Cosmic update: 4.18.12 upstream stable release

[Thadeu Lima de Souza Cascardo]

    SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       4.18.12 upstream stable release
       from git://git.kernel.org/

Linux 4.18.12
media: v4l: event: Prevent freeing event subscriptions while accessed
arm64: KVM: Sanitize PSTATE.M when being set from userspace
powerpc/pseries: Fix unitialized timer reset on migration
powerpc/pkeys: Fix reading of ibm, processor-storage-keys property
powerpc: fix csum_ipv6_magic() on little endian platforms
KVM: PPC: Book3S HV: Fix guest r11 corruption with POWER9 TM workarounds
x86/pti: Fix section mismatch warning/error
clk: x86: Set default parent to 48Mhz
i2c: i801: Allow ACPI AML access I/O ports not reserved for SMBus
arm/arm64: smccc-1.1: Handle function result as parameters
arm/arm64: smccc-1.1: Make return values unsigned long
drm/amdgpu: Need to set moved to true when evict bo
ARM: dts: omap4-droid4: Fix emmc errors seen on some devices
nvme-fcloop: Fix dropped LS's to removed target port
ata: ftide010: Add a quirk for SQ201
drm/amdgpu: Update power state at the end of smu hw_init.
drm/amdgpu: Enable/disable gfx PG feature in rlc safe mode
Revert "ARM: dts: imx7d: Invert legacy PCI irq mapping"
hwmon: (adt7475) Make adt7475_read_word() return errors
hwmon: (ina2xx) fix sysfs shunt resistor read access
crypto: cavium/nitrox - fix for command corruption in queue full case with backlog submissions.
crypto: chtls - fix null dereference chtls_free_uld()
i40e: fix condition of WARN_ONCE for stat strings
i40e: Fix for Tx timeouts when interface is brought up if DCB is enabled
ixgbe: fix driver behaviour after issuing VFLR
e1000: ensure to free old tx/rx rings in set_ringparam()
e1000: check on netif_running() before calling e1000_up()
ice: Fix potential return of uninitialized value
ice: Fix a few null pointer dereference issues
tools: bpftool: return from do_event_pipe() on bad arguments
ice: Set VLAN flags correctly
ice: Use order_base_2 to calculate higher power of 2
ice: Fix bugs in control queue processing
ice: Clean control queues only when they are initialized
ice: Report stats for allocated queues via ethtool stats
ice: Fix multiple static analyser warnings
net: hns3: fix page_offset overflow when CONFIG_ARM64_64K_PAGES
net: hns: fix skb->truesize underestimation
net: hns: fix length and page_offset overflow when CONFIG_ARM64_64K_PAGES
tcp_bbr: in restart from idle, see if we should exit PROBE_RTT
tcp_bbr: add bbr_check_probe_rtt_done() helper
net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler
amdgpu: fix multi-process hang issue
drm/amdgpu: fix preamble handling
drm/amdgpu: fix VM clearing for the root PD
bpf: sockmap: write_space events need to be passed to TCP handler
tls: possible hang when do_tcp_sendpages hits sndbuf is full case
bpf, sockmap: fix sock hash count in alloc_sock_hash_elem
bpf, sockmap: fix sock_hash_alloc and reject zero-sized keys
ARM: dts: omap4-droid4: fix vibrations on Droid 4
bus: ti-sysc: Fix no_console_suspend handling
mmc: android-goldfish: fix bad logic of sg_copy_{from,to}_buffer conversion
mmc: atmel-mci: fix bad logic of sg_copy_{from,to}_buffer conversion
isofs: reject hardware sector size > 2048 bytes
thermal: of-thermal: disable passive polling when thermal zone is disabled
qed: Avoid sending mailbox commands when MFW is not responsive
qed: Prevent a possible deadlock during driver load and unload
qed: Wait for MCP halt and resume commands to take place
qed: Wait for ready indication before rereading the shmem
bus: ti-sysc: Fix module register ioremap for larger offsets
ARM: OMAP2+: Fix module address for modules using mpu_rt_idx
ARM: OMAP2+: Fix null hwmod for ti-sysc debug
arm64: KVM: Tighten guest core register access from userspace
RDMA/uverbs: Atomically flush and mark closed the comp event queue
ACPI / hotplug / PCI: Don't scan for non-hotplug bridges if slot is not bridge
IB/hfi1: Fix destroy_qp hang after a link down
IB/hfi1: Fix context recovery when PBC has an UnsupportedVL
IB/hfi1: Invalid user input can result in crash
IB/hfi1: Fix SL array bounds check
IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop
Input: elantech - enable middle button of touchpad on ThinkPad P72
filesystem-dax: Fix use of zero page
ext2, dax: set ext2_dax_aops for dax files
uaccess: Fix is_source param for check_copy_size() in copy_to_iter_mcsafe()
USB: remove LPM management from usb_driver_claim_interface()
Revert "usb: cdc-wdm: Fix a sleep-in-atomic-context bug in service_outstanding_interrupt()"
USB: usbdevfs: restore warning for nonsensical flags
USB: usbdevfs: sanitize flags more
usb: musb: dsps: do not disable CPPI41 irq in driver teardown
usb: core: safely deal with the dynamic quirk lists
usb: roles: Take care of driver module reference counting
USB: handle NULL config in usb_find_alt_setting()
USB: fix error handling in usb_driver_claim_interface()
regulator: Fix 'do-nothing' value for regulators without suspend state
regulator: fix crash caused by null driver data
spi: rspi: Fix interrupted DMA transfers
spi: rspi: Fix invalid SPI use during system suspend
spi: sh-msiof: Fix handling of write value for SISTR register
spi: sh-msiof: Fix invalid SPI use during system suspend
spi: tegra20-slink: explicitly enable/disable clock
intel_th: Fix resource handling for ACPI glue layer
intel_th: Fix device removal logic
serial: cpm_uart: return immediately from console poll
serial: mvebu-uart: Fix reporting of effective CSIZE to userspace
serial: imx: restore handshaking irq for imx1
tty: serial: lpuart: avoid leaking struct tty_struct
x86/mm: Expand static page table for fixmap space
block: fix deadline elevator drain for zoned block devices
floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl
gpio: tegra: Fix tegra_gpio_irq_set_type()
perf tests: Fix indexing when invoking subtests
drm/vc4: plane: Expand the lower bits by repeating the higher bits
ARM: dts: dra7: fix DCAN node addresses
drm/vc4: Add missing formats to vc4_format_mod_supported().
iio: 104-quad-8: Fix off-by-one error in register selection
Input: xen-kbdfront - fix multi-touch XenStore node's locations
ath10k: fix memory leak of tpc_stats
fs/lock: skip lock owner pid translation in case we are in init_pid_ns
ath10k: snoc: use correct bus-specific pointer in RX retry
ath10k: fix incorrect size of dma_free_coherent in ath10k_ce_alloc_src_ring_64
staging: pi433: fix race condition in pi433_ioctl
EDAC, altera: Fix an error handling path in altr_s10_sdram_probe()
EDAC: Fix memleak in module init error path
nfsd: fix corrupted reply to badly ordered compound
gpio: Fix wrong rounding in gpio-menz127
module: exclude SHN_UNDEF symbols from kallsyms api
ASoC: dapm: Fix potential DAI widget pointer deref when linking DAIs
EDAC, i7core: Fix memleaks and use-after-free on probe and remove
ASoC: rsnd: SSI parent cares SWSP bit
ASoC: rt1305: Use ULL suffixes for 64-bit constants
ASoC: Intel: bytcr_rt5640: Fix Acer Iconia 8 over-current detect threshold
scsi: megaraid_sas: Update controller info during resume
spi: orion: fix CS GPIO handling again
scsi: hisi_sas: Fix the conflict between dev gone and host reset
iomap: complete partial direct I/O writes synchronously
scsi: bnx2i: add error handling for ioremap_nocache
perf/x86/intel/lbr: Fix incomplete LBR call stack
drm/v3d: Take a lock across GPU scheduler job creation and queuing.
arm64: dts: renesas: Fix VSPD registers range
MIPS: boot: fix build rule of vmlinux.its.S
HID: i2c-hid: Use devm to allocate i2c_hid struct
HID: hid-ntrig: add error handling for sysfs_create_group
arm: dts: mediatek: Add missing cooling device properties for CPUs
perf/hw_breakpoint: Split attribute parse and commit
Documentation/process: fix reST table border error
RDMA/uverbs: Don't overwrite NULL pointer with ZERO_SIZE_PTR
ARM: mvebu: declare asm symbols as character arrays in pmsu.c
drm/omap: gem: Fix mm_list locking
wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()
bitfield: fix *_encode_bits()
brcmsmac: fix wrap around in conversion from constant to s16
rndis_wlan: potential buffer overflow in rndis_wlan_auth_indication()
mt76x2: fix mrr idx/count estimation in mt76x2_mac_fill_tx_status()
ath10k: transmit queued frames after processing rx packets
drm/sun4i: Fix releasing node when enumerating enpoints
net: phy: xgmiitorgmii: Check phy_driver ready before accessing
drm/sun4i: Enable DW HDMI PHY clock
ath10k: protect ath10k_htt_rx_ring_free with rx_ring.lock
net: phy: xgmiitorgmii: Check read_status results
ALSA: hda: Add AZX_DCAPS_PM_RUNTIME for AMD Raven Ridge
ASoC: qdsp6: qdafe: fix some off by one bugs
media: tm6000: add error handling for dvb_register_adapter
staging: mt7621-dts: Fix remaining pcie warnings
serial: pxa: Fix an error handling path in 'serial_pxa_probe()'
arm64: dts: renesas: salvator-common: Fix adv7482 decimal unit addresses
drivers/tty: add error handling for pcmcia_loop_config
staging: mt7621-eth: Fix memory leak in mtk_add_mac() error path
media: ov772x: allow i2c controllers without I2C_FUNC_PROTOCOL_MANGLING
staging: android: ashmem: Fix mmap size validation
media: ov772x: add checks for register read errors
media: omap3isp: zero-initialize the isp cam_xclk{a,b} initial data
media: soc_camera: ov772x: correct setting of banding filter
media: s3c-camif: ignore -ENOIOCTLCMD from v4l2_subdev_call for s_power
ath10k: use locked skb_dequeue for rx completions
selftests: forwarding: Tweak tc filters for mirror-to-gretap tests
ALSA: snd-aoa: add of_node_put() in error path
posix-timers: Sanitize overrun handling
posix-timers: Make forward callback return s64
iio: accel: adxl345: convert address field usage in iio_chan_spec
mtd: rawnand: atmel: add module param to avoid using dma
s390/extmem: fix gcc 8 stringop-overflow warning
s390/scm_blk: correct numa_node in scm_blk_dev_setup
s390/dasd: correct numa_node in dasd_alloc_queue
alarmtimer: Prevent overflow for relative nanosleep
s390/sysinfo: add missing #ifdef CONFIG_PROC_FS
ACPI / button: increment wakeup count only when notified
platform/x86: asus-wireless: Fix uninitialized symbol usage
powerpc/powernv/ioda2: Reduce upper limit for DMA window size
ath10k: sdio: set skb len for all rx packets
ath10k: sdio: use same endpoint id for all packets in a bundle
usb: wusbcore: security: cast sizeof to int for comparison
scsi: target: Avoid that EXTENDED COPY commands trigger lock inversion
scsi: ibmvscsi: Improve strings handling
scsi: klist: Make it safe to use klists in atomic context
thermal: i.MX: Allow thermal probe to fail gracefully in case of bad calibration.
scsi: target/iscsi: Make iscsit_ta_authentication() respect the output buffer size
ARM: dts: ls1021a: Add missing cooling device properties for CPUs
x86/entry/64: Add two more instruction suffixes
ARM: hwmod: RTC: Don't assume lock/unlock will be called with irq enabled
x86/tsc: Add missing header to tsc_msr.c
include/rdma/opa_addr.h: Fix an endianness issue
IB/mlx5: Fix GRE flow specification
media: staging/imx: fill vb2_v4l2_buffer field entry
vhost_net: Avoid tx vring kicks during busyloop
media: fsl-viu: fix error handling in viu_of_probe()
powerpc/kdump: Handle crashkernel memory reservation failure
IB/mlx4: Test port number before querying type.
media: exynos4-is: Prevent NULL pointer dereference in __isp_video_try_fmt()
IB/core: type promotion bug in rdma_rw_init_one_mr()
RDMA/bnxt_re: Fix a bunch of off by one bugs in qplib_fp.c
RDMA/i40w: Hold read semaphore while looking after VMA
RDMA/bnxt_re: Fix a couple off by one bugs
cxgb4: Fix the condition to check if the card is T5
md-cluster: clear another node's suspend_area after the copy is finished
drm/amd/display: fix use of uninitialized memory
drm/amd/display/dc/dce: Fix multiple potential integer overflows
power: remove possible deadlock when unregistering power_supply
s390/mm: correct allocate_pgste proc_handler callback
iommu/msm: Don't call iommu_device_{,un}link from atomic context
6lowpan: iphc: reset mac_header after decompress to fix panic
USB: serial: kobil_sct: fix modem-status error handling
Bluetooth: Add a new Realtek 8723DE ID 0bda:b009
iommu/amd: make sure TLB to be flushed before IOVA freed
power: vexpress: fix corruption in notifier registration
uwb: hwa-rc: fix memory leak at probe
serial: sh-sci: Stop RX FIFO timer during port shutdown
misc: sram: enable clock before registering regions
power: supply: axp288_charger: Fix initial constant_charge_current value
staging: rts5208: fix missing error check on call to rtsx_write_register
x86/numa_emulation: Fix emulated-to-physical node mapping
net: hns3: Fix get_vector ops in hclgevf_main module
net: hns3: Fix warning bug when doing lp selftest
net: hns3: Fix for mac pause not disable in pfc mode
net: hns3: Fix for mailbox message truncated problem
siox: don't create a thread without starting it
vmci: type promotion bug in qp_host_get_user_memory()
misc: ibmvmc: Use GFP_ATOMIC under spin lock
tsl2550: fix lux1_input error in low light
iio: adc: ina2xx: avoid kthread_stop() with stale task_struct
crypto: skcipher - Fix -Wstringop-truncation warnings