https://source.android.com/security/bulletin/2018-12-01

CVE-2018-9568
CVE-2018-10840
Merge 4.9.143 into android-4.9-o

Changes in 4.9.143
	mm/huge_memory: rename freeze_page() to unmap_page()
	mm/huge_memory.c: reorder operations in __split_huge_page_tail()
	mm/huge_memory: splitting set mapping+index before unfreeze
	mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
	mm/khugepaged: collapse_shmem() stop if punched or truncated
	shmem: shmem_charge: verify max_block is not exceeded before inode update
	shmem: introduce shmem_inode_acct_block
	mm/khugepaged: fix crashes due to misaccounted holes
	mm/khugepaged: collapse_shmem() remember to clear holes
	mm/khugepaged: minor reorderings in collapse_shmem()
	mm/khugepaged: collapse_shmem() without freezing new_page
	mm/khugepaged: collapse_shmem() do not crash on Compound
	media: em28xx: Fix use-after-free when disconnecting
	Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()"
	net: skb_scrub_packet(): Scrub offload_fwd_mark
	rapidio/rionet: do not free skb before reading its length
	s390/qeth: fix length check in SNMP processing
	usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
	kvm: mmu: Fix race in emulated page table writes
	kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
	KVM: X86: Fix scan ioapic use-before-initialization
	xtensa: enable coprocessors that are being flushed
	xtensa: fix coprocessor context offset definitions
	Btrfs: ensure path name is null terminated at btrfs_control_ioctl
	perf/x86/intel: Move branch tracing setup to the Intel-specific source file
	perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
	fs: fix lost error code in dio_complete
	ALSA: wss: Fix invalid snd_free_pages() at error path
	ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
	ALSA: control: Fix race between adding and removing a user element
	ALSA: sparc: Fix invalid snd_free_pages() at error path
	ext2: fix potential use after free
	dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
	dmaengine: at_hdmac: fix module unloading
	btrfs: release metadata before running delayed refs
	USB: usb-storage: Add new IDs to ums-realtek
	usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
	Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
	iio:st_magn: Fix enable device after trigger
	mm: use swp_offset as key in shmem_replace_page()
	Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
	misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
	efi/libstub: arm: support building with clang
	ARM: 8766/1: drop no-thumb-interwork in EABI mode
	ARM: 8767/1: add support for building ARM kernel with clang
	bus: arm-cci: remove unnecessary unreachable()
	ARM: trusted_foundations: do not use naked function
	workqueue: avoid clang warning
	efi/libstub: Make file I/O chunking x86-specific
	kbuild: Set KBUILD_CFLAGS before incl. arch Makefile
	Linux 4.9.143

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>