https://source.android.com/security/bulletin/2020-06-01
CVE-2020-8647
CVE-2020-8648
CVE-2020-8428
Merge 4.4.226 into android-4.4-o

Changes in 4.4.226
	ax25: fix setsockopt(SO_BINDTODEVICE)
	net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()"
	sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed
	net/mlx5: Add command entry handling completion
	net: sun: fix missing release regions in cas_init_one().
	net/mlx4_core: fix a memory leak bug.
	uapi: fix linux/if_pppol2tp.h userspace compilation errors
	IB/cma: Fix reference count leak when no ipv4 addresses are set
	cachefiles: Fix race between read_waiter and read_copier involving op->to_do
	usb: gadget: legacy: fix redundant initialization warnings
	cifs: Fix null pointer check in cifs_read
	Input: usbtouchscreen - add support for BonXeon TP
	Input: evdev - call input_flush_device() on release(), not flush()
	Input: xpad - add custom init packet for Xbox One S controllers
	Input: i8042 - add ThinkPad S230u to i8042 reset list
	IB/qib: Call kobject_put() when kobject_init_and_add() fails
	ALSA: hwdep: fix a left shifting 1 by 31 UB bug
	ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
	exec: Always set cap_ambient in cap_bprm_set_creds
	fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
	include/asm-generic/topology.h: guard cpumask_of_node() macro argument
	iommu: Fix reference count leak in iommu_group_alloc.
	parisc: Fix kernel panic in mem_init()
	x86/dma: Fix max PFN arithmetic overflow on 32 bit systems
	xfrm: allow to accept packets with ipv6 NEXTHDR_HOP in xfrm_input
	xfrm: fix a warning in xfrm_policy_insert_list
	xfrm: fix a NULL-ptr deref in xfrm_local_error
	vti4: eliminated some duplicate code.
	ip_vti: receive ipip packet by calling ip_tunnel_rcv
	netfilter: nft_reject_bridge: enable reject with bridge vlan
	netfilter: ipset: Fix subcounter update skip
	netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code
	qlcnic: fix missing release in qlcnic_83xx_interrupt_test.
	bonding: Fix reference count leak in bond_sysfs_slave_add.
	netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build
	mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
	drm/fb-helper: Use proper plane mask for fb cleanup
	genirq/generic_pending: Do not lose pending affinity update
	usb: renesas_usbhs: gadget: fix spin_lock_init() for &uep->lock
	mac80211: fix memory leak
	net: rtnl_configure_link: fix dev flags changes arg to __dev_notify_flags
	mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
	asm-prototypes: Clear any CPP defines before declaring the functions
	sc16is7xx: move label 'err_spi' to correct section
	drm/msm: Fix possible null dereference on failure of get_pages()
	printk: help pr_debug and pr_devel to optimize out arguments
	scsi: zfcp: fix request object use-after-free in send path causing wrong traces
	Linux 4.4.226

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I14cbad17929220f4143483560fa70bc1afc57786