--- /dev/null
+From 40f7090bb1b4ec327ea1e1402ff5783af5b35195 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Tue, 22 May 2018 17:19:57 -0700
+Subject: Input: elan_i2c_smbus - fix corrupted stack
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 40f7090bb1b4ec327ea1e1402ff5783af5b35195 upstream.
+
+New ICs (like the one on the Lenovo T480s) answer to
+ETP_SMBUS_IAP_VERSION_CMD 4 bytes instead of 3. This corrupts the stack
+as i2c_smbus_read_block_data() uses the values returned by the i2c
+device to know how many data it need to return.
+
+i2c_smbus_read_block_data() can read up to 32 bytes (I2C_SMBUS_BLOCK_MAX)
+and there is no safeguard on how many bytes are provided in the return
+value. Ensure we always have enough space for any future firmware.
+Also 0-initialize the values to prevent any access to uninitialized memory.
+
+Cc: <stable@vger.kernel.org> # v4.4.x, v4.9.x, v4.14.x, v4.15.x, v4.16.x
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: KT Liao <kt.liao@emc.com.tw>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elan_i2c_smbus.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/input/mouse/elan_i2c_smbus.c
++++ b/drivers/input/mouse/elan_i2c_smbus.c
+@@ -130,7 +130,7 @@ static int elan_smbus_get_baseline_data(
+ bool max_baseline, u8 *value)
+ {
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ error = i2c_smbus_read_block_data(client,
+ max_baseline ?
+@@ -149,7 +149,7 @@ static int elan_smbus_get_version(struct
+ bool iap, u8 *version)
+ {
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ error = i2c_smbus_read_block_data(client,
+ iap ? ETP_SMBUS_IAP_VERSION_CMD :
+@@ -170,7 +170,7 @@ static int elan_smbus_get_sm_version(str
+ u8 *clickpad)
+ {
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ error = i2c_smbus_read_block_data(client,
+ ETP_SMBUS_SM_VERSION_CMD, val);
+@@ -188,7 +188,7 @@ static int elan_smbus_get_sm_version(str
+ static int elan_smbus_get_product_id(struct i2c_client *client, u16 *id)
+ {
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ error = i2c_smbus_read_block_data(client,
+ ETP_SMBUS_UNIQUEID_CMD, val);
+@@ -205,7 +205,7 @@ static int elan_smbus_get_checksum(struc
+ bool iap, u16 *csum)
+ {
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ error = i2c_smbus_read_block_data(client,
+ iap ? ETP_SMBUS_FW_CHECKSUM_CMD :
+@@ -226,7 +226,7 @@ static int elan_smbus_get_max(struct i2c
+ {
+ int ret;
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD, val);
+ if (ret != 3) {
+@@ -246,7 +246,7 @@ static int elan_smbus_get_resolution(str
+ {
+ int ret;
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD, val);
+ if (ret != 3) {
+@@ -267,7 +267,7 @@ static int elan_smbus_get_num_traces(str
+ {
+ int ret;
+ int error;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD, val);
+ if (ret != 3) {
+@@ -294,7 +294,7 @@ static int elan_smbus_iap_get_mode(struc
+ {
+ int error;
+ u16 constant;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD, val);
+ if (error < 0) {
+@@ -345,7 +345,7 @@ static int elan_smbus_prepare_fw_update(
+ int len;
+ int error;
+ enum tp_mode mode;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ u8 cmd[4] = {0x0F, 0x78, 0x00, 0x06};
+ u16 password;
+
+@@ -419,7 +419,7 @@ static int elan_smbus_write_fw_block(str
+ struct device *dev = &client->dev;
+ int error;
+ u16 result;
+- u8 val[3];
++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+
+ /*
+ * Due to the limitation of smbus protocol limiting
--- /dev/null
+From 5717a09aeaf62d197deba1fc7ccd6bc45f3a9dcc Mon Sep 17 00:00:00 2001
+From: Aaron Ma <aaron.ma@canonical.com>
+Date: Sat, 3 Feb 2018 11:49:22 -0800
+Subject: Input: synaptics - add Intertouch support on X1 Carbon 6th and X280
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+commit 5717a09aeaf62d197deba1fc7ccd6bc45f3a9dcc upstream.
+
+Synaptics devices reported it has Intertouch support,
+and it fails via PS/2 as following logs:
+
+psmouse serio2: Failed to reset mouse on synaptics-pt/serio0
+psmouse serio2: Failed to enable mouse on synaptics-pt/serio0
+
+Set these new devices to use SMBus to fix this issue, then they report
+SMBus version 3 is using, patch:
+https://patchwork.kernel.org/patch/9989547/ enabled SMBus ver 3 and
+makes synaptics devices work fine on SMBus mode.
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -174,6 +174,8 @@ static const char * const smbus_pnp_ids[
+ "LEN004a", /* W541 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
++ "LEN0092", /* X1 Carbon 6 */
++ "LEN0096", /* X280 */
+ "LEN200f", /* T450s */
+ NULL
+ };
--- /dev/null
+From ad8fb554f04e38f155c9bc34bbf521fc592ceee7 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Tue, 22 May 2018 17:16:08 -0700
+Subject: Input: synaptics - add Lenovo 80 series ids to SMBus
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit ad8fb554f04e38f155c9bc34bbf521fc592ceee7 upstream.
+
+This time, Lenovo decided to go with different pieces in its latest
+series of Thinkpads.
+
+For those we have been able to test:
+- the T480 is using Synaptics with an IBM trackpoint
+ -> it behaves properly with or without intertouch, there is no point
+ not using RMI4
+- the X1 Carbon 6th gen is using Synaptics with an IBM trackpoint
+ -> the touchpad doesn't behave properly under PS/2 so we have to
+ switch it to RMI4 if we do not want to have disappointed users
+- the X280 is using Synaptics with an ALPS trackpoint
+ -> the recent fixes in the trackpoint handling fixed it so upstream
+ now works fine with or without RMI4, and there is no point not
+ using RMI4
+- the T480s is using an Elan touchpad, so that's a different story
+
+Cc: <stable@vger.kernel.org> # v4.14.x, v4.15.x, v4.16.x
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: KT Liao <kt.liao@emc.com.tw>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -172,10 +172,12 @@ static const char * const smbus_pnp_ids[
+ "LEN0048", /* X1 Carbon 3 */
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
++ "LEN0071", /* T480 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN0073", /* X1 Carbon G5 (Elantech) */
+ "LEN0092", /* X1 Carbon 6 */
+ "LEN0096", /* X280 */
++ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
+ NULL
+ };
--- /dev/null
+From 9b2071028f8def49971a3b213ab6efd02a7e56e8 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Fri, 18 Aug 2017 12:08:13 -0700
+Subject: Input: synaptics - Lenovo Carbon X1 Gen5 (2017) devices should use RMI
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 9b2071028f8def49971a3b213ab6efd02a7e56e8 upstream.
+
+The touchpad on Lenovo Carbon X1 Gen 5 (2017 - Kabylake) is accessible over
+SMBUS/RMI, so let's activate it by default.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -172,6 +172,7 @@ static const char * const smbus_pnp_ids[
+ "LEN0048", /* X1 Carbon 3 */
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
++ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
+ "LEN200f", /* T450s */
+ NULL
+ };
--- /dev/null
+From 15e2cffec3aa0d47a8d75ae80e1b136bfb5dff30 Mon Sep 17 00:00:00 2001
+From: Edvard Holst <edvard.holst@gmail.com>
+Date: Sat, 3 Feb 2018 11:46:15 -0800
+Subject: Input: synaptics - Lenovo Thinkpad X1 Carbon G5 (2017) with Elantech trackpoints should use RMI
+
+From: Edvard Holst <edvard.holst@gmail.com>
+
+commit 15e2cffec3aa0d47a8d75ae80e1b136bfb5dff30 upstream.
+
+Lenovo use two different trackpoints in the fifth generation Thinkpad X1
+Carbon. Both are accessible over SMBUS/RMI but the pnpIDs are missing.
+This patch is for the Elantech trackpoint specifically which also
+reports SMB version 3 so rmi_smbus needs to be updated in order to
+handle it.
+
+For the record, I was not the first one to come up with this patch as it
+has been floating around the internet for a while now. However, I have
+spent significant time with testing and my efforts to find the original
+author of the patch have been unsuccessful.
+
+Signed-off-by: Edvard Holst <edvard.holst@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -173,6 +173,7 @@ static const char * const smbus_pnp_ids[
+ "LEN0046", /* X250 */
+ "LEN004a", /* W541 */
+ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */
++ "LEN0073", /* X1 Carbon G5 (Elantech) */
+ "LEN200f", /* T450s */
+ NULL
+ };
--- /dev/null
+From efe3de79e0b52ca281ef6691480c8c68c82a4657 Mon Sep 17 00:00:00 2001
+From: Sachin Grover <sgrover@codeaurora.org>
+Date: Fri, 25 May 2018 14:01:39 +0530
+Subject: selinux: KASAN: slab-out-of-bounds in xattr_getsecurity
+
+From: Sachin Grover <sgrover@codeaurora.org>
+
+commit efe3de79e0b52ca281ef6691480c8c68c82a4657 upstream.
+
+Call trace:
+ [<ffffff9203a8d7a8>] dump_backtrace+0x0/0x428
+ [<ffffff9203a8dbf8>] show_stack+0x28/0x38
+ [<ffffff920409bfb8>] dump_stack+0xd4/0x124
+ [<ffffff9203d187e8>] print_address_description+0x68/0x258
+ [<ffffff9203d18c00>] kasan_report.part.2+0x228/0x2f0
+ [<ffffff9203d1927c>] kasan_report+0x5c/0x70
+ [<ffffff9203d1776c>] check_memory_region+0x12c/0x1c0
+ [<ffffff9203d17cdc>] memcpy+0x34/0x68
+ [<ffffff9203d75348>] xattr_getsecurity+0xe0/0x160
+ [<ffffff9203d75490>] vfs_getxattr+0xc8/0x120
+ [<ffffff9203d75d68>] getxattr+0x100/0x2c8
+ [<ffffff9203d76fb4>] SyS_fgetxattr+0x64/0xa0
+ [<ffffff9203a83f70>] el0_svc_naked+0x24/0x28
+
+If user get root access and calls security.selinux setxattr() with an
+embedded NUL on a file and then if some process performs a getxattr()
+on that file with a length greater than the actual length of the string,
+it would result in a panic.
+
+To fix this, add the actual length of the string to the security context
+instead of the length passed by the userspace process.
+
+Signed-off-by: Sachin Grover <sgrover@codeaurora.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/selinux/ss/services.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -1448,7 +1448,7 @@ static int security_context_to_sid_core(
+ scontext_len, &context, def_sid);
+ if (rc == -EINVAL && force) {
+ context.str = str;
+- context.len = scontext_len;
++ context.len = strlen(str) + 1;
+ str = NULL;
+ } else if (rc)
+ goto out_unlock;
pci-hv-fix-2-hang-issues-in-hv_compose_msi_msg.patch
xfs-convert-xfs_agfl_size-to-a-helper-function.patch
xfs-detect-agfl-count-corruption-and-reset-agfl.patch
+input-synaptics-lenovo-carbon-x1-gen5-2017-devices-should-use-rmi.patch
+input-synaptics-lenovo-thinkpad-x1-carbon-g5-2017-with-elantech-trackpoints-should-use-rmi.patch
+input-synaptics-add-intertouch-support-on-x1-carbon-6th-and-x280.patch
+input-synaptics-add-lenovo-80-series-ids-to-smbus.patch
+input-elan_i2c_smbus-fix-corrupted-stack.patch
+tracing-fix-crash-when-freeing-instances-with-event-triggers.patch
+tracing-make-the-snapshot-trigger-work-with-instances.patch
+selinux-kasan-slab-out-of-bounds-in-xattr_getsecurity.patch
--- /dev/null
+From 86b389ff22bd6ad8fd3cb98e41cd271886c6d023 Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Sun, 27 May 2018 20:54:44 -0400
+Subject: tracing: Fix crash when freeing instances with event triggers
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 86b389ff22bd6ad8fd3cb98e41cd271886c6d023 upstream.
+
+If a instance has an event trigger enabled when it is freed, it could cause
+an access of free memory. Here's the case that crashes:
+
+ # cd /sys/kernel/tracing
+ # mkdir instances/foo
+ # echo snapshot > instances/foo/events/initcall/initcall_start/trigger
+ # rmdir instances/foo
+
+Would produce:
+
+ general protection fault: 0000 [#1] PREEMPT SMP PTI
+ Modules linked in: tun bridge ...
+ CPU: 5 PID: 6203 Comm: rmdir Tainted: G W 4.17.0-rc4-test+ #933
+ Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016
+ RIP: 0010:clear_event_triggers+0x3b/0x70
+ RSP: 0018:ffffc90003783de0 EFLAGS: 00010286
+ RAX: 0000000000000000 RBX: 6b6b6b6b6b6b6b2b RCX: 0000000000000000
+ RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800c7130ba0
+ RBP: ffffc90003783e00 R08: ffff8801131993f8 R09: 0000000100230016
+ R10: ffffc90003783d80 R11: 0000000000000000 R12: ffff8800c7130ba0
+ R13: ffff8800c7130bd8 R14: ffff8800cc093768 R15: 00000000ffffff9c
+ FS: 00007f6f4aa86700(0000) GS:ffff88011eb40000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f6f4a5aed60 CR3: 00000000cd552001 CR4: 00000000001606e0
+ Call Trace:
+ event_trace_del_tracer+0x2a/0xc5
+ instance_rmdir+0x15c/0x200
+ tracefs_syscall_rmdir+0x52/0x90
+ vfs_rmdir+0xdb/0x160
+ do_rmdir+0x16d/0x1c0
+ __x64_sys_rmdir+0x17/0x20
+ do_syscall_64+0x55/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+This was due to the call the clears out the triggers when an instance is
+being deleted not removing the trigger from the link list.
+
+Cc: stable@vger.kernel.org
+Fixes: 85f2b08268c01 ("tracing: Add basic event trigger framework")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace_events_trigger.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -482,9 +482,10 @@ clear_event_triggers(struct trace_array
+ struct trace_event_file *file;
+
+ list_for_each_entry(file, &tr->events, list) {
+- struct event_trigger_data *data;
+- list_for_each_entry_rcu(data, &file->triggers, list) {
++ struct event_trigger_data *data, *n;
++ list_for_each_entry_safe(data, n, &file->triggers, list) {
+ trace_event_trigger_enable_disable(file, 0);
++ list_del_rcu(&data->list);
+ if (data->ops->free)
+ data->ops->free(data->ops, data);
+ }
--- /dev/null
+From 2824f5033248600673e3e126a4d135363cbfd9ac Mon Sep 17 00:00:00 2001
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Mon, 28 May 2018 10:56:36 -0400
+Subject: tracing: Make the snapshot trigger work with instances
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+commit 2824f5033248600673e3e126a4d135363cbfd9ac upstream.
+
+The snapshot trigger currently only affects the main ring buffer, even when
+it is used by the instances. This can be confusing as the snapshot trigger
+is listed in the instance.
+
+ > # cd /sys/kernel/tracing
+ > # mkdir instances/foo
+ > # echo snapshot > instances/foo/events/syscalls/sys_enter_fchownat/trigger
+ > # echo top buffer > trace_marker
+ > # echo foo buffer > instances/foo/trace_marker
+ > # touch /tmp/bar
+ > # chown rostedt /tmp/bar
+ > # cat instances/foo/snapshot
+ # tracer: nop
+ #
+ #
+ # * Snapshot is freed *
+ #
+ # Snapshot commands:
+ # echo 0 > snapshot : Clears and frees snapshot buffer
+ # echo 1 > snapshot : Allocates snapshot buffer, if not already allocated.
+ # Takes a snapshot of the main buffer.
+ # echo 2 > snapshot : Clears snapshot buffer (but does not allocate or free)
+ # (Doesn't have to be '2' works with any number that
+ # is not a '0' or '1')
+
+ > # cat snapshot
+ # tracer: nop
+ #
+ # _-----=> irqs-off
+ # / _----=> need-resched
+ # | / _---=> hardirq/softirq
+ # || / _--=> preempt-depth
+ # ||| / delay
+ # TASK-PID CPU# |||| TIMESTAMP FUNCTION
+ # | | | |||| | |
+ bash-1189 [000] .... 111.488323: tracing_mark_write: top buffer
+
+Not only did the snapshot occur in the top level buffer, but the instance
+snapshot buffer should have been allocated, and it is still free.
+
+Cc: stable@vger.kernel.org
+Fixes: 85f2b08268c01 ("tracing: Add basic event trigger framework")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/trace.c | 12 ++++++------
+ kernel/trace/trace.h | 11 +++++++++++
+ kernel/trace/trace_events_trigger.c | 10 ++++++++--
+ 3 files changed, 25 insertions(+), 8 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -894,7 +894,7 @@ int __trace_bputs(unsigned long ip, cons
+ EXPORT_SYMBOL_GPL(__trace_bputs);
+
+ #ifdef CONFIG_TRACER_SNAPSHOT
+-static void tracing_snapshot_instance(struct trace_array *tr)
++void tracing_snapshot_instance(struct trace_array *tr)
+ {
+ struct tracer *tracer = tr->current_trace;
+ unsigned long flags;
+@@ -950,7 +950,7 @@ static int resize_buffer_duplicate_size(
+ struct trace_buffer *size_buf, int cpu_id);
+ static void set_buffer_entries(struct trace_buffer *buf, unsigned long val);
+
+-static int alloc_snapshot(struct trace_array *tr)
++int tracing_alloc_snapshot_instance(struct trace_array *tr)
+ {
+ int ret;
+
+@@ -996,7 +996,7 @@ int tracing_alloc_snapshot(void)
+ struct trace_array *tr = &global_trace;
+ int ret;
+
+- ret = alloc_snapshot(tr);
++ ret = tracing_alloc_snapshot_instance(tr);
+ WARN_ON(ret < 0);
+
+ return ret;
+@@ -5400,7 +5400,7 @@ static int tracing_set_tracer(struct tra
+
+ #ifdef CONFIG_TRACER_MAX_TRACE
+ if (t->use_max_tr && !had_max_tr) {
+- ret = alloc_snapshot(tr);
++ ret = tracing_alloc_snapshot_instance(tr);
+ if (ret < 0)
+ goto out;
+ }
+@@ -6378,7 +6378,7 @@ tracing_snapshot_write(struct file *filp
+ }
+ #endif
+ if (!tr->allocated_snapshot) {
+- ret = alloc_snapshot(tr);
++ ret = tracing_alloc_snapshot_instance(tr);
+ if (ret < 0)
+ break;
+ }
+@@ -7099,7 +7099,7 @@ ftrace_trace_snapshot_callback(struct tr
+ return ret;
+
+ out_reg:
+- ret = alloc_snapshot(tr);
++ ret = tracing_alloc_snapshot_instance(tr);
+ if (ret < 0)
+ goto out;
+
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -1807,6 +1807,17 @@ static inline void __init trace_event_in
+ static inline void trace_event_eval_update(struct trace_eval_map **map, int len) { }
+ #endif
+
++#ifdef CONFIG_TRACER_SNAPSHOT
++void tracing_snapshot_instance(struct trace_array *tr);
++int tracing_alloc_snapshot_instance(struct trace_array *tr);
++#else
++static inline void tracing_snapshot_instance(struct trace_array *tr) { }
++static inline int tracing_alloc_snapshot_instance(struct trace_array *tr)
++{
++ return 0;
++}
++#endif
++
+ extern struct trace_iterator *tracepoint_print_iter;
+
+ #endif /* _LINUX_KERNEL_TRACE_H */
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -642,6 +642,7 @@ event_trigger_callback(struct event_comm
+ trigger_data->count = -1;
+ trigger_data->ops = trigger_ops;
+ trigger_data->cmd_ops = cmd_ops;
++ trigger_data->private_data = file;
+ INIT_LIST_HEAD(&trigger_data->list);
+ INIT_LIST_HEAD(&trigger_data->named_list);
+
+@@ -1042,7 +1043,12 @@ static struct event_command trigger_trac
+ static void
+ snapshot_trigger(struct event_trigger_data *data, void *rec)
+ {
+- tracing_snapshot();
++ struct trace_event_file *file = data->private_data;
++
++ if (file)
++ tracing_snapshot_instance(file->tr);
++ else
++ tracing_snapshot();
+ }
+
+ static void
+@@ -1064,7 +1070,7 @@ register_snapshot_trigger(char *glob, st
+ {
+ int ret = register_trigger(glob, ops, data, file);
+
+- if (ret > 0 && tracing_alloc_snapshot() != 0) {
++ if (ret > 0 && tracing_alloc_snapshot_instance(file->tr) != 0) {
+ unregister_trigger(glob, ops, data, file);
+ ret = 0;
+ }