https://source.android.com/security/bulletin/2020-07-01
CVE-2018-20669
CVE-2019-18282
CVE-2019-20636
Merge 4.19.131 into android-4.19

Changes in 4.19.131
	net: be more gentle about silly gso requests coming from user
	block/bio-integrity: don't free 'buf' if bio_integrity_add_page() failed
	fanotify: fix ignore mask logic for events on child and on dir
	mtd: rawnand: marvell: Fix the condition on a return code
	net: bcmgenet: remove HFB_CTRL access
	net: sched: export __netdev_watchdog_up()
	EDAC/amd64: Add Family 17h Model 30h PCI IDs
	i2c: tegra: Cleanup kerneldoc comments
	i2c: tegra: Add missing kerneldoc for some fields
	i2c: tegra: Fix Maximum transfer size
	fix a braino in "sparc32: fix register window handling in genregs32_[gs]et()"
	ALSA: hda/realtek - Enable the headset of ASUS B9450FA with ALC294
	ALSA: hda/realtek: Enable mute LED on an HP system
	ALSA: hda/realtek - Enable micmute LED on and HP system
	apparmor: don't try to replace stale label in ptraceme check
	ibmveth: Fix max MTU limit
	mld: fix memory leak in ipv6_mc_destroy_dev()
	net: bridge: enfore alignment for ethernet address
	net: fix memleak in register_netdevice()
	net: place xmit recursion in softnet data
	net: use correct this_cpu primitive in dev_recursion_level
	net: increment xmit_recursion level in dev_direct_xmit()
	net: usb: ax88179_178a: fix packet alignment padding
	rocker: fix incorrect error handling in dma_rings_init
	rxrpc: Fix notification call on completion of discarded calls
	sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket
	tcp: don't ignore ECN CWR on pure ACK
	tcp: grow window for OOO packets only for SACK flows
	tg3: driver sleeps indefinitely when EEH errors exceed eeh_max_freezes
	ip6_gre: fix use-after-free in ip6gre_tunnel_lookup()
	net: phy: Check harder for errors in get_phy_id()
	ip_tunnel: fix use-after-free in ip_tunnel_lookup()
	sch_cake: don't try to reallocate or unshare skb unconditionally
	sch_cake: fix a few style nits
	tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
	sch_cake: don't call diffserv parsing code when it is not needed
	net: Fix the arp error in some cases
	net: Do not clear the sock TX queue in sk_set_socket()
	net: core: reduce recursion limit value
	USB: ohci-sm501: Add missed iounmap() in remove
	usb: dwc2: Postponed gadget registration to the udc class driver
	usb: add USB_QUIRK_DELAY_INIT for Logitech C922
	USB: ehci: reopen solution for Synopsys HC bug
	usb: host: xhci-mtk: avoid runtime suspend when removing hcd
	xhci: Poll for U0 after disabling USB2 LPM
	usb: host: ehci-exynos: Fix error check in exynos_ehci_probe()
	usb: typec: tcpci_rt1711h: avoid screaming irq causing boot hangs
	ALSA: usb-audio: add quirk for Denon DCD-1500RE
	ALSA: usb-audio: add quirk for Samsung USBC Headset (AKG)
	ALSA: usb-audio: Fix OOB access of mixer element list
	scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action
	xhci: Fix incorrect EP_STATE_MASK
	xhci: Fix enumeration issue when setting max packet size for FS devices.
	xhci: Return if xHCI doesn't support LPM
	cdc-acm: Add DISABLE_ECHO quirk for Microchip/SMSC chip
	loop: replace kill_bdev with invalidate_bdev
	IB/mad: Fix use after free when destroying MAD agent
	cifs/smb3: Fix data inconsistent when punch hole
	cifs/smb3: Fix data inconsistent when zero file range
	xfrm: Fix double ESP trailer insertion in IPsec crypto offload.
	ASoC: q6asm: handle EOS correctly
	efi/esrt: Fix reference count leak in esre_create_sysfs_entry.
	regualtor: pfuze100: correct sw1a/sw2 on pfuze3000
	ASoC: fsl_ssi: Fix bclk calculation for mono channel
	ARM: dts: Fix duovero smsc interrupt for suspend
	x86/resctrl: Fix a NULL vs IS_ERR() static checker warning in rdt_cdp_peer_get()
	regmap: Fix memory leak from regmap_register_patch
	ARM: dts: NSP: Correct FA2 mailbox node
	rxrpc: Fix handling of rwind from an ACK packet
	RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532
	RDMA/cma: Protect bind_list and listen_list while finding matching cm id
	ASoC: rockchip: Fix a reference count leak.
	RDMA/mad: Fix possible memory leak in ib_mad_post_receive_mads()
	net: qed: fix left elements count calculation
	net: qed: fix NVMe login fails over VFs
	net: qed: fix excessive QM ILT lines consumption
	cxgb4: move handling L2T ARP failures to caller
	ARM: imx5: add missing put_device() call in imx_suspend_alloc_ocram()
	usb: gadget: udc: Potential Oops in error handling code
	netfilter: ipset: fix unaligned atomic access
	net: bcmgenet: use hardware padding of runt frames
	i2c: fsi: Fix the port number field in status register
	i2c: core: check returned size of emulated smbus block read
	sched/deadline: Initialize ->dl_boosted
	sched/core: Fix PI boosting between RT and DEADLINE tasks
	sata_rcar: handle pm_runtime_get_sync failure cases
	ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
	drm/amd/display: Use kfree() to free rgb_user in calculate_user_regamma_ramp()
	riscv/atomic: Fix sign extension for RV64I
	hwrng: ks-sa - Fix runtime PM imbalance on error
	ibmvnic: Harden device login requests
	net: alx: fix race condition in alx_remove
	s390/ptrace: fix setting syscall number
	s390/vdso: fix vDSO clock_getres()
	arm64: sve: Fix build failure when ARM64_SVE=y and SYSCTL=n
	kbuild: improve cc-option to clean up all temporary files
	blktrace: break out of blktrace setup on concurrent calls
	RISC-V: Don't allow write+exec only page mapping request in mmap
	ALSA: hda: Add NVIDIA codec IDs 9a & 9d through a0 to patch table
	ALSA: hda/realtek - Add quirk for MSI GE63 laptop
	ACPI: sysfs: Fix pm_profile_attr type
	erofs: fix partially uninitialized misuse in z_erofs_onlinepage_fixup
	KVM: X86: Fix MSR range of APIC registers in X2APIC mode
	KVM: nVMX: Plumb L2 GPA through to PML emulation
	x86/asm/64: Align start of __clear_user() loop to 16-bytes
	btrfs: fix data block group relocation failure due to concurrent scrub
	btrfs: fix failure of RWF_NOWAIT write into prealloc extent beyond eof
	mm/slab: use memzero_explicit() in kzfree()
	ocfs2: avoid inode removal while nfsd is accessing it
	ocfs2: load global_inode_alloc
	ocfs2: fix value of OCFS2_INVALID_SLOT
	ocfs2: fix panic on nfs server over ocfs2
	arm64: perf: Report the PC value in REGS_ABI_32 mode
	tracing: Fix event trigger to accept redundant spaces
	ring-buffer: Zero out time extend if it is nested and not absolute
	drm: rcar-du: Fix build error
	drm/radeon: fix fb_div check in ni_init_smc_spll_table()
	Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
	sunrpc: fixed rollback in rpc_gssd_dummy_populate()
	SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment()
	pNFS/flexfiles: Fix list corruption if the mirror count changes
	NFSv4 fix CLOSE not waiting for direct IO compeletion
	dm writecache: correct uncommitted_block when discarding uncommitted entry
	dm writecache: add cond_resched to loop in persistent_memory_claim()
	xfs: add agf freeblocks verify in xfs_agf_verify
	Revert "tty: hvc: Fix data abort due to race in hvc_open"
	Linux 4.19.131

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I04be7c0f6a20d67b9c19c939cfc710c3defbe3d9