Artful update to v4.13.6 stable release

[Seth Forshee]

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The v4.13.6 upstream stable
       patch set is now available. It should be included in the Ubuntu
       kernel as well.

       git://git.kernel.org/

    TEST CASE: TBD

       The following patches from the v4.13.6 stable release shall be applied:

imx-media-of: avoid uninitialized variable warning
usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0
mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+
net: bonding: Fix transmit load balancing in balance-alb mode if specified by sysfs
openvswitch: Fix an error handling path in 'ovs_nla_init_match_and_action()'
mlxsw: spectrum: Prevent mirred-related crash on removal
net: bonding: fix tlb_dynamic_lb default value
net_sched: gen_estimator: fix scaling error in bytes/packets samples
net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
tcp: update skb->skb_mstamp more carefully
bpf/verifier: reject BPF_ALU64|BPF_END
tcp: fix data delivery rate
udpv6: Fix the checksum computation when HW checksum does not apply
ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
net: phy: Fix mask value write on gmii2rgmii converter speed register
ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
net/sched: cls_matchall: fix crash when used with classful qdisc
8139too: revisit napi_complete_done() usage
bpf: do not disable/enable BH in bpf_map_free_id()
tcp: fastopen: fix on syn-data transmit failure
net: emac: Fix napi poll list corruption
net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure
packet: hold bind lock when rebinding to fanout hook
bpf: one perf event close won't free bpf program attached by another perf event
net: change skb->mac_header when Generic XDP calls adjust_head
isdn/i4l: fetch the ppp_write buffer in one shot
net_sched: always reset qdisc backlog in qdisc_reset()
net: stmmac: Cocci spatch "of_table"
net: qcom/emac: specify the correct size when mapping a DMA buffer
vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
l2tp: fix race condition in l2tp_tunnel_delete
tun: bail out from tun_get_user() if the skb is empty
net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans
net: dsa: Fix network device registration order
packet: in packet_do_bind, test fanout with bind_lock held
packet: only test po->has_vnet_hdr once in packet_snd
net: dsa: mv88e6xxx: lock mutex when freeing IRQs
net: Set sk_prot_creator when cloning sockets to the right proto
net/mlx5e: IPoIB, Fix access to invalid memory address
netlink: do not proceed if dump's start() errs
ip6_gre: ip6gre_tap device should keep dst
ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
IPv4: early demux can return an error code
tipc: use only positive error codes in messages
l2tp: fix l2tp_eth module loading
socket, bpf: fix possible use after free
net: rtnetlink: fix info leak in RTM_GETSTATS call
bpf: fix bpf_tail_call() x64 JIT
usb: gadget: core: fix ->udc_set_speed() logic
USB: gadgetfs: Fix crash caused by inadequate synchronization
USB: gadgetfs: fix copy_to_user while holding spinlock
usb: gadget: udc: atmel: set vbus irqflags explicitly
usb: gadget: udc: renesas_usb3: fix for no-data control transfer
usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
usb-storage: fix bogus hardware error messages for ATA pass-thru devices
usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
usb: pci-quirks.c: Corrected timeout values used in handshake
USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
USB: dummy-hcd: fix connection failures (wrong speed)
USB: dummy-hcd: fix infinite-loop resubmission bug
USB: dummy-hcd: Fix erroneous synchronization change
USB: devio: Prevent integer overflow in proc_do_submiturb()
USB: devio: Don't corrupt user memory
USB: g_mass_storage: Fix deadlock when driver is unbound
USB: uas: fix bug in handling of alternate settings
USB: core: harden cdc_parse_cdc_header
usb: Increase quirk delay for USB devices
USB: fix out-of-bounds in usb_set_configuration
usb: xhci: Free the right ring in xhci_add_endpoint()
xhci: fix finding correct bus_state structure for USB 3.1 hosts
xhci: fix wrong endpoint ESIT value shown in tracing
usb: host: xhci-plat: allow sysdev to inherit from ACPI
xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
iio: ad_sigma_delta: Implement a dedicated reset function
staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
iio: core: Return error for failed read_reg
IIO: BME280: Updates to Humidity readings need ctrl_reg write!
iio: trigger: stm32-timer: preset shouldn't be buffered
iio: trigger: stm32-timer: fix a corner case to write preset
iio: ad7793: Fix the serial interface reset
iio: adc: stm32: fix bad error check on max_channels
iio: adc: mcp320x: Fix readout of negative voltages
iio: adc: mcp320x: Fix oops on module unload
uwb: properly check kthread_run return value
uwb: ensure that endpoint is interrupt
staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
ksm: fix unlocked iteration over vmas in cmp_and_merge_page()
mm, hugetlb, soft_offline: save compound page order before page migration
mm, oom_reaper: skip mm structs with mmu notifiers
mm: fix RODATA_TEST failure "rodata_test: test data was not read only"
mm: avoid marking swap cached page as lazyfree
mm: fix data corruption caused by lazyfree page
userfaultfd: non-cooperative: fix fork use after free
lib/ratelimit.c: use deferred printk() version
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
ALSA: compress: Remove unused variable
Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
ALSA: usx2y: Suppress kernel warning at page allocation failures
powerpc/powernv: Increase memory block size to 1GB on radix
powerpc: Fix action argument for cpufeatures-based TLB flush
powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
powerpc/tm: Fix illegal TM state in signal handler
percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
intel_th: pci: Add Lewisburg PCH support
driver core: platform: Don't read past the end of "driver_override" buffer
cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns
Drivers: hv: fcopy: restore correct transfer length
vmbus: don't acquire the mutex in vmbus_hvsock_device_unregister()
stm class: Fix a use-after-free
auxdisplay: charlcd: properly restore atomic counter on error path
ftrace: Fix kmemleak in unregister_ftrace_graph
ovl: fix error value printed in ovl_lookup_index()
ovl: fix dput() of ERR_PTR in ovl_cleanup_index()
ovl: fix dentry leak in ovl_indexdir_cleanup()
ovl: fix missing unlock_rename() in ovl_do_copy_up()
ovl: fix regression caused by exclusive upper/work dir protection
arm64: dt marvell: Fix AP806 system controller size
arm64: Ensure the instruction emulation is ready for userspace
HID: rmi: Make sure the HID device is opened on resume
HID: i2c-hid: allocate hid buffers for real worst case
HID: wacom: leds: Don't try to control the EKR's read-only LEDs
HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth
HID: wacom: Correct coordinate system of touchring and pen twist
HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox
HID: wacom: generic: Clear ABS_MISC when tool leaves proximity
HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
HID: wacom: bits shifted too much for 9th and 10th buttons
btrfs: avoid overflow when sector_t is 32 bit
Btrfs: fix overlap of fs_info::flags values
rocker: fix rocker_tlv_put_* functions for KASAN
netlink: fix nla_put_{u8,u16,u32} for KASAN
dm crypt: reject sector_size feature if device length is not aligned to it
dm ioctl: fix alignment of event number in the device list
dm crypt: fix memory leak in crypt_ctr_cipher_old()
KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()
kvm/x86: Avoid async PF preempting the kernel incorrectly
iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP
scsi: sd: Do not override max_sectors_kb sysfs setting
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
brcmfmac: setup passive scan if requested by user-space
drm/i915: always update ELD connector type after get modes
drm/i915/bios: ignore HDMI on port A
bsg-lib: fix use-after-free under memory-pressure
nvme-pci: Use PCI bus address for data/queues in CMB
mmc: core: add driver strength selection when selecting hs400es
nl80211: Define policy for packet pattern attributes
clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
udp: perform source validation for mcast early demux
udp: fix bcast packet reception
base: arch_topology: fix section mismatch build warnings
Linux 4.13.6

       The following patches from the v4.13.6 stable release had already been applied:

xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.13.0-17.20

---------------
linux (4.13.0-17.20) artful; urgency=low

  * linux: 4.13.0-17.20 -proposed tracker (LP: #1728927)

  [ Seth Forshee ]
  * thunderx2 ahci errata workaround needs additional delays (LP: #1724117)
    - SAUCE: ahci: thunderx2: stop engine fix update

  * usb 3-1: 2:1: cannot get freq at ep 0x1 (LP: #1708499)
    - ALSA: usb-audio: Add sample rate quirk for Plantronics C310/C520-M

  * Plantronics Blackwire C520-M - Cannot get freq at ep 0x1, 0x81
    (LP: #1709282)
    - ALSA: usb-audio: Add sample rate quirk for Plantronics C310/C520-M

  * TSC_DEADLINE incorrectly disabled inside virtual guests (LP: #1724912)
    - x86/apic: Silence "FW_BUG TSC_DEADLINE disabled due to Errata" on CPUs
      without the feature
    - x86/apic: Silence "FW_BUG TSC_DEADLINE disabled due to Errata" on
      hypervisors

  * x86/apic: Update TSC_DEADLINE quirk with additional SKX stepping
    (LP: #1724612)
    - x86/apic: Update TSC_DEADLINE quirk with additional SKX stepping

  * [Artful] Add support for Dell/Wyse 3040 audio codec (LP: #1723916)
    - SAUCE: ASoC: rt5670: Add support for Wyse 3040

  * [Artful] Some Dell Monitors Doesn't Work Well with Dell/Wyse 3040
    (LP: #1723915)
    - SAUCE: drm/i915: Workaround for DP DPMS D3 on Dell monitor

  * [Artful] Support headset mode for DELL WYSE (LP: #1723913)
    - SAUCE: ALSA: hda/realtek - Add support headset mode for DELL WYSE

  * Touchpad and TrackPoint Dose Not Work on Lenovo X1C6 and X280 (LP: #1723986)
    - SAUCE: Input: synaptics-rmi4 - RMI4 can also use SMBUS version 3
    - SAUCE: Input: synaptics - Lenovo X1 Carbon 5 should use SMBUS/RMI
    - SAUCE: Input: synaptics - add Intertouch support on X1 Carbon 6th and X280

  * Artful update to v4.13.8 stable release (LP: #1724669)
    - USB: dummy-hcd: Fix deadlock caused by disconnect detection
    - MIPS: math-emu: Remove pr_err() calls from fpu_emu()
    - MIPS: bpf: Fix uninitialised target compiler error
    - mei: always use domain runtime pm callbacks.
    - dmaengine: edma: Align the memcpy acnt array size with the transfer
    - dmaengine: ti-dma-crossbar: Fix possible race condition with dma_inuse
    - NFS: Fix uninitialized rpc_wait_queue
    - nfs/filelayout: fix oops when freeing filelayout segment
    - HID: usbhid: fix out-of-bounds bug
    - crypto: skcipher - Fix crash on zero-length input
    - crypto: shash - Fix zero-length shash ahash digest crash
    - KVM: MMU: always terminate page walks at level 1
    - KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
    - usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
    - pinctrl/amd: Fix build dependency on pinmux code
    - iommu/amd: Finish TLB flush in amd_iommu_unmap()
    - device property: Track owner device of device property
    - Revert "vmalloc: back off when the current task is killed"
    - fs/mpage.c: fix mpage_writepage() for pages with buffers
    - ALSA: usb-audio: Kill stray URB at exiting
    - ALSA: seq: Fix use-after-free at creating a port
    - ALSA: seq: Fix copy_from_user() call inside lock
    - ALSA: caiaq: Fix stray URB at probe error path
    - ALSA: li...