https://source.android.com/security/bulletin/2019-09-01
CVE-2019-2181
CVE-2018-20669 (i915 driver/x86 only): fix not backported
Merge 4.9.191 into android-4.9-q

Changes in 4.9.191
	HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
	MIPS: kernel: only use i8253 clocksource with periodic clockevent
	netfilter: ebtables: fix a memory leak bug in compat
	ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
	bonding: Force slave speed check after link state recovery for 802.3ad
	can: dev: call netif_carrier_off() in register_candev()
	st21nfca_connectivity_event_received: null check the allocation
	st_nci_hci_connectivity_event_received: null check the allocation
	ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
	net: usb: qmi_wwan: Add the BroadMobi BM818 card
	isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain()
	isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack
	perf bench numa: Fix cpu0 binding
	can: sja1000: force the string buffer NULL-terminated
	can: peak_usb: force the string buffer NULL-terminated
	NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
	HID: input: fix a4tech horizontal wheel custom usage
	net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
	net: hisilicon: make hip04_tx_reclaim non-reentrant
	net: hisilicon: fix hip04-xmit never return TX_BUSY
	net: hisilicon: Fix dma_map_single failed on arm64
	libata: add SG safety checks in SFF pio transfers
	x86/lib/cpu: Address missing prototypes warning
	drm/vmwgfx: fix memory leak when too many retries have occurred
	perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
	selftests: kvm: Adding config fragments
	HID: wacom: correct misreported EKR ring values
	HID: wacom: Correct distance scale for 2nd-gen Intuos devices
	Revert "dm bufio: fix deadlock with loop device"
	gpiolib: never report open-drain/source lines as 'input' to user-space
	userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx
	x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386
	x86/apic: Handle missing global clockevent gracefully
	x86/boot: Save fields explicitly, zero out everything else
	x86/boot: Fix boot regression caused by bootparam sanitizing
	dm btree: fix order of block initialization in btree_split_beneath
	dm space map metadata: fix missing store of apply_bops() return value
	dm table: fix invalid memory accesses with too high sector number
	genirq: Properly pair kobject_del() with kobject_add()
	mm, page_owner: handle THP splits correctly
	mm/zsmalloc.c: migration can leave pages in ZS_EMPTY indefinitely
	xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT
	Revert "perf test 6: Fix missing kvm module load for s390"
	x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h
	dmaengine: ste_dma40: fix unneeded variable warning
	iommu/dma: Handle SG length overflow better
	usb: gadget: composite: Clear "suspended" on reset/disconnect
	xen/blkback: fix memory leaks
	i2c: emev2: avoid race when unregistering slave client
	usb: host: fotg2: restart hcd after port reset
	tools: hv: fix KVP and VSS daemons exit code
	watchdog: bcm2835_wdt: Fix module autoload
	scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
	tcp: fix tcp_rtx_queue_tail in case of empty retransmit queue
	ALSA: usb-audio: Fix a stack buffer overflow bug in check_input_term
	ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit
	tcp: make sure EPOLLOUT wont be missed
	ALSA: line6: Fix memory leak at line6_init_pcm() error path
	ALSA: seq: Fix potential concurrent access to the deleted pool
	KVM: x86: Don't update RIP or do single-step on faulting emulation
	x86/apic: Do not initialize LDR and DFR for bigsmp
	x86/apic: Include the LDR when clearing out APIC registers
	mm/zsmalloc.c: fix race condition in zs_destroy_pool
	usb-storage: Add new JMS567 revision to unusual_devs
	USB: cdc-wdm: fix race between write and disconnect due to flag abuse
	usb: chipidea: udc: don't do hardware access if gadget has stopped
	usb: host: ohci: fix a race condition between shutdown and irq
	usb: host: xhci: rcar: Fix typo in compatible string matching
	USB: storage: ums-realtek: Update module parameter description for auto_delink_en
	USB: storage: ums-realtek: Whitelist auto-delink support
	ptrace,x86: Make user_64bit_mode() available to 32-bit builds
	uprobes/x86: Fix detection of 32-bit user mode
	mmc: sdhci-of-at91: add quirk for broken HS200
	mmc: core: Fix init of SD cards reporting an invalid VDD range
	stm class: Fix a double free of stm_source_device
	VMCI: Release resource if the work is already queued
	Revert "cfg80211: fix processing world regdomain when non modular"
	mac80211: fix possible sta leak
	KVM: arm/arm64: vgic: Fix potential deadlock when ap_list is long
	KVM: arm/arm64: vgic-v2: Handle SGI bits in GICD_I{S,C}PENDR0 as WI
	i2c: piix4: Fix port selection for AMD Family 16h Model 30h
	x86/ptrace: fix up botched merge of spectrev1 fix
	mm/zsmalloc.c: fix build when CONFIG_COMPACTION=n
	Linux 4.9.191

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>