https://source.android.com/security/bulletin/2020-06-01
CVE-2020-8647
CVE-2020-8648
CVE-2020-8428
Merge 4.9.226 into android-4.9-p

Changes in 4.9.226
	ax25: fix setsockopt(SO_BINDTODEVICE)
	net: ipip: fix wrong address family in init error path
	net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()"
	net sched: fix reporting the first-time use timestamp
	sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
	net/mlx5e: Update netdev txq on completions during closure
	net: qrtr: Fix passing invalid reference to qrtr_local_enqueue()
	net/mlx5: Add command entry handling completion
	net: sun: fix missing release regions in cas_init_one().
	net/mlx4_core: fix a memory leak bug.
	uapi: fix linux/if_pppol2tp.h userspace compilation errors
	IB/cma: Fix reference count leak when no ipv4 addresses are set
	gpio: tegra: mask GPIO IRQs during IRQ shutdown
	net: microchip: encx24j600: add missed kthread_stop
	gfs2: move privileged user check to gfs2_quota_lock_check
	cachefiles: Fix race between read_waiter and read_copier involving op->to_do
	usb: gadget: legacy: fix redundant initialization warnings
	cifs: Fix null pointer check in cifs_read
	Input: usbtouchscreen - add support for BonXeon TP
	Input: evdev - call input_flush_device() on release(), not flush()
	Input: xpad - add custom init packet for Xbox One S controllers
	Input: i8042 - add ThinkPad S230u to i8042 reset list
	Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
	IB/qib: Call kobject_put() when kobject_init_and_add() fails
	ARM: dts: imx: Correct B850v3 clock assignment
	ARM: dts: imx6q-bx50v3: Add internal switch
	ARM: dts/imx6q-bx50v3: Set display interface clock parents
	ALSA: hwdep: fix a left shifting 1 by 31 UB bug
	ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
	exec: Always set cap_ambient in cap_bprm_set_creds
	libceph: ignore pool overlay and cache logic on redirects
	mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
	include/asm-generic/topology.h: guard cpumask_of_node() macro argument
	iommu: Fix reference count leak in iommu_group_alloc.
	parisc: Fix kernel panic in mem_init()
	mac80211: mesh: fix discovery timer re-arming issue / crash
	x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
	xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
	xfrm: fix a warning in xfrm_policy_insert_list
	xfrm: fix a NULL-ptr deref in xfrm_local_error
	vti4: eliminated some duplicate code.
	ip_vti: receive ipip packet by calling ip_tunnel_rcv
	netfilter: nft_reject_bridge: enable reject with bridge vlan
	netfilter: ipset: Fix subcounter update skip
	netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
	qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
	bonding: Fix reference count leak in bond_sysfs_slave_add.
	netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
	genirq/generic_pending: Do not lose pending affinity update
	net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
	mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
	sc16is7xx: move label 'err_spi' to correct section
	net: hns: Fixes the missing put_device in positive leg for roce reset
	scsi: zfcp: fix request object use-after-free in send path causing wrong traces
	Linux 4.9.226

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibf7f7fd24db67013204548089f127f0875de613e