Merge 4.14.81 into android-4.14

Changes in 4.14.81
	mtd: spi-nor: fsl-quadspi: fix read error for flash size larger than 16MB
	spi: bcm-qspi: switch back to reading flash using smaller chunks
	bcache: trace missed reading by cache_missed
	bcache: fix miss key refill->end in writeback
	hwmon: (pmbus) Fix page count auto-detection.
	jffs2: free jffs2_sb_info through jffs2_kill_sb()
	cpufreq: conservative: Take limits changes into account properly
	pcmcia: Implement CLKRUN protocol disabling for Ricoh bridges
	ipmi: Fix timer race with module unload
	parisc: Fix address in HPMC IVA
	parisc: Fix map_pages() to not overwrite existing pte entries
	parisc: Fix exported address of os_hpmc handler
	ALSA: hda - Add quirk for ASUS G751 laptop
	ALSA: hda - Fix headphone pin config for ASUS G751
	ALSA: hda/realtek - Fix the problem of the front MIC on the Lenovo M715
	ALSA: hda - Add mic quirk for the Lenovo G50-30 (17aa:3905)
	ALSA: ca0106: Disable IZD on SB0570 DAC to fix audio pops
	x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
	x86/xen: Fix boot loader version reported for PVH guests
	x86/corruption-check: Fix panic in memory_corruption_check() when boot option without value is provided
	x86/mm/pat: Disable preemption around __flush_tlb_all()
	x86/speculation: Support Enhanced IBRS on future CPUs
	ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen
	bpf: do not blindly change rlimit in reuseport net selftest
	Revert "perf tools: Fix PMU term format max value calculation"
	xfrm: policy: use hlist rcu variants on insert
	perf vendor events intel: Fix wrong filter_band* values for uncore events
	sparc: Fix single-pcr perf event counter management.
	sparc: Throttle perf events properly.
	sparc64: Make proc_id signed.
	sched/fair: Fix the min_vruntime update logic in dequeue_entity()
	perf tools: Fix use of alternatives to find JDIR
	perf cpu_map: Align cpu map synthesized events properly.
	x86/fpu: Remove second definition of fpu in __fpu__restore_sig()
	net: qla3xxx: Remove overflowing shift statement
	selftests: ftrace: Add synthetic event syntax testcase
	i2c: rcar: cleanup DMA for all kinds of failure
	locking/lockdep: Fix debug_locks off performance problem
	ataflop: fix error handling during setup
	swim: fix cleanup on setup error
	nfp: devlink port split support for 1x100G CXP NIC
	tun: Consistently configure generic netdev params via rtnetlink
	s390/sthyi: Fix machine name validity indication
	hwmon: (pwm-fan) Set fan speed to 0 on suspend
	lightnvm: pblk: fix two sleep-in-atomic-context bugs
	spi: spi-ep93xx: Use dma_data_direction for ep93xx_spi_dma_{finish,prepare}
	perf tools: Free temporary 'sys' string in read_event_files()
	perf tools: Cleanup trace-event-info 'tdata' leak
	perf strbuf: Match va_{add,copy} with va_end
	cpupower: Fix coredump on VMWare
	mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01
	iwlwifi: pcie: avoid empty free RB queue
	iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface
	x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC
	ACPI / processor: Fix the return value of acpi_processor_ids_walk()
	cpufreq: dt: Try freeing static OPPs only if we have added them
	mtd: rawnand: atmel: Fix potential NULL pointer dereference
	signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack
	Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth
	x86: boot: Fix EFI stub alignment
	pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux
	brcmfmac: fix for proper support of 160MHz bandwidth
	net: phy: phylink: ensure the carrier is off when starting phylink
	block, bfq: correctly charge and reset entity service in all cases
	kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()
	ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers
	pinctrl: qcom: spmi-mpp: Fix drive strength setting
	pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant
	pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant
	net: dsa: mv88e6xxx: Fix writing to a PHY page.
	iwlwifi: mvm: fix BAR seq ctrl reporting
	ixgbevf: VF2VF TCP RSS
	ath10k: schedule hardware restart if WMI command times out
	thermal: da9062/61: Prevent hardware access during system suspend
	cgroup, netclassid: add a preemption point to write_classid
	scsi: esp_scsi: Track residual for PIO transfers
	UAPI: ndctl: Fix g++-unsupported initialisation in headers
	KVM: nVMX: Clear reserved bits of #DB exit qualification
	scsi: megaraid_sas: fix a missing-check bug
	RDMA/core: Do not expose unsupported counters
	IB/ipoib: Clear IPCB before icmp_send
	RDMA/bnxt_re: Fix recursive lock warning in debug kernel
	usb: host: ohci-at91: fix request of irq for optional gpio
	PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic
	tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated
	Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask
	VMCI: Resource wildcard match fixed
	PCI / ACPI: Enable wake automatically for power managed bridges
	usb: gadget: udc: atmel: handle at91sam9rl PMC
	ext4: fix argument checking in EXT4_IOC_MOVE_EXT
	MD: fix invalid stored role for a disk
	f2fs: fix to recover inode's i_flags during POR
	PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice
	coresight: etb10: Fix handling of perf mode
	PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode
	crypto: caam - fix implicit casts in endianness helpers
	usb: chipidea: Prevent unbalanced IRQ disable
	driver/dma/ioat: Call del_timer_sync() without holding prep_lock
	uio: ensure class is registered before devices
	scsi: lpfc: Correct soft lockup when running mds diagnostics
	scsi: lpfc: Correct race with abort on completion path
	f2fs: report error if quota off error during umount
	signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init
	mfd: menelaus: Fix possible race condition and leak
	dmaengine: dma-jz4780: Return error if not probed from DT
	IB/rxe: fix for duplicate request processing and ack psns
	ALSA: hda: Check the non-cached stream buffers more explicitly
	cpupower: Fix AMD Family 0x17 msr_pstate size
	Revert "f2fs: fix to clear PG_checked flag in set_page_dirty()"
	f2fs: fix to account IO correctly
	ARM: dts: exynos: Remove "cooling-{min|max}-level" for CPU nodes
	arm: dts: exynos: Add missing cooling device properties for CPUs
	ARM: dts: exynos: Convert exynos5250.dtsi to opp-v2 bindings
	ARM: dts: exynos: Mark 1 GHz CPU OPP as suspend OPP on Exynos5250
	xen-swiotlb: use actually allocated size on check physical continuous
	tpm: Restore functionality to xen vtpm driver.
	xen/blkfront: avoid NULL blkfront_info dereference on device removal
	xen/balloon: Support xend-based toolstack
	xen: fix race in xen_qlock_wait()
	xen: make xen_qlock_wait() nestable
	xen/pvh: increase early stack size
	xen/pvh: don't try to unplug emulated devices
	libertas: don't set URB_ZERO_PACKET on IN USB transfer
	usbip:vudc: BUG kmalloc-2048 (Not tainted): Poison overwritten
	usb: gadget: udc: renesas_usb3: Fix b-device mode for "workaround"
	iwlwifi: mvm: check return value of rs_rate_from_ucode_rate()
	net/ipv4: defensive cipso option parsing
	dmaengine: ppc4xx: fix off-by-one build failure
	dmaengine: stm32-dma: fix incomplete configuration in cyclic mode
	libnvdimm: Hold reference on parent while scheduling async init
	libnvdimm, region: Fail badblocks listing for inactive regions
	ASoC: intel: skylake: Add missing break in skl_tplg_get_token()
	IB/mlx5: Fix MR cache initialization
	jbd2: fix use after free in jbd2_log_do_checkpoint()
	gfs2_meta: ->mount() can get NULL dev_name
	ext4: initialize retries variable in ext4_da_write_inline_data_begin()
	ext4: fix setattr project check in fssetxattr ioctl
	ext4: propagate error from dquot_initialize() in EXT4_IOC_FSSETXATTR
	ext4: fix use-after-free race in ext4_remount()'s error path
	HID: hiddev: fix potential Spectre v1
	EDAC, amd64: Add Family 17h, models 10h-2fh support
	EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting
	EDAC, skx_edac: Fix logical channel intermediate decoding
	ARM: dts: dra7: Fix up unaligned access setting for PCIe EP
	PCI/ASPM: Fix link_state teardown on device removal
	PCI: Add Device IDs for Intel GPU "spurious interrupt" quirk
	PCI: vmd: White list for fast interrupt handlers
	signal/GenWQE: Fix sending of SIGKILL
	signal: Guard against negative signal numbers in copy_siginfo_from_user32
	crypto: lrw - Fix out-of bounds access on counter overflow
	crypto: tcrypt - fix ghash-generic speed test
	mm: /proc/pid/smaps_rollup: fix NULL pointer deref in smaps_pte_range()
	ima: fix showing large 'violations' or 'runtime_measurements_count'
	hugetlbfs: dirty pages as they are added to pagecache
	mm/rmap: map_pte() was not handling private ZONE_DEVICE page properly
	KVM: arm64: Fix caching of host MDCR_EL2 value
	kbuild: fix kernel/bounds.c 'W=1' warning
	iio: ad5064: Fix regulator handling
	iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
	iio: adc: at91: fix acking DRDY irq on simple conversions
	iio: adc: at91: fix wrong channel number in triggered buffer mode
	w1: omap-hdq: fix missing bus unregister at removal
	smb3: allow stats which track session and share reconnects to be reset
	smb3: do not attempt cifs operation in smb3 query info error path
	smb3: on kerberos mount if server doesn't specify auth type use krb5
	printk: Fix panic caused by passing log_buf_len to command line
	genirq: Fix race on spurious interrupt detection
	NFSv4.1: Fix the r/wsize checking
	nfs: Fix a missed page unlock after pg_doio()
	nfsd: Fix an Oops in free_session()
	lockd: fix access beyond unterminated strings in prints
	dm ioctl: harden copy_params()'s copy_from_user() from malicious users
	dm zoned: fix metadata block ref counting
	dm zoned: fix various dmz_get_mblock() issues
	powerpc/msi: Fix compile error on mpc83xx
	MIPS: OCTEON: fix out of bounds array access on CN68XX
	iommu/arm-smmu: Ensure that page-table updates are visible before TLBI
	TC: Set DMA masks for devices
	media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
	kgdboc: Passing ekgdboc to command line causes panic
	xen: fix xen_qlock_wait()
	xen-blkfront: fix kernel panic with negotiate_mq error path
	media: em28xx: use a default format if TRY_FMT fails
	media: tvp5150: avoid going past array on v4l2_querymenu()
	media: em28xx: fix input name for Terratec AV 350
	media: em28xx: make v4l2-compliance happier by starting sequence on zero
	media: media colorspaces*.rst: rename AdobeRGB to opRGB
	arm64: lse: remove -fcall-used-x0 flag
	rpmsg: smd: fix memory leak on channel create
	Cramfs: fix abad comparison when wrap-arounds occur
	ARM: dts: socfpga: Fix SDRAM node address for Arria10
	arm64: dts: stratix10: Correct System Manager register size
	soc/tegra: pmc: Fix child-node lookup
	selftests/powerpc: Fix ptrace tm failure
	btrfs: qgroup: Avoid calling qgroup functions if qgroup is not enabled
	btrfs: Handle owner mismatch gracefully when walking up tree
	btrfs: locking: Add extra check in btrfs_init_new_buffer() to avoid deadlock
	btrfs: fix error handling in free_log_tree
	btrfs: Enhance btrfs_trim_fs function to handle error better
	btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
	btrfs: iterate all devices during trim, instead of fs_devices::alloc_list
	btrfs: don't attempt to trim devices that don't support it
	btrfs: wait on caching when putting the bg cache
	btrfs: protect space cache inode alloc with GFP_NOFS
	btrfs: reset max_extent_size on clear in a bitmap
	btrfs: make sure we create all new block groups
	Btrfs: fix warning when replaying log after fsync of a tmpfile
	Btrfs: fix wrong dentries after fsync of file that got its parent replaced
	btrfs: qgroup: Dirty all qgroups before rescan
	Btrfs: fix null pointer dereference on compressed write path error
	Btrfs: fix assertion on fsync of regular file when using no-holes feature
	btrfs: set max_extent_size properly
	btrfs: don't use ctl->free_space for max_extent_size
	btrfs: only free reserved extent if we didn't insert it
	btrfs: don't run delayed_iputs in commit
	btrfs: move the dio_sem higher up the callchain
	Btrfs: fix use-after-free during inode eviction
	Btrfs: fix use-after-free when dumping free space
	Btrfs: fix fsync after hole punching when using no-holes feature
	net: sched: Remove TCA_OPTIONS from policy
	bpf: wait for running BPF programs when updating map-in-map
	MD: fix invalid stored role for a disk - try2
	Linux 4.14.81

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

2 files changed, 29 insertions, 1 deletions

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 9801dc0250e2..e073099083ca 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3644,6 +3644,12 @@ int huge_add_to_page_cache(struct page *page, struct address_space *mapping,
 		return err;
 	ClearPagePrivate(page);
 
+	/*
+	 * set page dirty so that it will not be removed from cache/file
+	 * by non-hugetlbfs specific code paths.
+	 */
+	set_page_dirty(page);
+
 	spin_lock(&inode->i_lock);
 	inode->i_blocks += blocks_per_huge_page(h);
 	spin_unlock(&inode->i_lock);
diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
index 956015614395..e00d985a51c5 100644
--- a/mm/page_vma_mapped.c
+++ b/mm/page_vma_mapped.c
@@ -21,7 +21,29 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw)
 			if (!is_swap_pte(*pvmw->pte))
 				return false;
 		} else {
-			if (!pte_present(*pvmw->pte))
+			/*
+			 * We get here when we are trying to unmap a private
+			 * device page from the process address space. Such
+			 * page is not CPU accessible and thus is mapped as
+			 * a special swap entry, nonetheless it still does
+			 * count as a valid regular mapping for the page (and
+			 * is accounted as such in page maps count).
+			 *
+			 * So handle this special case as if it was a normal
+			 * page mapping ie lock CPU page table and returns
+			 * true.
+			 *
+			 * For more details on device private memory see HMM
+			 * (include/linux/hmm.h or mm/hmm.c).
+			 */
+			if (is_swap_pte(*pvmw->pte)) {
+				swp_entry_t entry;
+
+				/* Handle un-addressable ZONE_DEVICE memory */
+				entry = pte_to_swp_entry(*pvmw->pte);
+				if (!is_device_private_entry(entry))
+					return false;
+			} else if (!pte_present(*pvmw->pte))
 				return false;
 		}
 	}