow FDB configuration for non-Ethernet device

Jakub Kicinski (1):
      net: sched: gred: pass the right attribute to gred_change_table_def()

Jarkko Sakkinen (1):
      tpm: fix: return rc when devm_add_action() fails

Jason Wang (1):
      vhost: Fix Spectre V1 vulnerability

Jeff Mahoney (1):
      btrfs: don't create or leak aliased root while cleaning up orphans

Jia-Ju Bai (1):
      crypto: shash - Fix a sleep-in-atomic bug in shash_setkey_unaligned

Jiri Olsa (1):
      perf/ring_buffer: Prevent concurent ring buffer access

Johannes Berg (1):
      ipv6: suppress sparse warnings in IP6_ECN_set_ce()

Jonathan Basseri (1):
      xfrm: Clear sk_dst_cache when applying per-socket policy.

Khazhismel Kumykov (1):
      fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters()

Kimmo Rautkoski (1):
      mtd: spi-nor: Add support for is25wp series chips

Linus Torvalds (1):
      mremap: properly flush TLB before releasing the page

Lubomir Rintel (1):
      pxa168fb: prepare the clock

Maciej W. Rozycki (2):
      MIPS: Fix FCSR Cause bit handling for correct SIGFPE issue
      MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression

Marcelo Ricardo Leitner (1):
      sctp: fix race on sctp_id2asoc

Mark Rustad (1):
      ixgbe: Correct X550EM_x revision check

Mark Syms (1):
      CIFS: handle guest access errors to Windows shares

Martin Willi (1):
      mac80211_hwsim: do not omit multicast announce of first added radio

Mateusz Jurczyk (1):
      af_iucv: Move sockaddr length checks to before accessing sa_family in bind and connect handlers

Matias Karhumaa (1):
      Bluetooth: SMP: fix crash in unpairing

Matt Fleming (1):
      x86/mm/pat: Prevent hang during boot when mapping pages

Matt Redfearn (2):
      MIPS: Handle non word sized instructions when examining frame
      MIPS: microMIPS: Fix decoding of swsp16 instruction

Mike Kravetz (1):
      sparc64 mm: Fix more TSB sizing issues

Mikhail Nikiforov (1):
      Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15IGM

Nathan Chancellor (1):
      x86/time: Correct the attribute on jiffies' definition

Nicolas Dichtel (1):
      vti6: flush x-netns xfrm cache when vti interface is removed

Niklas Cassel (1):
      net: stmmac: Fix stmmac_mdio_reset() when building stmmac as modules

Nikolay Aleksandrov (1):
      net: bridge: remove ipv6 zero address check in mcast queries

Paolo Abeni (1):
      bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal

Paul Bolle (1):
      ser_gigaset: use container_of() instead of detour

Pavel Roskin (1):
      drm/nouveau/fbcon: fix oops without fbdev emulation

Peter S. Housel (1):
      brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain

Peter Zijlstra (2):
      sched/cgroup: Fix cgroup entity load tracking tear-down
      x86/percpu: Fix this_cpu_read()

Phil Auld (1):
      sched/fair: Fix throttle_list starvation with low CFS quota

Prarit Bhargava (1):
      x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs

Raghava Aditya Renukunta (2):
      aacraid: Start adapter after updating number of MSIX vectors
      scsi: aacraid: Fix typo in blink status

Rasmus Villemoes (1):
      perf tools: Disable parallelism for 'make clean'

Sascha Hauer (1):
      ARM: dts: imx53-qsb: disable 1.2GHz OPP

Sean Tranchetti (1):
      xfrm: validate template mode

Sowmini Varadhan (1):
      sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata

Srinivas Kandagatla (1):
      ARM: dts: apq8064: add ahci ports-implemented mask

Stefano Brivio (1):
      ipv6/ndisc: Preserve IPv6 control buffer if protocol error handlers are called

Steffen Klassert (1):
      xfrm: Validate address prefix lengths in the xfrm selector.

Steven Rostedt (Red Hat) (1):
      tracing: Skip more functions when doing stack tracing of events

Takashi Iwai (1):
      ALSA: timer: Fix zero-division by continue of uninitialized instance

Tariq Toukan (2):
      net/mlx5e: Fix LRO modify
      net/mlx5e: Correctly handle RSS indirection table when changing number of channels

Thadeu Lima de Souza Cascardo (1):
      xfrm6: call kfree_skb when skb is toobig

Thomas Petazzoni (1):
      ARM: 8799/1: mm: fix pci_ioremap_io() offset check

Tobias Herzog (1):
      cdc-acm: correct counting of UART states in serial state notification

Vladis Dronov (1):
      usbvision: revert commit 588afcc1

WANG Cong (1):
      sch_red: update backlog as well

Wenwen Wang (2):
      net: cxgb3_main: fix a missing-check bug
      net: socket: fix a missing-check bug

William Dauchy (1):
      ixgbevf: Fix handling of NAPI budget when multiple queues are enabled per vector

 Makefile                                           |  2 +-
 arch/arm/boot/dts/imx53-qsb-common.dtsi            | 11 ++++
 arch/arm/boot/dts/qcom-apq8064.dtsi                |  3 +-
 arch/arm/mm/ioremap.c                              |  2 +-
 arch/arm64/mm/fault.c                              | 15 ++---
 arch/mips/dec/int-handler.S                        | 34 ++--------
 arch/mips/include/asm/fpu_emulator.h               | 13 ++++
 arch/mips/include/asm/switch_to.h                  | 18 ++++++
 arch/mips/include/uapi/asm/inst.h                  |  2 +-
 arch/mips/kernel/mips-r2-to-r6-emul.c              | 10 +--
 arch/mips/kernel/process.c                         | 11 ++--
 arch/mips/kernel/ptrace.c                          |  7 +--
 arch/mips/kernel/traps.c                           | 72 ++++++++++++----------
 arch/sparc/include/asm/page_64.h                   |  1 +
 arch/sparc/kernel/pci.c                            | 29 ++++++---
 arch/sparc/lib/U3memcpy.S                          |  4 +-
 arch/sparc/mm/fault_64.c                           |  1 +
 arch/sparc/mm/tlb.c                                | 35 +++++++++--
 arch/sparc/mm/tsb.c                                | 18 ++++--
 arch/um/Makefile                                   |  4 ++
 arch/x86/include/asm/percpu.h                      |  8 +--
 arch/x86/kernel/time.c                             |  2 +-
 arch/x86/mm/pageattr.c                             | 21 ++++---
 arch/x86/pci/fixup.c                               |  7 +++
 arch/x86/um/setjmp_32.S                            | 16 ++---
 arch/x86/um/setjmp_64.S                            | 16 ++---
 crypto/shash.c                                     |  2 +-
 drivers/ata/ahci.c                                 |  5 +-
 drivers/devfreq/tegra-devfreq.c                    |  6 +-
 drivers/gpio/gpio-msic.c                           |  4 +-
 drivers/gpu/drm/nouveau/nouveau_fbcon.c            |  7 ++-
 drivers/gpu/host1x/dev.c                           |  4 +-
 drivers/infiniband/core/ucm.c                      |  3 +
 drivers/infiniband/core/ucma.c                     |  3 +
 drivers/input/mouse/elan_i2c_core.c                |  1 +
 drivers/isdn/gigaset/ser-gigaset.c                 |  9 +--
 drivers/media/usb/usbvision/usbvision-video.c      |  7 ---
 drivers/mfd/db8500-prcmu.c                         |  3 +
 drivers/mtd/spi-nor/spi-nor.c                      |  6 ++
 drivers/net/bonding/bond_main.c                    |  2 +-
 drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c    | 17 +++++
 drivers/net/ethernet/intel/igb/e1000_82575.c       | 11 ----
 drivers/net/ethernet/intel/ixgbe/ixgbe.h           |  2 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_type.h      |  2 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c      |  9 +--
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c  |  2 +
 drivers/net/ethernet/mellanox/mlx4/en_clock.c      |  5 +-
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |  2 +
 .../net/ethernet/mellanox/mlx5/core/en_ethtool.c   |  2 +
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  | 30 ++++++---
 drivers/net/ethernet/realtek/r8169.c               |  8 +--
 drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c  |  2 +-
 drivers/net/usb/asix_common.c                      |  3 +
 drivers/net/usb/ax88179_178a.c                     |  3 +
 drivers/net/usb/lan78xx.c                          | 17 ++---
 drivers/net/usb/r8152.c                            |  3 +
 drivers/net/usb/smsc75xx.c                         |  3 +
 drivers/net/usb/smsc95xx.c                         |  3 +
 drivers/net/usb/sr9800.c                           |  3 +
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |  7 +--
 drivers/net/wireless/mac80211_hwsim.c              |  3 +-
 drivers/ptp/ptp_chardev.c                          |  4 ++
 drivers/scsi/aacraid/linit.c                       |  2 +-
 drivers/scsi/aacraid/src.c                         |  2 +-
 drivers/scsi/scsi_scan.c                           |  5 +-
 drivers/scsi/scsi_sysfs.c                          |  8 ++-
 drivers/spi/spi-bcm63xx-hsspi.c                    |  4 +-
 drivers/spi/spi-bcm63xx.c                          |  4 +-
 drivers/spi/spi-xlp.c                              |  4 +-
 drivers/thermal/Kconfig                            |  6 +-
 drivers/tty/serial/sprd_serial.c                   |  4 +-
 drivers/usb/class/cdc-acm.c                        | 14 ++---
 drivers/usb/core/devio.c                           |  4 +-
 drivers/usb/dwc3/dwc3-omap.c                       |  4 +-
 drivers/usb/gadget/function/f_mass_storage.c       |  3 +
 drivers/usb/host/ehci-omap.c                       |  4 +-
 drivers/usb/host/imx21-hcd.c                       |  6 +-
 drivers/usb/storage/transport.c                    | 14 ++++-
 drivers/vhost/vhost.c                              |  2 +
 drivers/video/fbdev/pxa168fb.c                     |  6 +-
 drivers/video/fbdev/pxa3xx-gcu.c                   |  4 +-
 fs/btrfs/disk-io.c                                 |  4 +-
 fs/btrfs/disk-io.h                                 |  2 +
 fs/btrfs/root-tree.c                               | 27 +++++---
 fs/cachefiles/namei.c                              |  2 +-
 fs/cifs/connect.c                                  |  3 +
 fs/fat/fatent.c                                    |  1 +
 fs/fuse/file.c                                     |  6 +-
 fs/fuse/fuse_i.h                                   |  1 +
 include/linux/bpf.h                                |  5 --
 include/linux/cpuidle.h                            |  3 +
 include/linux/radix-tree.h                         |  1 +
 include/net/inet_ecn.h                             |  3 +-
 include/scsi/scsi_device.h                         |  1 +
 kernel/bpf/arraymap.c                              |  4 +-
 kernel/bpf/syscall.c                               | 13 +---
 kernel/events/core.c                               |  5 +-
 kernel/sched/core.c                                |  4 +-
 kernel/sched/fair.c                                | 59 ++++++++++++------
 kernel/sched/idle.c                                |  2 +-
 kernel/sched/sched.h                               |  4 +-
 kernel/trace/trace.c                               | 19 +++++-
 net/bluetooth/mgmt.c                               |  7 +--
 net/bluetooth/smp.c                                | 29 +++++++--
 net/bluetooth/smp.h                                |  3 +-
 net/bridge/br_multicast.c                          |  9 ++-
 net/core/rtnetlink.c                               | 10 +++
 net/ipv4/fou.c                                     | 16 +++++
 net/ipv4/ip_fragment.c                             | 12 ++--
 net/ipv6/addrconf.c                                |  6 +-
 net/ipv6/ip6_vti.c                                 | 31 ++++++++++
 net/ipv6/mcast.c                                   | 16 ++---
 net/ipv6/ndisc.c                                   |  3 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |  1 +
 net/ipv6/xfrm6_output.c                            |  2 +
 net/iucv/af_iucv.c                                 |  8 +--
 net/l2tp/l2tp_ip.c                                 | 16 ++---
 net/l2tp/l2tp_ip6.c                                | 16 ++---
 net/mac80211/status.c                              |  7 +--
 net/sched/sch_gred.c                               |  2 +-
 net/sched/sch_red.c                                |  4 ++
 net/sctp/socket.c                                  |  5 +-
 net/socket.c                                       | 11 +++-
 net/unix/af_unix.c                                 |  5 +-
 net/wireless/reg.c                                 |  1 +
 net/xfrm/xfrm_user.c                               | 15 +++++
 security/keys/process_keys.c                       |  7 ++-
 sound/core/timer.c                                 | 14 +++++
 sound/soc/codecs/ak4613.c                          |  1 +
 sound/soc/codecs/wm8940.c                          |  1 +
 sound/soc/spear/spdif_in.c                         |  6 +-
 tools/perf/Makefile                                |  4 +-
 132 files changed, 718 insertions(+), 384 deletions(-)

BUG= chromium:903534 
TEST=Build and test on various affected systems

Change-Id: I63cd955b4ebdca719c2b7b019ebca232cbe1921b
Signed-off-by: Guenter Roeck <groeck@chromium.org>

[modify] https://crrev.com/e4e68c9ea8106eff534321d2171dfd38f9f3a53c/drivers/char/tpm/tpm-chip.c
[delete] https://crrev.com/2e5698de443c2adccad36334ffbd1638f14446e6/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
[modify] https://crrev.com/e4e68c9ea8106eff534321d2171dfd38f9f3a53c/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c