CHROMIUM: Merge 'v4.14.134' into chromeos-4.14 Merge of v4.14.134 into chromeos-4.14 Changelog: ---------------------------------------------------------------- Aaron Ma (1): Input: elantech - enable middle button support on 2 ThinkPads Alan Stern (1): p54usb: Fix race between disconnect and firmware loading Alex Deucher (1): drm/amdgpu/gfx9: use reset default for PA_SC_FIFO_SIZE Alexandre Belloni (1): usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC Amadeusz Sławiński (1): SoC: rt274: Fix internal jack assignment in set_jack callback Andreas Fritiofson (1): USB: serial: ftdi_sio: add ID for isodebug v1 Anson Huang (1): Input: imx_keypad - make sure keyboard can always wake up system Ard Biesheuvel (1): arm64: kaslr: keep modules inside module region when KASAN is enabled Arnd Bergmann (2): ARM: omap2: remove incorrect __init annotation ARC: hide unused function unw_hdr_alloc Bartosz Golaszewski (2): ARM: davinci: da850-evm: call regulator_has_full_constraints() ARM: davinci: da8xx: specify dma_coherent_mask for lcdc Brian Norris (1): mwifiex: Don't abort on small, spec-compliant vendor IEs Chang-Hsien Tsai (1): samples, bpf: fix to change the buffer size for read() Christian Lamparter (1): carl9170: fix misuse of device driver API Christophe Leroy (1): crypto: talitos - rename alternative AEAD algos. Chuck Lever (1): svcrdma: Ignore source port when computing DRC hash Cole Rogers (1): Input: synaptics - enable SMBUS on T480 thinkpad trackpad Colin Ian King (3): ALSA: seq: fix incorrect order of dest_client/dest_ports arguments ALSA: usb-audio: fix sign unintended sign extension on left shifts net: lio_core: fix potential sign-extension overflow on large shift Dan Carpenter (1): drm: return -EFAULT if copy_to_user() fails Dave Airlie (2): drm/udl: introduce a macro to convert dev to udl. drm/udl: move to embedding drm device inside udl device. Dave Martin (1): KVM: arm/arm64: vgic: Fix kvm_device leak in vgic_its_destroy Dennis Wassenberg (1): ALSA: hda/realtek - Change front mic location for Lenovo M710q Dianzhang Chen (2): x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg() x86/tls: Fix possible spectre-v1 in do_get_thread_area() Dmitry Korotin (1): MIPS: Add missing EHB in mtc0 -> mfc0 sequence. Don Brace (1): scsi: hpsa: correct ioaccel2 chaining Douglas Anderson (1): block, bfq: NULL out the bic when it's no longer valid Eiichi Tsukata (2): tracing/snapshot: Resize spare buffer if size changed cpu/hotplug: Fix out-of-bounds read when setting fail state Eric Biggers (1): crypto: user - prevent operating on larval algorithms Eugen Hristev (1): can: m_can: implement errata "Needless activation of MRAF irq" Greg Kroah-Hartman (2): Linux 4.14.133 Linux 4.14.134 Guillaume Nault (2): netfilter: ipv6: nf_defrag: fix leakage of unqueued fragments netfilter: ipv6: nf_defrag: accept duplicate fragments again Hans de Goede (1): efi/bgrt: Drop BGRT status field reserved bits check Haren Myneni (1): crypto/NX: Set receive window credits to max number of CRBs in RxFIFO Hauke Mehrtens (1): MIPS: Fix bounds check virt_addr_valid Heiko Carstens (1): s390: fix stfle zero padding Herbert Xu (1): lib/mpi: Fix karactx leak in mpi_powm Hongjie Fang (1): fscrypt: don't set policy for a dead directory Hsin-Yi Wang (3): drm/mediatek: fix unbind functions drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable() Ian Abbott (2): staging: comedi: dt282x: fix a null pointer deref on interrupt staging: comedi: amplc_pci230: fix null pointer deref on interrupt Ido Schimmel (1): mlxsw: spectrum: Disallow prio-tagged packets when PVID is removed James Morse (1): drivers: base: cacheinfo: Ensure cpu hotplug work is done before Intel RDT Jann Horn (1): ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME Jason Wang (5): vhost_net: introduce vhost_exceeds_weight() vhost: introduce vhost_exceeds_weight() vhost_net: fix possible infinite loop vhost: vsock: add weight support vhost: scsi: add weight support Jia-Ju Bai (1): iwlwifi: Fix double-free problems in iwl_req_fw_callback() Joel Savitz (1): cpuset: restore sanity to cpuset_cpus_allowed_fallback() John Fastabend (1): bpf: sockmap, fix use after free from sleep in psock backlog workqueue Josh Poimboeuf (1): module: Fix livepatch/ftrace module text permissions race Julian Wiedmann (2): s390/qdio: (re-)initialize tiqdio list entries s390/qdio: don't touch the dsci in tiqdio_add_input_queues() Jörgen Storvist (1): USB: serial: option: add support for GosunCn ME3630 RNDIS mode Kailang Yang (1): ALSA: hda/realtek - Headphone Mic can't record after S3 Kirill A. Shutemov (1): x86/boot/64: Fix crash if kernel image crosses page table boundary Kiruthika Varadarajan (1): usb: gadget: ether: Fix race between gether_disconnect and rx_submit Konstantin Khlebnikov (2): Revert "e1000e: fix cyclic resets at link up with active tx" e1000e: start network tx queue only when link is up Libin Yang (1): ASoC: soc-pcm: BE dai needs prepare when pause release after resume Lin Yi (1): net :sunrpc :clnt :Fix xps refcount imbalance on the error path Linus Torvalds (1): tty: rocket: fix incorrect forward declaration of 'rp_init()' Lucas De Marchi (1): drm/i915/dmc: protect against reading random memory Manuel Traut (1): scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE Marcus Cooper (2): ASoC: sun4i-i2s: Fix sun8i tx channel offset mask ASoC: sun4i-i2s: Add offset to RX channel select Mariusz Tkaczyk (1): md: fix for divide error in status_resync Masahiro Yamada (1): nilfs2: do not use unexported cpu_to_le32()/le32_to_cpu() in uapi header Matias Karhumaa (1): Bluetooth: Fix faulty expression for minimum encryption key size check Matt Flax (1): ASoC : cs4265 : readable register too low Mauro S. M. Rodrigues (1): bnx2x: Check if transceiver implements DDM before access Melissa Wen (1): staging:iio:ad7150: fix threshold mode config bit Milan Broz (1): dm verity: use message limit for data block corruption message Nikolay Borisov (1): btrfs: Ensure replaced device doesn't have pending chunk allocation Oliver Barta (1): Revert "serial: 8250: Don't service RX FIFO if interrupts are disabled" Paolo Abeni (1): vhost_net: use packet weight for rx handler, too Paolo Bonzini (1): KVM: x86: degrade WARN to pr_warn_ratelimited Paul Burton (1): MIPS: netlogic: xlr: Remove erroneous check in nlm_fmn_send() Peter Zijlstra (1): perf/core: Fix perf_sample_regs_user() mm check Petr Mladek (1): ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code() Petr Oros (1): be2net: fix link failure after ethtool offline test Pradeep Kumar Chitrapu (1): mac80211: free peer keys before vif down in mesh Rasmus Villemoes (1): net: dsa: mv88e6xxx: fix shift of FID bits in mv88e6185_g1_vtu_loadpurge() Reinhard Speyerer (3): qmi_wwan: add support for QMAP padding in the RX path qmi_wwan: avoid RCU stalls on device disconnect when in QMAP mode qmi_wwan: extend permitted QMAP mux_id value range Robert Beckett (2): drm/imx: notify drm core before sending event during crtc disable drm/imx: only send event on crtc disable if kept disabled Robert Kolchmeyer (1): Merge branch 'stable-merge/linux/v4.14.134' into merge/chromeos-4.14-v4.14.134 Robin Gong (1): dmaengine: imx-sdma: remove BD_INTR for channel0 Sean Nyekjaer (2): dt-bindings: can: mcp251x: add mcp25625 support can: mcp251x: add support for mcp25625 Sean Young (1): MIPS: Remove superfluous check for __linux__ Sergej Benilov (1): sis900: fix TX completion Shakeel Butt (1): mm/vmscan.c: prevent useless kswapd loops Stanislaw Gruszka (1): stable/btrfs: fix backport bug in d819d97ea025 ("btrfs: honor path->skip_locking in backref code") Steven J. Magnani (1): udf: Fix incorrect final NOT_ALLOCATED (hole) extent length Sébastien Szymanski (1): ARM: dts: imx6ul: fix PWM[1-4] interrupts Takashi Iwai (5): ALSA: line6: Fix write on zero-sized buffer mwifiex: Fix possible buffer overflows at parsing bss descriptor mwifiex: Abort at too short BSS descriptor element mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() ppp: mppe: Add softdep to arc4 Takashi Sakamoto (1): ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages Teresa Remmet (1): ARM: dts: am335x phytec boards: Fix cd-gpios active level Thomas Falcon (1): ibmvnic: Refresh device multicast list after reset Thomas Pedersen (1): mac80211: mesh: fix RCU warning Tim Chen (1): Documentation: Add section about CPU vulnerabilities for Spectre Todd Kjos (1): binder: fix memory leak in error path Tony Lindgren (1): clk: ti: clkctrl: Fix returning uninitialized data Vadim Pasternak (1): platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device registration Vincent Whitchurch (1): crypto: cryptd - Fix skcipher instance memory leak Vineet Gupta (1): ARC: handle gcc generated __builtin_trap for older compiler Vinod Koul (1): linux/kernel.h: fix overflow for DIV_ROUND_UP_ULL Vishnu DASA (1): VMCI: Fix integer overflow in VMCI handle arrays Wanpeng Li (1): KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC Wei Li (1): ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper() Xin Long (1): ip6_tunnel: allow not to count pkts on tstats by passing dev as NULL Yibo Zhao (1): mac80211: only warn once on chanctx_conf being NULL Yoshihiro Shimoda (1): usb: renesas_usbhs: add a workaround for a race condition of workqueue Young Xiao (1): usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] Yu-Hsuan Hsu (1): ASoC: max98090: remove 24-bit format support if RJ is 0 YueHaibing (2): spi: bitbang: Fix NULL pointer dereference in spi_unregister_master can: af_can: Fix error path of can_init() haibinzhang(张海斌) (1): vhost-net: set packet weight of tx polling to 2 * vq size swkhack (1): mm/mlock.c: change count_mm_mlocked_page_nr return type yangerkun (1): quota: fix a problem about transfer quota Documentation/ABI/testing/sysfs-class-net-qmi | 4 +- Documentation/admin-guide/hw-vuln/index.rst | 1 + Documentation/admin-guide/hw-vuln/spectre.rst | 697 +++++++++++++++++++++ .../bindings/net/can/microchip,mcp251x.txt | 1 + Documentation/userspace-api/spec_ctrl.rst | 2 + Makefile | 2 +- arch/arc/kernel/traps.c | 8 + arch/arc/kernel/unwind.c | 9 +- arch/arm/boot/dts/am335x-pcm-953.dtsi | 2 +- arch/arm/boot/dts/am335x-wega.dtsi | 2 +- arch/arm/boot/dts/imx6ul.dtsi | 8 +- arch/arm/mach-davinci/board-da850-evm.c | 2 + arch/arm/mach-davinci/devices-da8xx.c | 3 + arch/arm/mach-omap2/prm3xxx.c | 2 +- arch/arm64/kernel/module.c | 8 +- arch/mips/include/asm/netlogic/xlr/fmn.h | 2 - arch/mips/include/uapi/asm/sgidefs.h | 8 - arch/mips/mm/mmap.c | 2 +- arch/mips/mm/tlbex.c | 29 +- arch/s390/include/asm/facility.h | 21 +- arch/x86/kernel/ftrace.c | 3 + arch/x86/kernel/head64.c | 17 +- arch/x86/kernel/ptrace.c | 5 +- arch/x86/kernel/tls.c | 9 +- arch/x86/kvm/lapic.c | 2 +- arch/x86/kvm/x86.c | 6 +- block/bfq-iosched.c | 1 + crypto/cryptd.c | 1 + crypto/crypto_user.c | 3 + drivers/android/binder.c | 4 +- drivers/base/cacheinfo.c | 3 +- drivers/clk/ti/clkctrl.c | 7 +- drivers/crypto/nx/nx-842-powernv.c | 8 +- drivers/crypto/talitos.c | 16 +- drivers/dma/imx-sdma.c | 4 +- drivers/firmware/efi/efi-bgrt.c | 5 - drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 19 - drivers/gpu/drm/drm_bufs.c | 5 +- drivers/gpu/drm/drm_ioc32.c | 5 +- drivers/gpu/drm/i915/intel_csr.c | 18 + drivers/gpu/drm/imx/ipuv3-crtc.c | 6 +- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + drivers/gpu/drm/mediatek/mtk_dsi.c | 12 +- drivers/gpu/drm/udl/udl_drv.c | 56 +- drivers/gpu/drm/udl/udl_drv.h | 9 +- drivers/gpu/drm/udl/udl_fb.c | 12 +- drivers/gpu/drm/udl/udl_main.c | 35 +- drivers/input/keyboard/imx_keypad.c | 18 +- drivers/input/mouse/elantech.c | 2 + drivers/input/mouse/synaptics.c | 1 + drivers/md/dm-verity-target.c | 4 +- drivers/md/md.c | 36 +- drivers/misc/vmw_vmci/vmci_context.c | 80 +-- drivers/misc/vmw_vmci/vmci_handle_array.c | 38 +- drivers/misc/vmw_vmci/vmci_handle_array.h | 29 +- drivers/net/can/m_can/m_can.c | 21 + drivers/net/can/spi/Kconfig | 5 +- drivers/net/can/spi/mcp251x.c | 25 +- drivers/net/dsa/mv88e6xxx/global1_vtu.c | 2 +- .../net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c | 3 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h | 1 + drivers/net/ethernet/cavium/liquidio/lio_core.c | 2 +- drivers/net/ethernet/emulex/benet/be_ethtool.c | 28 +- drivers/net/ethernet/ibm/ibmvnic.c | 3 + drivers/net/ethernet/intel/e1000e/netdev.c | 21 +- drivers/net/ethernet/mellanox/mlxsw/reg.h | 2 +- drivers/net/ethernet/sis/sis900.c | 16 +- drivers/net/ppp/ppp_mppe.c | 1 + drivers/net/usb/qmi_wwan.c | 27 +- drivers/net/wireless/ath/carl9170/usb.c | 39 +- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 - drivers/net/wireless/intersil/p54/p54usb.c | 43 +- drivers/net/wireless/marvell/mwifiex/fw.h | 12 +- drivers/net/wireless/marvell/mwifiex/ie.c | 45 +- drivers/net/wireless/marvell/mwifiex/scan.c | 31 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 4 +- drivers/net/wireless/marvell/mwifiex/wmm.c | 2 +- drivers/platform/x86/mlx-platform.c | 2 +- drivers/s390/cio/qdio_setup.c | 2 + drivers/s390/cio/qdio_thinint.c | 5 +- drivers/scsi/hpsa.c | 7 +- drivers/scsi/hpsa_cmd.h | 1 + drivers/spi/spi-bitbang.c | 2 +- drivers/staging/comedi/drivers/amplc_pci230.c | 3 +- drivers/staging/comedi/drivers/dt282x.c | 3 +- drivers/staging/iio/cdc/ad7150.c | 19 +- drivers/tty/rocket.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/usb/gadget/function/u_ether.c | 6 +- drivers/usb/gadget/udc/fusb300_udc.c | 5 + drivers/usb/gadget/udc/lpc32xx_udc.c | 3 +- drivers/usb/renesas_usbhs/fifo.c | 34 +- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 + drivers/usb/serial/option.c | 1 + drivers/vhost/net.c | 33 +- drivers/vhost/scsi.c | 14 +- drivers/vhost/vhost.c | 20 +- drivers/vhost/vhost.h | 6 +- drivers/vhost/vsock.c | 27 +- fs/btrfs/backref.c | 2 - fs/btrfs/dev-replace.c | 29 +- fs/btrfs/volumes.c | 2 + fs/btrfs/volumes.h | 5 + fs/crypto/policy.c | 2 + fs/quota/dquot.c | 4 +- fs/udf/inode.c | 93 ++- include/linux/cpuhotplug.h | 1 + include/linux/kernel.h | 3 +- include/linux/vmw_vmci_defs.h | 11 +- include/net/ip6_tunnel.h | 9 +- include/uapi/linux/nilfs2_ondisk.h | 24 +- kernel/cgroup/cpuset.c | 15 +- kernel/cpu.c | 3 + kernel/events/core.c | 2 +- kernel/livepatch/core.c | 6 + kernel/ptrace.c | 4 +- kernel/trace/ftrace.c | 7 +- kernel/trace/trace.c | 10 +- lib/mpi/mpi-pow.c | 6 +- mm/mlock.c | 4 +- mm/vmscan.c | 27 +- net/bluetooth/l2cap_core.c | 2 +- net/can/af_can.c | 24 +- net/core/skbuff.c | 1 + net/ipv6/netfilter/nf_conntrack_reasm.c | 22 +- net/mac80211/ieee80211_i.h | 2 +- net/mac80211/mesh.c | 6 +- net/sunrpc/clnt.c | 1 + net/sunrpc/xprtrdma/svc_rdma_transport.c | 7 +- samples/bpf/bpf_load.c | 2 +- scripts/decode_stacktrace.sh | 2 +- sound/core/seq/oss/seq_oss_ioctl.c | 2 +- sound/core/seq/oss/seq_oss_rw.c | 2 +- sound/firewire/amdtp-am824.c | 2 +- sound/pci/hda/patch_realtek.c | 3 +- sound/soc/codecs/cs4265.c | 2 +- sound/soc/codecs/max98090.c | 16 + sound/soc/codecs/rt274.c | 3 +- sound/soc/soc-pcm.c | 3 +- sound/soc/sunxi/sun4i-i2s.c | 6 +- sound/usb/line6/pcm.c | 5 + sound/usb/mixer_quirks.c | 4 +- virt/kvm/arm/vgic/vgic-its.c | 1 + 144 files changed, 1684 insertions(+), 535 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/spectre.rst BUG=b:138029094 TEST=Build and test on various affected systems Change-Id: If88b0307a5be1b609a5b5f9b9710d5f0df73cdec Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com> 