Bionic update: upstream stable patchset 2019-07-26

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       upstream stable patchset 2019-07-26

            Ported from the following upstream stable releases:
                v4.14.109, v4.19.32,
                v4.14.110, v4.19.33,
                v4.14.111, v4.19.34,
                v4.14.112, v4.19.35

       from git://git.kernel.org/

mmc: pxamci: fix enum type confusion
drm/vmwgfx: Don't double-free the mode stored in par->set_mode
iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
libceph: wait for latest osdmap in ceph_monc_blacklist_add()
udf: Fix crash on IO error during truncate
mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
MIPS: Ensure ELF appended dtb is relocated
MIPS: Fix kernel crash for R6 in jump label branch function
scsi: ibmvscsi: Protect ibmvscsi_head from concurrent modificaiton
scsi: ibmvscsi: Fix empty event pool access during host removal
futex: Ensure that futex address is aligned in handle_futex_death()
perf probe: Fix getting the kernel map
objtool: Move objtool_file struct off the stack
ALSA: x86: Fix runtime PM for hdmi-lpe-audio
ext4: fix NULL pointer dereference while journal is aborted
ext4: fix data corruption caused by unaligned direct AIO
ext4: brelse all indirect buffer in ext4_ind_remove_space()
media: v4l2-ctrls.c/uvc: zero v4l2_event
Bluetooth: hci_uart: Check if socket buffer is ERR_PTR in h4_recv_buf()
Bluetooth: Fix decrementing reference count twice in releasing socket
Bluetooth: hci_ldisc: Initialize hci_dev before open()
Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
drm: Reorder set_property_atomic to avoid returning with an active ww_ctx
netfilter: ebtables: remove BUGPRINT messages
x86/unwind: Handle NULL pointer calls better in frame unwinder
x86/unwind: Add hardcoded ORC entry for NULL
locking/lockdep: Add debug_locks check in __lock_downgrade()
ALSA: hda - Record the current power state before suspend/resume calls
PCI: designware-ep: dw_pcie_ep_set_msi() should only set MMC bits
PCI: designware-ep: Read-only registers need DBI_RO_WR_EN to be writable
PCI: endpoint: Use EPC's device in dma_alloc_coherent()/dma_free_coherent()
rtc: Fix overflow when converting time64_t to rtc_time
sched/cpufreq/schedutil: Fix error path mutex unlock
pwm-backlight: Enable/disable the PWM before/after LCD enable toggle.
power: supply: charger-manager: Fix incorrect return value
ath10k: avoid possible string overflow
mmc: renesas_sdhi: limit block count to 16 bit for old revisions
powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038
RDMA/cma: Rollback source IP address if failing to acquire device
f2fs: fix to avoid deadlock of atomic file operations
loop: access lo_backing_file only when the loop device is Lo_bound
video: fbdev: Set pixclock = 0 in goldfishfb
dccp: do not use ipv6 header for ipv4 flow
genetlink: Fix a memory leak on error path
mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S
net: datagram: fix unbounded loop in __skb_try_recv_datagram()
net/packet: Set __GFP_NOWARN upon allocation in alloc_pg_vec
net: rose: fix a possible stack overflow
net: stmmac: fix memory corruption with large MTUs
net-sysfs: call dev_hold if kobject_init_and_add success
packets: Always register packet sk in the same order
rhashtable: Still do rehash when we get EEXIST
tcp: do not use ipv6 header for ipv4 flow
thunderx: enable page recycling for non-XDP case
thunderx: eliminate extra calls to put_page() for pages held for recycling
vxlan: Don't call gro_cells_destroy() before device is unregistered
sctp: get sctphdr by offset in sctp_compute_cksum
net: aquantia: fix rx checksum offload for UDP/TCP over IPv6
mac8390: Fix mmio access size probe
tun: properly test for IFF_UP
tun: add a missing rcu_read_unlock() in error path
powerpc/fsl: Add barrier_nospec implementation for NXP PowerPC Book3E
powerpc/fsl: Sanitize the syscall table for NXP PowerPC 32 bit platforms
powerpc/fsl: Add infrastructure to fixup branch predictor flush
powerpc/fsl: Add macro to flush the branch predictor
powerpc/fsl: Emulate SPRN_BUCSR register
powerpc/fsl: Flush the branch predictor at each kernel entry (64bit)
powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit)
powerpc/fsl: Flush branch predictor when entering KVM
powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used
powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup'
powerpc/fsl: Fix the flush of branch predictor.
Btrfs: fix incorrect file size after shrinking truncate and fsync
btrfs: remove WARN_ON in log_dir_items
ARM: imx6q: cpuidle: fix bug that CPU might not wake up at expected time
powerpc: bpf: Fix generation of load/store DW instructions
NFSv4.1 don't free interrupted slot on open
net: dsa: qca8k: remove leftover phy accessors
ALSA: pcm: Fix possible OOB access in PCM oss plugins
ALSA: pcm: Don't suspend stream in unrecoverable PCM state
kbuild: modversions: Fix relative CRC byte order interpretation
fs/open.c: allow opening only regular files during execve()
ocfs2: fix inode bh swapping mixup in ocfs2_reflink_inodes_lock
scsi: sd: Fix a race between closing an sd device and sd I/O
scsi: sd: Quiesce warning if device does not report optimal I/O size
scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host
scsi: zfcp: fix scsi_eh host reset with port_forced ERP for non-NPIV FCP devices
tty: atmel_serial: fix a potential NULL pointer dereference
staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest
staging: vt6655: Remove vif check from vnt_interrupt
staging: vt6655: Fix interrupt race condition on device start up.
serial: max310x: Fix to avoid potential NULL pointer dereference
serial: sh-sci: Fix setting SCSCR_TIE while transferring data
USB: serial: cp210x: add new device id
USB: serial: ftdi_sio: add additional NovaTech products
USB: serial: mos7720: fix mos_parport refcount imbalance on error path
USB: serial: option: set driver_info for SIM5218 and compatibles
USB: serial: option: add support for Quectel EM12
USB: serial: option: add Olicard 600
Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc
fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links
drm/vgem: fix use-after-free when drm_gem_handle_create() fails
gpio: exar: add a check for the return value of ida_simple_get fails
gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input
phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs
usb: mtu3: fix EXTCON dependency
USB: gadget: f_hid: fix deadlock in f_hidg_write()
usb: common: Consider only available nodes for dr_mode
usb: host: xhci-rcar: Add XHCI_TRUST_TX_LENGTH quirk
xhci: Fix port resume done detection for SS ports with LPM enabled
usb: cdc-acm: fix race during wakeup blocking TX traffic
mm/migrate.c: add missing flush_dcache_page for non-mapped page migrate
perf intel-pt: Fix TSC slip
cpu/hotplug: Prevent crash when CPU bringup fails on CONFIG_HOTPLUG_CPU=n
x86/smp: Enforce CONFIG_HOTPLUG_CPU when SMP=y
KVM: Reject device ioctls from processes other than the VM's creator
KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
vfio: ccw: only free cp on final interrupt
ipmi_si: Fix crash when using hard-coded device
gtp: change NET_UDP_TUNNEL dependency to select
Btrfs: fix assertion failure on fsync with NO_HOLES enabled
NFS: fix mount/umount race in nlmclnt.
ALSA: hda/realtek: Enable headset MIC of Acer AIO with ALC286
ALSA: hda/realtek: Enable headset MIC of Acer Aspire Z24-890 with ALC286
ALSA: hda/realtek - Add support for Acer Aspire E5-523G/ES1-432 headset mic
ALSA: hda/realtek: Enable ASUS X441MB and X705FD headset MIC with ALC256
ALSA: hda/realtek: Enable headset mic of ASUS P5440FF with ALC256
ALSA: hda/realtek: Enable headset MIC of ASUS X430UN and X512DK with ALC256
ALSA: hda/realtek - Fix speakers on Acer Predator Helios 500 Ryzen laptops
drm/rockchip: Do not use memcpy for MMIO addresses
drm/rockchip: vop: reset scale mode when win is disabled
tty: mxs-auart: fix a potential NULL pointer dereference
staging: speakup_soft: Fix alternate speech with other synths
serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference
drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check
usb: xhci: dbc: Don't free all memory with spinlock held
xhci: Don't let USB3 ports stuck in polling state prevent suspend
mm: add support for kmem caches in DMA32 zone
iommu/io-pgtable-arm-v7s: request DMA32 memory, and improve debugging
mm: mempolicy: make mbind() return -EIO when MPOL_MF_STRICT is specified
perf pmu: Fix parser error for uncore event alias
objtool: Query pkg-config for libelf location
bpf: do not restore dst_reg when cur_state is freed
arm64: debug: Don't propagate UNKNOWN FAR into si_code for debug signals
ext4: cleanup bh release code in ext4_ind_remove_space()
tty/serial: atmel: Add is_half_duplex helper
tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
CIFS: fix POSIX lock leak and invalid ptr deref
h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-
f2fs: fix to avoid deadlock in f2fs_read_inline_dir()
tracing: kdb: Fix ftdump to not sleep
net/mlx5: Avoid panic when setting vport rate
net/mlx5: Avoid panic when setting vport mac, getting vport config
gpio: gpio-omap: fix level interrupt idling
include/linux/relay.h: fix percpu annotation in struct rchan
enic: fix build warning without CONFIG_CPUMASK_OFFSTACK
scsi: hisi_sas: Set PHY linkrate when disconnected
iio: adc: fix warning in Qualcomm PM8xxx HK/XOADC driver
perf c2c: Fix c2c report for empty numa node
mm/cma.c: cma_declare_contiguous: correct err handling
mm/page_ext.c: fix an imbalance with kmemleak
mm, mempolicy: fix uninit memory access
mm/vmalloc.c: fix kernel BUG at mm/vmalloc.c:512!
mm/slab.c: kmemleak no scan alien caches
ocfs2: fix a panic problem caused by o2cb_ctl
f2fs: do not use mutex lock in atomic context
fs/file.c: initialize init_files.resize_wait
page_poison: play nicely with KASAN
cifs: use correct format characters
dm thin: add sanity checks to thin-pool and external snapshot creation
cifs: Fix NULL pointer dereference of devname
jbd2: fix invalid descriptor block checksum
fs: fix guard_bio_eod to check for real EOD errors
tools lib traceevent: Fix buffer overflow in arg_eval
PCI/PME: Fix hotplug/sysfs remove deadlock in pcie_pme_remove()
wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
crypto: crypto4xx - add missing of_node_put after of_device_is_available
crypto: cavium/zip - fix collision with generic cra_driver_name
usb: chipidea: Grab the (legacy) USB PHY by phandle first
scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c
powerpc/xmon: Fix opcode being uninitialized in print_insn_powerpc
coresight: etm4x: Add support to enable ETMv4.2
serial: 8250_pxa: honor the port number from devicetree
ARM: 8840/1: use a raw_spinlock_t in unwind
iommu/io-pgtable-arm-v7s: Only kmemleak_ignore L2 tables
powerpc/hugetlb: Handle mmap_min_addr correctly in get_unmapped_area callback
mmc: omap: fix the maximum timeout setting
e1000e: Fix -Wformat-truncation warnings
mlxsw: spectrum: Avoid -Wformat-truncation warnings
IB/mlx4: Increase the timeout for CM cache
clk: fractional-divider: check parent rate only if flag is set
cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies
efi: cper: Fix possible out-of-bounds access
scsi: megaraid_sas: return error when create DMA pool failed
scsi: fcoe: make use of fip_mode enum complete
perf test: Fix failure of 'evsel-tp-sched' test on s390
SoC: imx-sgtl5000: add missing put_device()
media: sh_veu: Correct return type for mem2mem buffer helpers
media: s5p-jpeg: Correct return type for mem2mem buffer helpers
media: s5p-g2d: Correct return type for mem2mem buffer helpers
media: mx2_emmaprp: Correct return type for mem2mem buffer helpers
media: mtk-jpeg: Correct return type for mem2mem buffer helpers
vfs: fix preadv64v2 and pwritev64v2 compat syscalls with offset == -1
HID: intel-ish-hid: avoid binding wrong ishtp_cl_device
jbd2: fix race when writing superblock
leds: lp55xx: fix null deref on firmware load failure
iwlwifi: pcie: fix emergency path
ACPI / video: Refactor and fix dmi_is_desktop()
kprobes: Prohibit probing on bsearch()
netfilter: conntrack: fix cloned unconfirmed skb->_nfct race in __nf_conntrack_confirm
ARM: 8833/1: Ensure that NEON code always compiles with Clang
ALSA: PCM: check if ops are defined before suspending PCM
usb: f_fs: Avoid crash due to out-of-scope stack ptr access
sched/topology: Fix percpu data types in struct sd_data & struct s_data
bcache: fix input overflow to cache set sysfs file io_error_halflife
bcache: fix input overflow to sequential_cutoff
bcache: improve sysfs_strtoul_clamp()
genirq: Avoid summation loops for /proc/stat
iw_cxgb4: fix srqidx leak during connection abort
fbdev: fbmem: fix memory access if logo is bigger than the screen
cdrom: Fix race condition in cdrom_sysctl_register
platform/x86: intel_pmc_core: Fix PCH IP sts reading
ASoC: fsl-asoc-card: fix object reference leaks in fsl_asoc_card_probe
sched/debug: Initialize sd_sysctl_cpus if !CONFIG_CPUMASK_OFFSTACK
efi/memattr: Don't bail on zero VA if it equals the region's PA
ARM: dts: lpc32xx: Remove leading 0x and 0s from bindings notation
soc: qcom: gsbi: Fix error handling in gsbi_probe()
mt7601u: bump supported EEPROM version
ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of
ARM: avoid Cortex-A9 livelock on tight dmb loops
bpf: fix missing prototype warnings
cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting
backlight: pwm_bl: Use gpiod_get_value_cansleep() to get initial state
tty: increase the default flip buffer limit to 2*640K
powerpc/pseries: Perform full re-add of CPU for topology update post-migration
usb: dwc3: gadget: Fix OTG events when gadget driver isn't loaded
media: mt9m111: set initial frame size other than 0x0
hwrng: virtio - Avoid repeated init of completion
soc/tegra: fuse: Fix illegal free of IO base address
HID: intel-ish: ipc: handle PIMR before ish_wakeup also clear PISR busy_clear bit
hpet: Fix missing '=' character in the __setup() code of hpet_mmap_enable
cpu/hotplug: Mute hotplug lockdep during init
dmaengine: imx-dma: fix warning comparison of distinct pointer types
dmaengine: qcom_hidma: assign channel cookie correctly
dmaengine: qcom_hidma: initialize tx flags in hidma_prep_dma_*
netfilter: physdev: relax br_netfilter dependency
media: s5p-jpeg: Check for fmt_ver_flag when doing fmt enumeration
regulator: act8865: Fix act8600_sudcdc_voltage_ranges setting
drm: Auto-set allow_fb_modifiers when given modifiers at plane init
drm/nouveau: Stop using drm_crtc_force_disable
x86/build: Specify elf_i386 linker emulation explicitly for i386 objects
selinux: do not override context on context mounts
wlcore: Fix memory leak in case wl12xx_fetch_firmware failure
x86/build: Mark per-CPU symbols as absolute explicitly for LLD
clk: rockchip: fix frac settings of GPLL clock for rk3328
dmaengine: tegra: avoid overflow of byte tracking
drm/dp/mst: Configure no_stop_bit correctly for remote i2c xfers
ACPI / video: Extend chassis-type detection with a "Lunch Box" check
f2fs: fix to adapt small inline xattr space in __find_inline_xattr()
net: stmmac: Avoid sometimes uninitialized Clang warnings
libbpf: force fixdep compilation at the start of the build
scsi: hisi_sas: Fix a timeout race of driver internal and SMP IO
x86/hyperv: Fix kernel panic when kexec on HyperV
mm/sparse: fix a bad comparison
mm, swap: bounds check swap_info array accesses to avoid NULL derefs
memcg: killed threads should not invoke memcg OOM killer
cifs: Accept validate negotiate if server return NT_STATUS_NOT_SUPPORTED
netfilter: nf_tables: check the result of dereferencing base_chain->stats
netfilter: conntrack: tcp: only close if RST matches exact sequence
kbuild: invoke syncconfig if include/config/auto.conf.cmd is missing
mwifiex: don't advertise IBSS features without FW support
perf report: Don't shadow inlined symbol with different addr range
media: rockchip/rga: Correct return type for mem2mem buffer helpers
selftests: skip seccomp get_metadata test if not real root
kprobes: Prohibit probing on RCU debug routine
bcache: fix potential div-zero error of writeback_rate_i_term_inverse
drm: rcar-du: add missing of_node_put
perf/aux: Make perf_event accessible to setup_aux()
e1000e: Exclude device from suspend direct complete optimization
i2c: of: Try to find an I2C adapter matching the parent
sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/task_rq_lock()
powerpc/64s: Clear on-stack exception marker upon exception return
platform/x86: intel-hid: Missing power button release on some Dell models
pinctrl: meson: meson8b: add the eth_rxd2 and eth_rxd3 pins
net: stmmac: Avoid one more sometimes uninitialized Clang warning
bcache: fix potential div-zero error of writeback_rate_p_term_inverse
net: sfp: move sfp_register_socket call from sfp_remove to sfp_probe
drm/i915/gvt: do not let pin count of shadow mm go negative
powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM
kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD
x86: vdso: Use $LD instead of $CC to link
x86/vdso: Drop implicit common-page-size linker flag
lib/string.c: implement a basic bcmp
stating: ccree: revert "staging: ccree: fix leak of import() after init()"
arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region
tty: mark Siemens R3964 line discipline as BROKEN
UBUNTU: [Config] updateconfigs for CONFIG_R3964 (BROKEN)
UBUNTU: [Config] updateconfigs for CONFIG_LDISC_AUTOLOAD
tty: ldisc: add sysctl to prevent autoloading of ldiscs
ipv6: Fix dangling pointer when ipv6 fragment
ipv6: sit: reset ip header pointer in ipip6_rcv
kcm: switch order of device registration to fix a crash
net-gro: Fix GRO flush when receiving a GSO packet.
net/mlx5: Decrease default mr cache size
net/sched: fix ->get helper of the matchall cls
qmi_wwan: add Olicard 600
sctp: initialize _pad of sockaddr_in before copying to user memory
tcp: Ensure DCTCP reacts to losses
vrf: check accept_source_route on the original netdevice
net/mlx5e: Fix error handling when refreshing TIRs
net/mlx5e: Add a lock on tir list
nfp: validate the return code from dev_queue_xmit()
bnxt_en: Improve RX consumer index validity check.
bnxt_en: Reset device on RX buffer errors.
net/sched: act_sample: fix divide by zero in the traffic path
netns: provide pure entropy for net_hash_mix()
net: ethtool: not call vzalloc for zero sized memory request
ALSA: seq: Fix OOB-reads from strlcpy
ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type
hv_netvsc: Fix unwanted wakeup after tx_disable
arm64: dts: rockchip: fix rk3328 sdmmc0 write errors
parisc: Detect QEMU earlier in boot process
parisc: regs_return_value() should return gpr28
alarmtimer: Return correct remaining time
drm/udl: add a release method and delay modeset teardown
include/linux/bitrev.h: fix constant bitrev
ASoC: fsl_esai: fix channel swap issue when stream starts
Btrfs: do not allow trimming when a fs is mounted with the nologreplay option
btrfs: prop: fix zstd compression parameter validation
btrfs: prop: fix vanished compression property after failed set
block: do not leak memory in bio_copy_user_iov()
block: fix the return errno for direct IO
genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent()
genirq: Initialize request_mutex if CONFIG_SPARSE_IRQ=n
virtio: Honour 'may_reduce_num' in vring_create_virtqueue
ARM: dts: am335x-evmsk: Correct the regulators for the audio codec
ARM: dts: am335x-evm: Correct the regulators for the audio codec
ARM: dts: at91: Fix typo in ISC_D0 on PC9
arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
arm64: dts: rockchip: fix rk3328 rgmii high tx error rate
arm64: backtrace: Don't bother trying to unwind the userspace stack
xen: Prevent buffer overflow in privcmd ioctl
sched/fair: Do not re-read ->h_load_next during hierarchical load calculation
xtensa: fix return_address
x86/perf/amd: Resolve race condition when disabling PMC
x86/perf/amd: Resolve NMI latency issues for active PMCs
x86/perf/amd: Remove need to check "running" bit in NMI handler
PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
dm table: propagate BDI_CAP_STABLE_WRITES to fix sporadic checksum errors
arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64
arm64: dts: rockchip: Fix vcc_host1_5v GPIO polarity on rk3328-rock64
tcp: fix a potential NULL pointer dereference in tcp_sk_exit
nfp: disable netpoll on representors
r8169: disable default rx interrupt coalescing on RTL8168
kbuild: deb-pkg: fix bindeb-pkg breakage when O= is used
ACPICA: Namespace: remove address node from global list after method termination
ALSA: hda/realtek - Add quirk for Tuxedo XC 1509
mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd()
riscv: Fix syscall_get_arguments() and syscall_set_arguments()
x86/asm: Remove dead __GNUC__ conditionals
dm integrity: change memcmp to strncmp in dm_integrity_ctr
UBUNTU: upstream stable to v4.14.112, v4.19.35