https://source.android.com/security/bulletin/2020-05-01
CVE-2020-0110
CVE-2019-19536
Merge 4.9.221 into android-4.9-q

Changes in 4.9.221
	ext4: fix extent_status fragmentation for plain files
	net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()
	net: ipv4: avoid unused variable warning for sysctl
	drm/msm: Use the correct dma_sync calls harder
	crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static
	vti4: removed duplicate log message.
	watchdog: reset last_hw_keepalive time at start
	scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login
	ceph: return ceph_mdsc_do_request() errors from __get_parent()
	ceph: don't skip updating wanted caps when cap is stale
	pwm: rcar: Fix late Runtime PM enablement
	scsi: iscsi: Report unbind session event when the target has been removed
	ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map()
	kernel/gcov/fs.c: gcov_seq_next() should increase position index
	ipc/util.c: sysvipc_find_ipc() should increase position index
	s390/cio: avoid duplicated 'ADD' uevents
	pwm: renesas-tpu: Fix late Runtime PM enablement
	pwm: bcm2835: Dynamically allocate base
	PCI/ASPM: Allow re-enabling Clock PM
	ipv6: fix restrict IPV6_ADDRFORM operation
	macsec: avoid to set wrong mtu
	macvlan: fix null dereference in macvlan_device_event()
	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node
	net/x25: Fix x25_neigh refcnt leak when receiving frame
	tcp: cache line align MAX_TCP_HEADER
	team: fix hang in team_mode_get()
	net: dsa: b53: Fix ARL register definitions
	xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
	ALSA: hda: Remove ASUS ROG Zenith from the blacklist
	iio: xilinx-xadc: Fix ADC-B powerdown
	iio: xilinx-xadc: Fix clearing interrupt when enabling trigger
	iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode
	fs/namespace.c: fix mountpoint reference counter race
	USB: sisusbvga: Change port variable from signed to unsigned
	USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE
	USB: core: Fix free-while-in-use bug in the USB S-Glibrary
	USB: hub: Fix handling of connect changes during sleep
	overflow.h: Add arithmetic shift helper
	vmalloc: fix remap_vmalloc_range() bounds checks
	ALSA: usx2y: Fix potential NULL dereference
	ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif
	ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices
	tpm/tpm_tis: Free IRQ if probing fails
	KVM: Check validity of resolved slot when searching memslots
	KVM: VMX: Enable machine check support for 32bit targets
	tty: hvc: fix buffer overflow during hvc_alloc().
	tty: rocket, avoid OOB access
	usb-storage: Add unusual_devs entry for JMicron JMS566
	audit: check the length of userspace generated audit records
	ASoC: dapm: fixup dapm kcontrol widget
	ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y
	staging: comedi: dt2815: fix writing hi byte of analog output
	staging: comedi: Fix comedi_device refcnt leak in comedi_open
	staging: vt6656: Fix drivers TBTT timing counter.
	staging: vt6656: Power save stop wake_up_count wrap around.
	UAS: no use logging any details in case of ENODEV
	UAS: fix deadlock in error handling and PM flushing work
	usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset()
	remoteproc: Fix wrong rvring index computation
	fuse: fix possibly missed wake-up after abort
	mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer
	usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete
	nfsd: memory corruption in nfsd4_lock()
	net/cxgb4: Check the return from t4_query_params properly
	perf/core: fix parent pid/tid in task exit events
	bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B
	xfs: fix partially uninitialized structure in xfs_reflink_remap_extent
	scsi: target: fix PR IN / READ FULL STATUS for FC
	objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings
	objtool: Support Clang non-section symbols in ORC dump
	xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
	ext4: convert BUG_ON's to WARN_ON's in mballoc.c
	hwmon: (jc42) Fix name to have no illegal characters
	ext4: avoid declaring fs inconsistent due to invalid file handles
	ext4: protect journal inode's blocks using block_validity
	ext4: don't perform block validity checks on the journal inode
	ext4: fix block validity checks for journal inodes using indirect blocks
	ext4: unsigned int compared against zero
	ext4: check for non-zero journal inum in ext4_calculate_overhead
	propagate_one(): mnt_set_mountpoint() needs mount_lock
	Linux 4.9.221

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ica420bdbb6c18fff9d0e6abffc180beefff0c5b9