https://source.android.com/security/bulletin/2018-07-01
CVE-2018-9422
CVE-2018-9417
CVE-2018-6927
CVE-2018-9416
CVE-2018-9415
CVE-2018-9415
CVE-2018-7995
CVE-2018-1065
CVE-2017-18218
CVE-2017-1000112
Not included:
CVE-2018-5703 : Skipped due to fix rejected upstream
Merge 3.18.114 into android-3.18
Changes in 3.18.114
tools build: No need to make libapi for perf explicitly
tools build: Fix Makefile(s) to properly invoke tools build
af_key: Always verify length of provided sadb_key
fsnotify: fix ignore mask logic in send_to_group()
MIPS: io: Add barrier after register read in readX()
s390/smsgiucv: disable SMSG on module unload
isofs: fix potential memory leak in mount option parsing
scsi: iscsi: respond to netlink with unicast when appropriate
drm/msm: Fix possible null dereference on failure of get_pages()
parisc: time: Convert read_persistent_clock() to read_persistent_clock64()
scsi: isci: Fix infinite loop in while loop
net: phy: marvell: clear wol event before setting it
arm64: ptrace: remove addr_limit manipulation
selftests: ftrace: Add a testcase for multiple actions on trigger
rds: ib: Fix missing call to rds_ib_dev_put in rds_ib_setup_qp
x86/cpu/intel: Add missing TLB cpuid values
bpf: fix uninitialized variable in bpf tools
ARM: davinci: board-dm355-evm: fix broken networking
hexagon: add memset_io() helper
hexagon: export csum_partial_copy_nocheck
scsi: vmw-pvscsi: return DID_BUS_BUSY for adapter-initated aborts
kthread, sched/wait: Fix kthread_parkme() wait-loop
mac80211: Adjust SAE authentication timeout
drm/omap: fix possible NULL ref issue in tiler_reserve_2d
driver core: add __printf verification to __ata_ehi_pushv_desc
can: dev: increase bus-off message severity
agp: uninorth: make two functions static
usb: musb: fix remote wakeup racing with suspend
ARM: keystone: fix platform_domain_notifier array overrun
i2c: pmcmsp: return message count on master_xfer success
i2c: pmcmsp: fix error return from master_xfer
i2c: viperboard: return message count on master_xfer success
ARM: davinci: board-dm646x-evm: set VPIF capture card name
ARM: 8753/1: decompressor: add a missing parameter to the addruart macro
tcp: do not overshoot window_clamp in tcp_rcv_space_adjust()
ext4: update mtime in ext4_punch_hole even if no blocks are released
ext4: fix fencepost error in check for inode count overflow during resize
btrfs: scrub: Don't use inode pages for device replace
ALSA: hda - Handle kzalloc() failure in snd_hda_attach_pcm_stream()
libata: zpodd: make arrays cdb static, reduces object code size
libata: zpodd: small read overflow in eject_tray()
libata: Drop SanDisk SD7UB3Q*G1001 NOLPM quirk
w1: mxc_w1: Enable clock before calling clk_get_rate() on it
fs/binfmt_misc.c: do not allow offset overflow
m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
usb: do not reset if a low-speed or full-speed device timed out
ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it
ASoC: cirrus: i2s: Fix LRCLK configuration
ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup
mips: ftrace: fix static function graph tracing
branch-check: fix long->int truncation when profiling branches
ipmi:bt: Set the timeout before doing a capabilities check
fuse: atomic_o_trunc should truncate pagecache
fuse: don't keep dead fuse_conn at fuse_fill_super().
powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch
powerpc/ptrace: Fix setting 512B aligned breakpoints with PTRACE_SET_DEBUGREG
powerpc/ptrace: Fix enforcement of DAWR constraints
powerpc/fadump: Unregister fadump on kexec down path.
ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size
mtd: cfi_cmdset_0002: Change write buffer to check correct value
mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()
mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips
mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary
mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.
MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum
PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on resume
MIPS: io: Add barrier after register read in inX()
time: Make sure jiffies_to_msecs() preserves non-zero time periods
scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
UBIFS: Fix potential integer overflow in allocation
backlight: as3711_bl: Fix Device Tree node lookup
backlight: max8925_bl: Fix Device Tree node lookup
backlight: tps65217_bl: Fix Device Tree node lookup
media: v4l2-compat-ioctl32: prevent go past max size
media: cx231xx: Add support for AverMedia DVD EZMaker 7
media: dvb_frontend: fix locking issues at dvb_frontend_get_event()
nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
video: uvesafb: Fix integer overflow in allocation
xen: Remove unnecessary BUG_ON from __unbind_from_irq()
udf: Detect incorrect directory size
block: Fix transfer when chunk sectors exceeds max
dm thin: handle running out of data space vs concurrent discard
Linux 3.18.114
Change-Id: Ifb8e6127d28dc8d13e8ac8de2bafb1888f49d688
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>