[PATCH 4.4 00/72] 4.4.216-stable review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 4.4.216 release.
There are 72 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Thu, 12 Mar 2020 12:34:10 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.216-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Linux 4.4.216-rc1

yangerkun <yangerkun@xxxxxxxxxx>
    crypto: algif_skcipher - use ZERO_OR_NULL_PTR in skcipher_recvmsg_async

Mikulas Patocka <mpatocka@xxxxxxxxxx>
    dm cache: fix a crash due to incorrect work item cancelling

Desnes A. Nunes do Rosario <desnesn@xxxxxxxxxxxxx>
    powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems

Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()

Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()

Ahmad Fatoum <a.fatoum@xxxxxxxxxxxxxx>
    ARM: imx: build v7_cpu_resume() unconditionally

Jason Gunthorpe <jgg@xxxxxxxxxxxx>
    RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()

Bernard Metzler <bmt@xxxxxxxxxxxxxx>
    RDMA/iwcm: Fix iwcm work deallocation

Charles Keepax <ckeepax@xxxxxxxxxxxxxxxxxxxxx>
    ASoC: dapm: Correct DAPM handling of active widgets during shutdown

Matthias Reichl <hias@xxxxxxxxx>
    ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path

Takashi Iwai <tiwai@xxxxxxx>
    ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output

Dmitry Osipenko <digetx@xxxxxxxxx>
    dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list

Dmitry Osipenko <digetx@xxxxxxxxx>
    dmaengine: tegra-apb: Fix use-after-free

Jiri Slaby <jslaby@xxxxxxx>
    vt: selection, push sel_lock up

Jiri Slaby <jslaby@xxxxxxx>
    vt: selection, push console lock down

Jiri Slaby <jslaby@xxxxxxx>
    vt: selection, close sel_buffer race

OGAWA Hirofumi <hirofumi@xxxxxxxxxxxxxxxxxx>
    fat: fix uninit-memory access for partial initialized inode

Zhang Xiaoxu <zhangxiaoxu5@xxxxxxxxxx>
    vgacon: Fix a UAF in vgacon_invert_region

Eugeniu Rosca <erosca@xxxxxxxxxxxxxx>
    usb: core: port: do error out if usb_autopm_get_interface() fails

Eugeniu Rosca <erosca@xxxxxxxxxxxxxx>
    usb: core: hub: do error out if usb_autopm_get_interface() fails

Dan Lazewatsky <dlaz@xxxxxxxxxxxx>
    usb: quirks: add NO_LPM quirk for Logitech Screen Share

Jim Lin <jilin@xxxxxxxxxx>
    usb: storage: Add quirk for Samsung Fit flash

Ronnie Sahlberg <lsahlber@xxxxxxxxxx>
    cifs: don't leak -EAGAIN for stat() during reconnect

Vasily Averin <vvs@xxxxxxxxxxxxx>
    s390/cio: cio_ignore_proc_seq_next should increase position index

Marco Felsch <m.felsch@xxxxxxxxxxxxxx>
    watchdog: da9062: do not ping the hw during stop()

Marek Vasut <marex@xxxxxxx>
    net: ks8851-ml: Fix 16-bit IO operation

Marek Vasut <marex@xxxxxxx>
    net: ks8851-ml: Fix 16-bit data access

Marek Vasut <marex@xxxxxxx>
    net: ks8851-ml: Remove 8-bit bus accessors

Harigovindan P <harigovi@xxxxxxxxxxxxxx>
    drm/msm/dsi: save pll state before dsi host is powered off

John Stultz <john.stultz@xxxxxxxxxx>
    drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI

Sergey Organov <sorganov@xxxxxxxxx>
    usb: gadget: serial: fix Tx stall after buffer overflow

Lars-Peter Clausen <lars@xxxxxxxxxx>
    usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags

Daniel Golle <daniel@xxxxxxxxxxxxxx>
    serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE

Paul Moore <paul@xxxxxxxxxxxxxx>
    audit: always check the netlink payload length in audit_receive_msg()

Matthew Wilcox <willy@xxxxxxxxxxxxx>
    fs: prevent page refcount overflow in pipe_buf_get

Miklos Szeredi <mszeredi@xxxxxxxxxx>
    pipe: add pipe_buf_get() helper

Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    mm: prevent get_user_pages() from overflowing page refcount

Punit Agrawal <punit.agrawal@xxxxxxx>
    mm, gup: ensure real head page is ref-counted when using hugepages

Will Deacon <will.deacon@xxxxxxx>
    mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages

Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    mm: add 'try_get_page()' helper function

Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
    mm: make page ref count overflow check tighter and more explicit

yangerkun <yangerkun@xxxxxxxxxx>
    slip: stop double free sl->dev in slip_open

Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
    KVM: Check for a bad hva before dropping into the ghc slow path

Aleksa Sarai <cyphar@xxxxxxxxxx>
    namei: only return -ECHILD from follow_dotdot_rcu()

Nikolay Aleksandrov <nikolay@xxxxxxxxxxxxxxxxxxx>
    net: netlink: cap max groups which will be considered in netlink_bind()

Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
    include/linux/bitops.h: introduce BITS_PER_TYPE

Nathan Chancellor <natechancellor@xxxxxxxxx>
    ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66

Wolfram Sang <wsa@xxxxxxxxxxxxx>
    i2c: jz4780: silence log flood on txabrt

Christophe JAILLET <christophe.jaillet@xxxxxxxxxx>
    MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'

dan.carpenter@xxxxxxxxxx <dan.carpenter@xxxxxxxxxx>
    HID: hiddev: Fix race in in hiddev_disconnect()

Johan Korsnes <jkorsnes@xxxxxxxxx>
    HID: core: increase HID report buffer size to 8KiB

Johan Korsnes <jkorsnes@xxxxxxxxx>
    HID: core: fix off-by-one memset in hid_report_raw_event()

Paul Moore <paul@xxxxxxxxxxxxxx>
    audit: fix error handling in audit_data_to_entry()

Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()

Jason Baron <jbaron@xxxxxxxxxx>
    net: sched: correct flower port blocking

Dmitry Osipenko <digetx@xxxxxxxxx>
    nfc: pn544: Fix occasional HW initialization failure

Xin Long <lucien.xin@xxxxxxxxx>
    sctp: move the format error check out of __sctp_sf_do_9_1_abort

Benjamin Poirier <bpoirier@xxxxxxxxxxxxxxxxxxx>
    ipv6: Fix route replacement with dev-only route

Benjamin Poirier <bpoirier@xxxxxxxxxxxxxxxxxxx>
    ipv6: Fix nlmsg_flags when splitting a multipath route

Arun Parameswaran <arun.parameswaran@xxxxxxxxxxxx>
    net: phy: restore mdio regs in the iproc mdio driver

Jethro Beekman <jethro@xxxxxxxxxxxx>
    net: fib_rules: Correctly set table field when table number exceeds 8 bits

Petr Mladek <pmladek@xxxxxxxx>
    sysrq: Remove duplicated sysrq message

Petr Mladek <pmladek@xxxxxxxx>
    sysrq: Restore original console_loglevel when sysrq disabled

Sergey Matyukevich <sergey.matyukevich.os@xxxxxxxxxxxxx>
    cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE

Frank Sorenson <sorenson@xxxxxxxxxx>
    cifs: Fix mode output in debugging statements

Sergey Matyukevich <sergey.matyukevich.os@xxxxxxxxxxxxx>
    cfg80211: check wiphy driver existence for drvinfo report

Johannes Berg <johannes.berg@xxxxxxxxx>
    mac80211: consider more elements in parsing CRC

Corey Minyard <cminyard@xxxxxxxxxx>
    ipmi:ssif: Handle a possible NULL pointer reference

Suraj Jitindar Singh <surajjs@xxxxxxxxxx>
    ext4: fix potential race between s_group_info online resizing and access

Suraj Jitindar Singh <surajjs@xxxxxxxxxx>
    ext4: fix potential race between s_flex_groups online resizing and access

Theodore Ts'o <tytso@xxxxxxx>
    ext4: fix potential race between online resizing and write operations

Johannes Berg <johannes.berg@xxxxxxxxx>
    iwlwifi: pcie: fix rb_allocator workqueue allocation


-------------

Diffstat:

 Makefile                                 |   4 +-
 arch/arm/mach-imx/Makefile               |   2 +
 arch/arm/mach-imx/common.h               |   4 +-
 arch/arm/mach-imx/resume-imx6.S          |  24 +++++++
 arch/arm/mach-imx/suspend-imx6.S         |  14 -----
 arch/mips/kernel/vpe.c                   |   2 +-
 arch/powerpc/kernel/cputable.c           |   4 +-
 arch/s390/mm/gup.c                       |   6 +-
 arch/x86/mm/gup.c                        |   9 ++-
 crypto/algif_skcipher.c                  |   2 +-
 drivers/char/ipmi/ipmi_ssif.c            |  10 ++-
 drivers/dma/coh901318.c                  |   4 --
 drivers/dma/tegra20-apb-dma.c            |   6 +-
 drivers/gpu/drm/msm/dsi/dsi_manager.c    |   7 ++-
 drivers/hid/hid-core.c                   |   4 +-
 drivers/hid/usbhid/hiddev.c              |   2 +-
 drivers/hwmon/adt7462.c                  |   2 +-
 drivers/i2c/busses/i2c-jz4780.c          |  36 +----------
 drivers/infiniband/core/cm.c             |   1 +
 drivers/infiniband/core/iwcm.c           |   4 +-
 drivers/md/dm-cache-target.c             |   4 +-
 drivers/net/ethernet/micrel/ks8851_mll.c |  53 +++-------------
 drivers/net/phy/mdio-bcm-iproc.c         |  20 ++++++
 drivers/net/slip/slip.c                  |   1 -
 drivers/net/wireless/iwlwifi/pcie/rx.c   |   6 +-
 drivers/nfc/pn544/i2c.c                  |   1 +
 drivers/s390/cio/blacklist.c             |   5 +-
 drivers/tty/serial/ar933x_uart.c         |   8 +++
 drivers/tty/sysrq.c                      |   8 +--
 drivers/tty/vt/selection.c               |  24 ++++++-
 drivers/tty/vt/vt.c                      |   2 -
 drivers/usb/core/hub.c                   |   6 +-
 drivers/usb/core/port.c                  |  10 ++-
 drivers/usb/core/quirks.c                |   3 +
 drivers/usb/gadget/function/f_fs.c       |   5 +-
 drivers/usb/gadget/function/u_serial.c   |   4 +-
 drivers/usb/storage/unusual_devs.h       |   6 ++
 drivers/video/console/vgacon.c           |   3 +
 drivers/watchdog/da9062_wdt.c            |   7 ---
 fs/cifs/cifsacl.c                        |   4 +-
 fs/cifs/connect.c                        |   2 +-
 fs/cifs/inode.c                          |   8 ++-
 fs/ecryptfs/keystore.c                   |   4 +-
 fs/ext4/balloc.c                         |  14 ++++-
 fs/ext4/ext4.h                           |  30 +++++++--
 fs/ext4/ialloc.c                         |  23 ++++---
 fs/ext4/mballoc.c                        |  61 ++++++++++++------
 fs/ext4/resize.c                         |  62 +++++++++++++++----
 fs/ext4/super.c                          | 103 +++++++++++++++++++++----------
 fs/fat/inode.c                           |  19 +++---
 fs/fuse/dev.c                            |  12 ++--
 fs/namei.c                               |   2 +-
 fs/pipe.c                                |   4 +-
 fs/splice.c                              |  12 +++-
 include/linux/bitops.h                   |   3 +-
 include/linux/hid.h                      |   2 +-
 include/linux/mm.h                       |  23 ++++++-
 include/linux/pipe_fs_i.h                |  17 ++++-
 include/net/flow_dissector.h             |   9 +++
 kernel/audit.c                           |  40 ++++++------
 kernel/auditfilter.c                     |  71 +++++++++++----------
 kernel/trace/trace.c                     |   6 +-
 mm/gup.c                                 |  51 ++++++++++-----
 mm/hugetlb.c                             |  16 ++++-
 mm/internal.h                            |  28 ++++++++-
 net/core/fib_rules.c                     |   2 +-
 net/ipv6/ip6_fib.c                       |   7 ++-
 net/ipv6/route.c                         |   1 +
 net/mac80211/util.c                      |  18 ++++--
 net/netlink/af_netlink.c                 |   5 +-
 net/sched/cls_flower.c                   |   1 +
 net/sctp/sm_statefuns.c                  |  27 +++++---
 net/wireless/ethtool.c                   |   8 ++-
 net/wireless/nl80211.c                   |   1 +
 sound/soc/codecs/pcm512x.c               |   8 ++-
 sound/soc/soc-dapm.c                     |   2 +-
 sound/soc/soc-pcm.c                      |  16 ++---
 virt/kvm/kvm_main.c                      |  12 ++--
 78 files changed, 684 insertions(+), 373 deletions(-)