https://source.android.com/security/bulletin/2020-05-01
CVE-2020-0110
CVE-2019-19536
Merge 4.14.178 into android-4.14-stable

Changes in 4.14.178
	ext4: fix extent_status fragmentation for plain files
	net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()
	net: ipv4: avoid unused variable warning for sysctl
	keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h
	drm/msm: Use the correct dma_sync calls harder
	crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static
	vti4: removed duplicate log message.
	watchdog: reset last_hw_keepalive time at start
	scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
	ceph: return ceph_mdsc_do_request() errors from __get_parent()
	ceph: don't skip updating wanted caps when cap is stale
	pwm: rcar: Fix late Runtime PM enablement
	scsi: iscsi: Report unbind session event when the target has been removed
	ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
	kernel/gcov/fs.c: gcov_seq_next() should increase position index
	selftests: kmod: fix handling test numbers above 9
	ipc/util.c: sysvipc_find_ipc() should increase position index
	s390/cio: avoid duplicated 'ADD' uevents
	pwm: renesas-tpu: Fix late Runtime PM enablement
	pwm: bcm2835: Dynamically allocate base
	perf/core: Disable page faults when getting phys address
	PCI/ASPM: Allow re-enabling Clock PM
	mm, slub: restore the original intention of prefetch_freepointer()
	cxgb4: fix large delays in PTP synchronization
	ipv6: fix restrict IPV6_ADDRFORM operation
	macsec: avoid to set wrong mtu
	macvlan: fix null dereference in macvlan_device_event()
	net: bcmgenet: correct per TX/RX ring statistics
	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
	net/x25: Fix x25_neigh refcnt leak when receiving frame
	tcp: cache line align MAX_TCP_HEADER
	team: fix hang in team_mode_get()
	net: dsa: b53: Fix ARL register definitions
	xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
	vrf: Check skb for XFRM_TRANSFORMED flag
	KEYS: Avoid false positive ENOMEM error on key read
	ALSA: hda: Remove ASUS ROG Zenith from the blacklist
	iio: adc: stm32-adc: fix sleep in atomic context
	iio: xilinx-xadc: Fix ADC-B powerdown
	iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
	iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
	fs/namespace.c: fix mountpoint reference counter race
	USB: sisusbvga: Change port variable from signed to unsigned
	USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
	USB: early: Handle AMD's spec-compliant identifiers, too
	USB: core: Fix free-while-in-use bug in the USB S-Glibrary
	USB: hub: Fix handling of connect changes during sleep
	overflow.h: Add arithmetic shift helper
	vmalloc: fix remap_vmalloc_range() bounds checks
	mm/hugetlb: fix a addressing exception caused by huge_pte_offset
	mm/ksm: fix NULL pointer dereference when KSM zero page is enabled
	tools/vm: fix cross-compile build
	ALSA: usx2y: Fix potential NULL dereference
	ALSA: hda/realtek - Add new codec supported for ALC245
	ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
	ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
	tpm/tpm_tis: Free IRQ if probing fails
	tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send()
	KVM: Check validity of resolved slot when searching memslots
	KVM: VMX: Enable machine check support for 32bit targets
	tty: hvc: fix buffer overflow during hvc_alloc().
	tty: rocket, avoid OOB access
	usb-storage: Add unusual_devs entry for JMicron JMS566
	audit: check the length of userspace generated audit records
	ASoC: dapm: fixup dapm kcontrol widget
	iwlwifi: pcie: actually release queue memory in TVQM
	ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
	powerpc/setup_64: Set cache-line-size based on cache-block-size
	staging: comedi: dt2815: fix writing hi byte of analog output
	staging: comedi: Fix comedi_device refcnt leak in comedi_open
	vt: don't hardcode the mem allocation upper bound
	staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default.
	staging: vt6656: Fix calling conditions of vnt_set_bss_mode
	staging: vt6656: Fix drivers TBTT timing counter.
	staging: vt6656: Fix pairwise key entry save.
	staging: vt6656: Power save stop wake_up_count wrap around.
	cdc-acm: close race betrween suspend() and acm_softint
	cdc-acm: introduce a cool down
	UAS: no use logging any details in case of ENODEV
	UAS: fix deadlock in error handling and PM flushing work
	usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
	serial: sh-sci: Make sure status register SCxSR is read in correct sequence
	xfs: validate sb_logsunit is a multiple of the fs blocksize
	xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT
	remoteproc: Fix wrong rvring index computation
	mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
	include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap
	binder: take read mode of mmap_sem in binder_alloc_free_page()
	usb: dwc3: gadget: Do link recovery for SS and SSP
	usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
	iio:ad7797: Use correct attribute_group
	nfsd: memory corruption in nfsd4_lock()
	i2c: altera: use proper variable to hold errno
	net/cxgb4: Check the return from t4_query_params properly
	ARM: dts: bcm283x: Disable dsi0 node
	perf/core: fix parent pid/tid in task exit events
	mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path
	bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
	x86: hyperv: report value of misc_features
	xfs: fix partially uninitialized structure in xfs_reflink_remap_extent
	scsi: target: fix PR IN / READ FULL STATUS for FC
	objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
	objtool: Support Clang non-section symbols in ORC dump
	xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
	arm64: Delete the space separator in __emit_inst
	ext4: use matching invalidatepage in ext4_writepage
	ext4: increase wait time needed before reuse of deleted inode numbers
	ext4: convert BUG_ON's to WARN_ON's in mballoc.c
	hwmon: (jc42) Fix name to have no illegal characters
	ext4: avoid declaring fs inconsistent due to invalid file handles
	ext4: protect journal inode's blocks using block_validity
	ext4: don't perform block validity checks on the journal inode
	ext4: fix block validity checks for journal inodes using indirect blocks
	ext4: unsigned int compared against zero
	qed: Fix use after free in qed_chain_free
	ext4: check for non-zero journal inum in ext4_calculate_overhead
	propagate_one(): mnt_set_mountpoint() needs mount_lock
	Linux 4.14.178

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia3d4a2b883413346daf1779820545cb0b0e35948