Xenial update: 4.4.223 upstream stable release

SRU Justification

    Impact:
       The upstream process for stable tree updates is quite similar
       in scope to the Ubuntu SRU process, e.g., each patch has to
       demonstrably fix a bug, and each patch is vetted by upstream
       by originating either directly from a mainline/stable Linux tree or
       a minimally backported form of that patch. The following upstream
       stable patches should be included in the Ubuntu kernel:

       4.4.223 upstream stable release
       from git://git.kernel.org/

The following patches from the 4.4.223 stable release shall be applied:
* mwifiex: fix PCIe register information for 8997 chipset
* drm/qxl: qxl_release use after free
* drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
* staging: rtl8192u: Fix crash due to pointers being "confusing"
* usb: gadget: f_acm: Fix configfs attr name
* usb: gadged: pch_udc: get rid of redundant assignments
* usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock
* usb: gadget: udc: core: don't starve DMA resources
* MIPS: Fix macro typo
* MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[]
* MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200
* MIPS: smp-cps: Stop printing EJTAG exceptions to UART
* MIPS: scall: Handle seccomp filters which redirect syscalls
* MIPS: BMIPS: BMIPS5000 has I cache filing from D cache
* MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier
* MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache
* MIPS: BMIPS: Pretty print BMIPS5200 processor name
* MIPS: Fix HTW config on XPA kernel without LPA enabled
* MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435
* MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
* MIPS: Fix BC1{EQ,NE}Z return offset calculation
* MIPS: perf: Fix I6400 event numbers
* MIPS: KVM: Fix translation of MFC0 ErrCtl
* MIPS: SMP: Update cpu_foreign_map on CPU disable
* MIPS: c-r4k: Fix protected_writeback_scache_line for EVA
* MIPS: Octeon: Off by one in octeon_irq_gpio_map()
* bpf, mips: fix off-by-one in ctx offset allocation
* MIPS: RM7000: Double locking bug in rm7k_tc_disable()
* MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
* mips/panic: replace smp_send_stop() with kdump friendly version in panic path
* ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
* ARM: imx: select SRC for i.MX7
* ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl
* ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl
* ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl
* ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl
* ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl
* ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl
* ARM: dts: kirkwood: use unique machine name for ds112
* ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile
* ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence
* perf/x86: Fix filter_events() bug with event mappings
* x86/LDT: Print the real LDT base address
* x86/apic/uv: Silence a shift wrapping warning
* ALSA: fm801: explicitly free IRQ line
* ALSA: fm801: propagate TUNER_ONLY bit when autodetected
* ALSA: fm801: detect FM-only card earlier
* netfilter: nfnetlink: use original skbuff when acking batches
* xfrm: fix crash in XFRM_MSG_GETSA netlink handler
* mwifiex: fix IBSS data path issue.
* mwifiex: add missing check for PCIe8997 chipset
* iwlwifi: set max firmware version of 7265 to 17
* Bluetooth: btmrvl: fix hung task warning dump
* dccp: limit sk_filter trim to payload
* net/mlx4_core: Do not BUG_ON during reset when PCI is offline
* mlxsw: pci: Correctly determine if descriptor queue is full
* PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()
* net/mlx4_core: Implement pci_resume callback
* alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO
* vfio/pci: Allow VPD short read
* brcmfmac: add eth_type_trans back for PCIe full dongle
* mlxsw: Treat local port 64 as valid
* IB/mlx4: Initialize hop_limit when creating address handle
* ovs/gre,geneve: fix error path when creating an iface
* GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
* powerpc/pci/of: Parse unassigned resources
* firmware: actually return NULL on failed request_firmware_nowait()
* c8sectpfe: Rework firmware loading mechanism
* net/mlx5: Avoid passing dma address 0 to firmware
* IB/mlx5: Fix RC transport send queue overhead computation
* net/mlx5: Make command timeout way shorter
* IB/mlx5: Fix FW version diaplay in sysfs
* net/mlx5e: Fix MLX5E_100BASE_T define
* net/mlx5: Fix the size of modify QP mailbox
* net/mlx5: Fix masking of reserved bits in XRCD number
* net/mlx5e: Fix blue flame quota logic
* net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create
* net/mlx5: Avoid calling sleeping function by the health poll thread
* net/mlx5: Fix wait_vital for VFs and remove fixed sleep
* net/mlx5: Fix potential deadlock in command mode change
* net/mlx5: Add timeout handle to commands with callback
* net/mlx5: Fix pci error recovery flow
* net/mlx5e: Copy all L2 headers into inline segment
* net_sched: keep backlog updated with qlen
* sch_drr: update backlog as well
* sch_hfsc: always keep backlog updated
* sch_prio: update backlog as well
* sch_qfq: keep backlog updated with qlen
* sch_sfb: keep backlog updated with qlen
* sch_tbf: update backlog as well
* btrfs: cleaner_kthread() doesn't need explicit freeze
* irda: Free skb on irda_accept error path.
* phy: fix device reference leaks
* bonding: prevent out of bound accesses
* mtd: nand: fix ONFI parameter page layout
* ath10k: free cached fw bin contents when get board id fails
* xprtrdma: checking for NULL instead of IS_ERR()
* xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)
* xprtrdma: xprt_rdma_free() must not release backchannel reqs
* xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len
* RDMA/cxgb3: device driver frees DMA memory with different size
* mlxsw: spectrum: Don't forward packets when STP state is DISABLED
* mlxsw: spectrum: Disable learning according to STP state
* mlxsw: spectrum: Don't count internal TX header bytes to stats
* mlxsw: spectrum: Indicate support for autonegotiation
* mlxsw: spectrum: Fix misuse of hard_header_len
* net: tcp_memcontrol: properly detect ancestor socket pressure
* tcp: do not set rtt_min to 1
* RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock
* net: ipv6: tcp reset, icmp need to consider L3 domain
* batman-adv: Fix lockdep annotation of batadv_tlv_container_remove
* batman-adv: replace WARN with rate limited output on non-existing VLAN
* tty: serial: msm: Support more bauds
* serial: samsung: Fix possible out of bounds access on non-DT platform
* Drivers: hv: utils: use memdup_user in hvt_op_write
* isa: Call isa_bus_init before dependent ISA bus drivers register
* Btrfs: clean up an error code in btrfs_init_space_info()
* Input: gpio-keys - fix check for disabling unsupported keys
* Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree
* net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key
* xfrm_user: propagate sec ctx allocation errors
* xfrm: Fix memory leak of aead algorithm name
* mac80211: fix mgmt-tx abort cookie and leak
* mac80211: TDLS: always downgrade invalid chandefs
* mac80211: TDLS: change BW calculation for WIDER_BW peers
* mac80211: Fix BW upgrade for TDLS peers
* NFS: Fix an LOCK/OPEN race when unlinking an open file
* net: get rid of an signed integer overflow in ip_idents_reserve()
* mtd: nand: denali: add missing nand_release() call in denali_remove()
* ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
* ASoC: tegra_alc5632: check return value
* ASoC: fsl_ssi: mark SACNT register volatile
* Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
* mmc: sdhci: restore behavior when setting VDD via external regulator
* mmc: sd: limit SD card power limit according to cards capabilities
* mmc: debugfs: correct wrong voltage value
* mmc: block: return error on failed mmc_blk_get()
* clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization"
* mmc: dw_mmc: rockchip: Set the drive phase properly
* mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type
* mmc: sdhci: Fix regression setting power on Trats2 board
* perf tools: Fix perf regs mask generation
* powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint()
* powerpc/book3s: Fix MCE console messages for unrecoverable MCE.
* sctp: fix the transports round robin issue when init is retransmitted
* sunrpc: Update RPCBIND_MAXNETIDLEN
* NFC: nci: memory leak in nci_core_conn_create()
* net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS
* net: phy: Fix phy_mac_interrupt()
* net: phy: bcm7xxx: Fix shadow mode 2 disabling
* of_mdio: fix node leak in of_phy_register_fixed_link error path
* phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.
* net: dsa: slave: fix of-node leak and phy priority
* drivers: net: cpsw: don't ignore phy-mode if phy-handle is used
* iommu/dma: Respect IOMMU aperture when allocating
* mdio-sun4i: oops in error handling in probe
* iio:ad7797: Use correct attribute_group
* selftests/ipc: Fix test failure seen after initial test run
* wimax/i2400m: Fix potential urb refcnt leak
* cifs: protect updating server->dstaddr with a spinlock
* scripts/config: allow colons in option strings for sed
* lib/mpi: Fix building for powerpc with clang
* net: bcmgenet: suppress warnings on failed Rx SKB allocations
* net: systemport: suppress warnings on failed Rx SKB allocations
* rc: allow rc modules to be loaded if rc-main is not a module
* lirc_imon: do not leave imon_probe() with mutex held
* am437x-vpfe: fix an uninitialized variable bug
* cx23885: uninitialized variable in cx23885_av_work_handler()
* ath9k_htc: check for underflow in ath9k_htc_rx_msg()
* VFIO: platform: reset: fix a warning message condition
* net: moxa: fix an error code
* mfd: lp8788-irq: Uninitialized variable in irq handler
* ethernet: micrel: fix some error codes
* power: ipaq-micro-battery: freeing the wrong variable
* i40e: fix an uninitialized variable bug
* qede: uninitialized variable in qede_start_xmit()
* qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template()
* qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag()
* target: Fix a memory leak in target_dev_lba_map_store()
* memory/tegra: Add number of TLB lines for Tegra124
* pinctrl: bcm2835: Fix memory leak in error path
* be2net: Don't leak iomapped memory on removal.
* ipv4: Fix memory leak in exception case for splitting tries
* flow_dissector: Check for IP fragmentation even if not using IPv4 address
* ipv4: fix checksum annotation in udp4_csum_init
* ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf()
* ipv4: accept u8 in IP_TOS ancillary data
* net: vrf: Fix dev refcnt leak due to IPv6 prefix route
* ipv6: fix checksum annotation in udp6_csum_init
* ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf()
* ipv6: add missing netconf notif when 'all' is updated
* net: ipv6: Fix processing of RAs in presence of VRF
* netfilter: nf_tables: fix a wrong check to skip the inactive rules
* netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled
* netfilter: nf_tables: destroy the set if fail to add transaction
* netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it
* udp: restore UDPlite many-cast delivery
* clk: st: avoid uninitialized variable use
* clk: gpio: handle error codes for of_clk_get_parent_count()
* clk: ti: omap3+: dpll: use non-locking version of clk_get_rate
* clk: multiplier: Prevent the multiplier from under / over flowing
* clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit
* clk: xgene: Don't call __pa on ioremaped address
* cls_bpf: reset class and reuse major in da
* arm64: bpf: jit JMP_JSET_{X,K}
* bpf, trace: check event type in bpf_perf_event_read
* bpf: fix map not being uncharged during map creation failure
* net/mlx4_core: Fix potential corruption in counters database
* net/mlx4_core: Fix access to uninitialized index
* net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill
* net/mlx4_core: Check device state before unregistering it
* net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec
* net/mlx4_en: Process all completions in RX rings after port goes up
* net/mlx4_core: Do not access comm channel if it has not yet been initialized
* net/mlx4_en: Fix potential deadlock in port statistics flow
* net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering
* net/mlx4_core: Fix QUERY FUNC CAP flags
* mlxsw: switchx2: Fix misuse of hard_header_len
* mlxsw: switchx2: Fix ethernet port initialization
* sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion
* net_sched: flower: Avoid dissection of unmasked keys
* pkt_sched: fq: use proper locking in fq_dump_stats()
* sched/preempt: Fix preempt_count manipulations
* power: bq27xxx: fix reading for bq27000 and bq27010
* power: bq27xxx: fix register numbers of bq27500
* power: test_power: correctly handle empty writes
* power: bq27xxx_battery: Fix bq27541 AveragePower register address
* power_supply: tps65217-charger: Fix NULL deref during property export
* net: vrf: Fix dst reference counting
* net: Don't delete routes in different VRFs
* vti6: fix input path
* ipv4: Fix table id reference in fib_sync_down_addr
* mlx4: do not call napi_schedule() without care
* xprtrdma: Fix backchannel allocation of extra rpcrdma_reps
* ALSA: fm801: Initialize chip after IRQ handler is registered
* bonding: fix length of actor system
* MIPS: perf: Remove incorrect odd/even counter handling for I6400
* Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT"
* net: dsa: mv88e6xxx: unlock DSA and CPU ports
* gfs2: fix flock panic issue
* blk-mq: fix undefined behaviour in order_to_size()
* dm: fix second blk_delay_queue() parameter to be in msec units not jiffies
* dmaengine: edma: Add probe callback to edma_tptc_driver
* openvswitch: update checksum in {push,pop}_mpls
* cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled
* net: bcmgenet: fix skb_len in bcmgenet_xmit_single()
* net: bcmgenet: device stats are unsigned long
* ovs/gre: fix rtnl notifications on iface deletion
* gre: do not assign header_ops in collect metadata mode
* gre: build header correctly for collect metadata tunnels
* gre: reject GUE and FOU in collect metadata mode
* sfc: fix potential stack corruption from running past stat bitmask
* sfc: clear napi_hash state when copying channels
* net: bcmsysport: Device stats are unsigned long
* cxgbi: fix uninitialized flowi6
* net: macb: add missing free_netdev() on error in macb_probe()
* macvtap: segmented packet is consumed
* tipc: fix the error handling in tipc_udp_enable()
* net: icmp6_send should use dst dev to determine L3 domain
* et131x: Fix logical vs bitwise check in et131x_tx_timeout()
* net: ethernet: stmmac: dwmac-sti: fix probe error path
* rtnl: reset calcit fptr in rtnl_unregister()
* net: ethernet: stmmac: dwmac-rk: fix probe error path
* fq_codel: return non zero qlen in class dumps
* net: ethernet: stmmac: dwmac-generic: fix probe error path
* ovs/geneve: fix rtnl notifications on iface deletion
* bnxt: add a missing rcu synchronization
* qdisc: fix a module refcount leak in qdisc_create_dflt()
* net: axienet: Fix return value check in axienet_probe()
* bnxt_en: Remove locking around txr->dev_state
* net: ethernet: davinci_emac: Fix devioctl while in fixed link
* net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented
* net: ethernet: ti: cpsw: fix device and of_node leaks
* net: ethernet: ti: cpsw: fix secondary-emac probe error path
* net: hns: fix device reference leaks
* net: bridge: don't increment tx_dropped in br_do_proxy_arp
* net: dsa: mv88e6xxx: enable SA learning on DSA ports
* net: ehea: avoid null pointer dereference
* l2tp: fix use-after-free during module unload
* hwrng: exynos - Disable runtime PM on driver unbind
* net: icmp_route_lookup should use rt dev to determine L3 domain
* net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats
* net: macb: replace macb_writel() call by queue_writel() to update queue ISR
* ravb: Add missing free_irq() call to ravb_close()
* mvpp2: use correct size for memset
* net: vxlan: lwt: Fix vxlan local traffic.
* net: ethoc: Fix early error paths
* ovs/vxlan: fix rtnl notifications on iface deletion
* net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
* regulator: core: Rely on regulator_dev_release to free constraints
* net: dsa: mv88e6xxx: fix port VLAN maps
* at803x: fix reset handling
* cxl: Fix DAR check & use REGION_ID instead of opencoding
* net: ethernet: davinci_emac: Fix platform_data overwrite
* ata: sata_dwc_460ex: remove incorrect locking
* pinctrl: tegra: Correctly check the supported configuration
* brcmfmac: add fallback for devices that do not report per-chain values
* brcmfmac: restore stopping netdev queue when bus clogs up
* bridge: Fix problems around fdb entries pointing to the bridge device
* bna: add missing per queue ethtool stat
* net: skbuff: Remove errornous length validation in skb_vlan_pop()
* net: ep93xx_eth: Do not crash unloading module
* macvlan: Fix potential use-after free for broadcasts
* sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
* ALSA: hda: Match both PCI ID and SSID for driver blacklist
* mac80211: add ieee80211_is_any_nullfunc()
* Linux 4.4.223