Merge remote-tracking branch '4.9/tmp-85e1c017' into 4.9

* 4.9/tmp-85e1c017:
  Linux 4.9.48
  epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
  kvm: arm/arm64: Force reading uncached stage2 PGD
  drm/ttm: Fix accounting error when fail to get pages for pool
  xfrm: policy: check policy direction value
  lib/mpi: kunmap after finishing accessing buffer
  wl1251: add a missing spin_lock_init()
  CIFS: remove endian related sparse warning
  CIFS: Fix maximum SMB2 header size
  alpha: uapi: Add support for __SANE_USERSPACE_TYPES__
  cpuset: Fix incorrect memory_pressure control file mapping
  cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs
  ceph: fix readpage from fscache
  mm, madvise: ensure poisoned pages are removed from per-cpu lists
  mm, uprobes: fix multiple free of ->uprobes_state.xol_area
  crypto: algif_skcipher - only call put_page on referenced and used pages
  i2c: ismt: Return EMSGSIZE for block reads with bogus length
  i2c: ismt: Don't duplicate the receive length for block reads
  irqchip: mips-gic: SYNC after enabling GIC region
  ANDROID: fiq_debugger: Fix minor bug in code
  ANDROID: configs: remove requirement for CONFIG_SYNC
  FROMLIST: binder: fix an ret value override
  FROMLIST: binder: fix memory corruption in binder_transaction binder
  Linux 4.9.47
  lz4: fix bogus gcc warning
  scsi: sg: reset 'res_in_use' after unlinking reserved array
  scsi: sg: protect accesses to 'reserved' page array
  locking/spinlock/debug: Remove spinlock lockup detection code
  arm64: fpsimd: Prevent registers leaking across exec
  x86/io: Add "memory" clobber to insb/insw/insl/outsb/outsw/outsl
  arm64: mm: abort uaccess retries upon fatal signal
  kvm: arm/arm64: Fix race in resetting stage2 PGD
  gcov: support GCC 7.1
  staging: wilc1000: simplify vif[i]->ndev accesses
  scsi: isci: avoid array subscript warning
  p54: memset(0) whole array
  FROMLIST: android: binder: Add page usage in binder stats
  FROMLIST: android: binder: Add shrinker tracepoints
  FROMLIST: android: binder: Add global lru shrinker to binder
  FROMLIST: android: binder: Move buffer out of area shared with user space
  FROMLIST: android: binder: Add allocator selftest
  FROMLIST: android: binder: Refactor prev and next buffer into a helper function
  android: android-base.config: enable IP6_NF_MATCH_RPFILTER
  Linux 4.9.46
  powerpc/mm: Ensure cpumask update is ordered
  ACPI: EC: Fix regression related to wrong ECDT initialization order
  ACPI / APEI: Add missing synchronize_rcu() on NOTIFY_SCI removal
  ACPI: ioapic: Clear on-stack resource before using it
  ntb: transport shouldn't disable link due to bogus values in SPADs
  ntb: ntb_test: ensure the link is up before trying to configure the mws
  ntb: no sleep in ntb_async_tx_submit
  NTB: ntb_test: fix bug printing ntb_perf results
  ntb_transport: fix bug calculating num_qps_mw
  ntb_transport: fix qp count bug
  Clarify (and fix) MAX_LFS_FILESIZE macros
  staging: rtl8188eu: add RNX-N150NUB support
  iio: hid-sensor-trigger: Fix the race with user space powering up sensors
  iio: imu: adis16480: Fix acceleration scale factor for adis16480
  ANDROID: binder: fix proc->tsk check.
  binder: Use wake up hint for synchronous transactions.
  binder: use group leader instead of open thread
  Revert "android: binder: Sanity check at binder ioctl"
  Bluetooth: bnep: fix possible might sleep error in bnep_session
  Bluetooth: cmtp: fix possible might sleep error in cmtp_session
  Bluetooth: hidp: fix possible might sleep error in hidp_session_thread
  netfilter: nat: fix src map lookup
  Revert "leds: handle suspend/resume in heartbeat trigger"
  net: sunrpc: svcsock: fix NULL-pointer exception
  x86/mm: Fix use-after-free of ldt_struct
  timers: Fix excessive granularity of new timers after a nohz idle
  perf/x86/intel/rapl: Make package handling more robust
  perf probe: Fix --funcs to show correct symbols for offline module
  perf/core: Fix group {cpu,task} validation
  ftrace: Check for null ret_stack on profile function graph entry function
  nfsd: Limit end of page list when decoding NFSv4 WRITE
  cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup()
  cifs: Fix df output for users with quota limits
  kbuild: linker script do not match C names unless LD_DEAD_CODE_DATA_ELIMINATION is configured
  tracing: Fix freeing of filter in create_filter() when set_str is false
  tracing: Fix kmemleak in tracing_map_array_free()
  tracing: Call clear_boot_tracer() at lateinit_sync
  drm: rcar-du: Fix H/V sync signal polarity configuration
  drm: rcar-du: Fix display timing controller parameter
  drm: rcar-du: Fix crash in encoder failure error path
  drm/atomic: If the atomic check fails, return its value first
  drm: Release driver tracking before making the object available again
  mm/memblock.c: reversed logic in memblock_discard()
  fork: fix incorrect fput of ->exe_file causing use-after-free
  mm/madvise.c: fix freeing of locked page with MADV_FREE
  i2c: designware: Fix system suspend
  mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled
  ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses
  ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource
  ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978)
  ALSA: core: Fix unexpected error at replacing user TLV
  ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets
  KVM: x86: block guest protection keys unless the host has them enabled
  KVM: s390: sthyi: fix specification exception detection
  KVM: s390: sthyi: fix sthyi inline assembly
  Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad
  Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310
  Input: trackpoint - add new trackpoint firmware ID
  bpf/verifier: fix min/max handling in BPF_SUB
  bpf: fix mixed signed/unsigned derived min/max value bounds
  bpf, verifier: fix alu ops against map_value{, _adj} register types
  bpf: adjust verifier heuristics
  bpf, verifier: add additional patterns to evaluate_reg_imm_alu
  net_sched: fix order of queue length updates in qdisc_replace()
  net: sched: fix NULL pointer dereference when action calls some targets
  irda: do not leak initialized list.dev to userspace
  net/mlx4_core: Enable 4K UAR if SRIOV module parameter is not enabled
  tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP
  ipv6: repair fib6 tree in failure case
  ipv6: reset fn->rr_ptr when replacing route
  tipc: fix use-after-free
  sctp: fully initialize the IPv6 address in sctp_v6_to_addr()
  nfp: fix infinite loop on umapping cleanup
  ipv4: better IP_MAX_MTU enforcement
  ptr_ring: use kmalloc_array()
  openvswitch: fix skb_panic due to the incorrect actions attrlen
  bpf: fix bpf_trace_printk on 32 bit archs
  net_sched: remove warning from qdisc_hash_add
  net_sched/sfq: update hierarchical backlog when drop packet
  ipv4: fix NULL dereference in free_fib_info_rcu()
  dccp: defer ccid_hc_tx_delete() at dismantle time
  dccp: purge write queue in dccp_destroy_sock()
  af_key: do not use GFP_KERNEL in atomic contexts
  sparc64: remove unnecessary log message
  ANDROID: NFC: st21nfca: Fix memory OOB and leak issues in connectivity events handler
  Linux 4.9.45
  usb: qmi_wwan: add D-Link DWM-222 device ID
  usb: optimize acpi companion search for usb port devices
  pids: make task_tgid_nr_ns() safe
  Sanitize 'move_pages()' permission checks
  genirq/ipi: Fixup checks against nr_cpu_ids
  genirq: Restore trigger settings in irq_modify_status()
  irqchip/atmel-aic: Fix unbalanced refcount in aic_common_rtc_irq_fixup()
  irqchip/atmel-aic: Fix unbalanced of_node_put() in aic_common_irq_fixup()
  x86/asm/64: Clear AC on NMI entries
  xen-blkfront: use a right index when checking requests
  powerpc: Fix VSX enabling/flushing to also test MSR_FP and MSR_VEC
  blk-mq-pci: add a fallback when pci_irq_get_affinity returns NULL
  xen: fix bio vec merging
  mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes
  mm/mempolicy: fix use after free when calling get_mempolicy
  mm: fix double mmap_sem unlock on MMF_UNSTABLE enforced SIGBUS
  mm: discard memblock data later
  ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices
  ALSA: usb-audio: Apply sample rate quirk to Sennheiser headset
  ALSA: seq: 2nd attempt at fixing race creating a queue
  Input: elan_i2c - Add antoher Lenovo ACPI ID for upcoming Lenovo NB
  Input: elan_i2c - add ELAN0608 to the ACPI table
  crypto: x86/sha1 - Fix reads beyond the number of blocks passed
  crypto: ixp4xx - Fix error handling path in 'aead_perform()'
  parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo
  audit: Fix use after free in audit_remove_watch_rule()
  netfilter: nf_ct_ext: fix possible panic after nf_ct_extend_unregister
  ANDROID: check dir value of xfrm_userpolicy_id
  ANDROID: NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
  ANDROID: nfc: fdp: Fix possible buffer overflow in WCS4000 NFC driver
  ANDROID: NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ
  ANDROID: usb: gadget: assign no-op request complete callbacks
  ANDROID: usb: gadget: configfs: fix null ptr in android_disconnect
  ANDROID: uid_sys_stats: Fix implicit declaration of get_cmdline()
  uid_sys_stats: log task io with a debug flag
  Linux 4.9.44
  MIPS: DEC: Fix an int-handler.S CPU_DADDI_WORKAROUNDS regression
  pinctrl: meson-gxbb: Add missing GPIODV_18 pin entry
  pinctrl: samsung: Remove bogus irq_[un]mask from resource management
  pinctrl: uniphier: fix WARN_ON() of pingroups dump on LD20
  pinctrl: uniphier: fix WARN_ON() of pingroups dump on LD11
  pinctrl: intel: merrifield: Correct UART pin lists
  pinctrl: sunxi: add a missing function of A10/A20 pinctrl driver
  pnfs/blocklayout: require 64-bit sector_t
  iio: adc: vf610_adc: Fix VALT selection value for REFSEL bits
  usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume
  usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter
  usb: core: unlink urbs from the tail of the endpoint's urb_list
  USB: Check for dropped connection before switching to full speed
  usb: renesas_usbhs: Fix UGCTRL2 value for R-Car Gen3
  usb: gadget: udc: renesas_usb3: Fix usb_gadget_giveback_request() calling
  uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069
  staging: comedi: comedi_fops: do not call blocking ops when !TASK_RUNNING
  iio: light: tsl2563: use correct event code
  iio: accel: bmc150: Always restore device to normal mode after suspend-resume
  staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
  USB: hcd: Mark secondary HCD as dead if the primary one died
  usb: musb: fix tx fifo flush handling again
  USB: serial: pl2303: add new ATEN device id
  USB: serial: cp210x: add support for Qivicon USB ZigBee dongle
  USB: serial: option: add D-Link DWM-222 device ID
  drm/i915: Fix out-of-bounds array access in bdw_load_gamma_lut
  drm/etnaviv: Fix off-by-one error in reloc checking
  nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays
  mmc: mmc: correct the logic for setting HS400ES signal voltage
  nand: fix wrong default oob layout for small pages using soft ecc
  fuse: initialize the flock flag in fuse_file on allocation
  target: Fix node_acl demo-mode + uncached dynamic shutdown regression
  iscsi-target: Fix iscsi_np reset hung task during parallel delete
  iscsi-target: fix memory leak in iscsit_setup_text_cmd()
  mtd: nand: Fix timing setup for NANDs that do not support SET FEATURES
  xtensa: don't limit csum_partial export by CONFIG_NET
  xtensa: mm/cache: add missing EXPORT_SYMBOLs
  xtensa: fix cache aliasing handling code for WT cache
  futex: Remove unnecessary warning from get_futex_key
  mm: fix list corruptions on shmem shrinklist
  mm: ratelimit PFNs busy info message
  ANDROID: Use sk_uid to replace uid get from socket file
  Linux 4.9.43
  Revert "ARM: dts: sun8i: Support DTB build for NanoPi M1"
  KVM: arm/arm64: Handle hva aging while destroying the vm
  sparc64: Prevent perf from running during super critical sections
  udp: consistently apply ufo or fragmentation
  revert "ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output"
  revert "net: account for current skb length when deciding about UFO"
  packet: fix tp_reserve race in packet_set_ring
  igmp: Fix regression caused by igmp sysctl namespace code.
  net: avoid skb_warn_bad_offload false positives on UFO
  tcp: fastopen: tcp_connect() must refresh the route
  net: sched: set xt_tgchk_param par.nft_compat as 0 in ipt_init_target
  net/mlx4_en: don't set CHECKSUM_COMPLETE on SCTP packets
  bpf, s390: fix jit branch offset related to ldimm64
  net: fix keepalive code vs TCP_FASTOPEN_CONNECT
  tcp: avoid setting cwnd to invalid ssthresh after cwnd reduction states
  ppp: fix xmit recursion detection on ppp channels
  ppp: Fix false xmit recursion detect with two ppp devices
  Linux 4.9.42
  workqueue: implicit ordered attribute should be overridable
  net: phy: Fix PHY unbind crash
  net: account for current skb length when deciding about UFO
  ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
  net/mlx5: E-Switch, Re-enable RoCE on mode change only after FDB destroy
  mm: don't dereference struct page fields of invalid pages
  signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
  lib/Kconfig.debug: fix frv build failure
  mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
  ARM: 8632/1: ftrace: fix syscall name matching
  virtio_blk: fix panic in initialization error path
  nbd: blk_mq_init_queue returns an error code on failure, not NULL
  iw_cxgb4: do not send RX_DATA_ACK CPLs after close/abort
  ARM: dts: sunxi: Change node name for pwrseq pin on Olinuxino-lime2-emmc
  ARM: dts: sun8i: Support DTB build for NanoPi M1
  drm/virtio: fix framebuffer sparse warning
  scsi: qla2xxx: Get mutex lock before checking optrom_state
  clk/samsung: exynos542x: mark some clocks as critical
  ipv4: make tcp_notsent_lowat sysctl knob behave as true unsigned int
  phy state machine: failsafe leave invalid RUNNING state
  netfilter: use fwmark_reflect in nf_send_reset
  ASoC: rt5645: set sel_i2s_pre_div1 to 2
  spi: spi-axi: Free resources on error path
  x86/boot: Add missing declaration of string functions
  tg3: Fix race condition in tg3_get_stats64().
  net: phy: dp83867: fix irq generation
  sh_eth: R8A7740 supports packet shecksumming
  sh_eth: fix EESIPR values for SH77{34|63}
  wext: handle NULL extra data in iwe_stream_add_point better
  sparc64: Fix exception handling in UltraSPARC-III memcpy.
  sparc64: Measure receiver forward progress to avoid send mondo timeout
  xen-netback: correctly schedule rate-limited queues
  net: phy: Correctly process PHY_HALTED in phy_stop_machine()
  net/mlx5e: Schedule overflow check work to mlx5e workqueue
  net/mlx5e: Fix wrong delay calculation for overflow check scheduling
  net/mlx5e: Fix outer_header_zero() check size
  net/mlx5: Fix command bad flow on command entry allocation failure
  net/mlx5: Consider tx_enabled in all modes on remap
  sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
  sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
  dccp: fix a memleak for dccp_feat_init err process
  dccp: fix a memleak that dccp_ipv4 doesn't put reqsk properly
  dccp: fix a memleak that dccp_ipv6 doesn't put reqsk properly
  net: ethernet: nb8800: Handle all 4 RGMII modes identically
  ipv6: Don't increase IPSTATS_MIB_FRAGFAILS twice in ip6_fragment()
  packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
  openvswitch: fix potential out of bound access in parse_ct
  mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled
  rtnetlink: allocate more memory for dev_set_mac_address()
  ipv4: initialize fib_trie prior to register_netdev_notifier call.
  net: dsa: b53: Add missing ARL entries for BCM53125
  ipv6: avoid overflow of offset in ip6_find_1stfragopt
  net: Zero terminate ifr_name in dev_ifname().
  ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()
  tcp_bbr: init pacing rate on first RTT sample
  tcp_bbr: remove sk_pacing_rate=0 transient during init
  tcp_bbr: introduce bbr_init_pacing_rate_from_rtt() helper
  tcp_bbr: introduce bbr_bw_to_pacing_rate() helper
  tcp_bbr: cut pacing rate only if filled pipe
  saa7164: fix double fetch PCIe access condition
  Btrfs: fix early ENOSPC due to delalloc
  f2fs: sanity check checkpoint segno and blkoff
  media: lirc: LIRC_GET_REC_RESOLUTION should return microseconds
  mmc: core: Use device_property_read instead of of_property_read
  mmc: dw_mmc: Use device_property_read instead of of_property_read
  iscsi-target: Fix initial login PDU asynchronous socket close OOPs
  media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
  ARM: dts: tango4: Request RGMII RX and TX clock delays
  ARM: dts: armada-38x: Fix irq type for pca955
  ext4: fix overflow caused by missing cast in ext4_resize_fs()
  ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
  gpiolib: skip unwanted events, don't convert them to opposite edge
  iommu/amd: Enable ga_log_intr when enabling guest_mode
  powerpc/64: Fix __check_irq_replay missing decrementer interrupt
  powerpc/tm: Fix saving of TM SPRs in core dump
  timers: Fix overflow in get_next_timer_interrupt
  mm/page_alloc: Remove kernel address exposure in free_reserved_area()
  KVM: async_pf: make rcu irq exit if not triggered from idle task
  ASoC: do not close shared backend dailink
  drm/amdgpu: Fix undue fallthroughs in golden registers initialization
  ALSA: hda - Fix speaker output from VAIO VPCL14M1R
  cpuset: fix a deadlock due to incomplete patching of cpusets_enabled()
  mm, mprotect: flush TLB if potentially racing with a parallel reclaim leaving stale TLB entries
  mmc: core: Fix access to HS400-ES devices
  device property: Make dev_fwnode() public
  mmc: sdhci-of-at91: force card detect value for non removable devices
  NFSv4: Fix EXCHANGE_ID corrupt verifier issue
  brcmfmac: fix memleak due to calling brcmf_sdiod_sgtable_alloc() twice
  iwlwifi: dvm: prevent an out of bounds access
  workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
  libata: array underflow in ata_find_dev()
  cgroup: fix error return value from cgroup_subtree_control()
  cgroup: create dfl_root files on subsys registration
  parisc: Handle vma's whose context is not current in flush_cache_range
  ANDROID: binder: don't queue async transactions to thread.
  ANDROID: binder: don't enqueue death notifications to thread todo.
  ANDROID: binder: call poll_wait() unconditionally.
  ANDROID: keychord: Fix for a memory leak in keychord.
  ANDROID: keychord: Fix races in keychord_write.
  android: configs: move quota-related configs to recommended
  ANDROID: sdcardfs: override credential for ioctl to lower fs
  ANDROID: xt_qtaguid: handle properly request sockets

Conflicts:
	drivers/staging/android/fiq_debugger/fiq_debugger.c
	include/linux/sched.h
	kernel/locking/spinlock_debug.c
	sound/soc/soc-pcm.c

Change-Id: I163a8c98f1737eeb01b9c8a0636a91d552ef349f
Signed-off-by: Kyle Yan <kyan@codeaurora.org>