https://source.android.com/security/bulletin/2018-07-01
CVE-2018-9422
CVE-2018-9417
CVE-2018-6927
CVE-2018-9416
CVE-2018-9415
CVE-2018-9415
CVE-2018-7995
CVE-2018-1065
CVE-2017-18218
CVE-2017-1000112

Not included:
CVE-2018-5703 : Skipped due to fix rejected upstream
Merge 4.14.53 into android-4.14

Changes in 4.14.53
	x86/spectre_v1: Disable compiler optimizations over array_index_mask_nospec()
	x86/xen: Add call of speculative_store_bypass_ht_init() to PV paths
	x86/mce: Improve error message when kernel cannot recover
	x86/mce: Check for alternate indication of machine check recovery on Skylake
	x86/mce: Fix incorrect "Machine check from unknown source" message
	x86/mce: Do not overwrite MCi_STATUS in mce_no_way_out()
	x86: Call fixup_exception() before notify_die() in math_error()
	m68k/mm: Adjust VM area to be unmapped by gap size for __iounmap()
	m68k/mac: Fix SWIM memory resource end address
	serial: sh-sci: Use spin_{try}lock_irqsave instead of open coding version
	signal/xtensa: Consistenly use SIGBUS in do_unaligned_user
	PM / Domains: Fix error path during attach in genpd
	PM / core: Fix supplier device runtime PM usage counter imbalance
	PM / OPP: Update voltage in case freq == old_freq
	usb: do not reset if a low-speed or full-speed device timed out
	1wire: family module autoload fails because of upper/lower case mismatch.
	ASoC: dapm: delete dapm_kcontrol_data paths list before freeing it
	ASoC: cs35l35: Add use_single_rw to regmap config
	ASoC: cirrus: i2s: Fix LRCLK configuration
	ASoC: cirrus: i2s: Fix {TX|RX}LinCtrlData setup
	thermal: bcm2835: Stop using printk format %pCr
	clk: renesas: cpg-mssr: Stop using printk format %pCr
	lib/vsprintf: Remove atomic-unsafe support for %pCr
	ftrace/selftest: Have the reset_trigger code be a bit more careful
	mips: ftrace: fix static function graph tracing
	branch-check: fix long->int truncation when profiling branches
	ipmi:bt: Set the timeout before doing a capabilities check
	Bluetooth: hci_qca: Avoid missing rampatch failure with userspace fw loader
	printk: fix possible reuse of va_list variable
	fuse: fix congested state leak on aborted connections
	fuse: atomic_o_trunc should truncate pagecache
	fuse: don't keep dead fuse_conn at fuse_fill_super().
	fuse: fix control dir setup and teardown
	powerpc/mm/hash: Add missing isync prior to kernel stack SLB switch
	powerpc/ptrace: Fix setting 512B aligned breakpoints with PTRACE_SET_DEBUGREG
	powerpc/perf: Fix memory allocation for core-imc based on num_possible_cpus()
	powerpc/ptrace: Fix enforcement of DAWR constraints
	powerpc/powernv/ioda2: Remove redundant free of TCE pages
	powerpc/powernv: copy/paste - Mask SO bit in CR
	powerpc/powernv/cpuidle: Init all present cpus for deep states
	cpuidle: powernv: Fix promotion from snooze if next state disabled
	powerpc/fadump: Unregister fadump on kexec down path.
	soc: rockchip: power-domain: Fix wrong value when power up pd with writemask
	cxl: Disable prefault_mode in Radix mode
	ARM: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size
	ARM: dts: Fix SPI node for Arria10
	ARM: dts: socfpga: Fix NAND controller node compatible
	ARM: dts: socfpga: Fix NAND controller clock supply
	ARM: dts: socfpga: Fix NAND controller node compatible for Arria10
	arm64: Fix syscall restarting around signal suppressed by tracer
	arm64: kpti: Use early_param for kpti= command-line option
	arm64: mm: Ensure writes to swapper are ordered wrt subsequent cache maintenance
	ARM64: dts: meson: disable sd-uhs modes on the libretech-cc
	of: overlay: validate offset from property fixups
	of: unittest: for strings, account for trailing \0 in property length field
	of: platform: stop accessing invalid dev in of_platform_device_destroy
	tpm: fix use after free in tpm2_load_context()
	tpm: fix race condition in tpm_common_write()
	IB/qib: Fix DMA api warning with debug kernel
	IB/{hfi1, qib}: Add handling of kernel restart
	IB/mlx4: Mark user MR as writable if actual virtual memory is writable
	IB/core: Make testing MR flags for writability a static inline function
	IB/mlx5: Fetch soft WQE's on fatal error state
	IB/isert: Fix for lib/dma_debug check_sync warning
	IB/isert: fix T10-pi check mask setting
	IB/hfi1: Fix fault injection init/exit issues
	IB/hfi1: Reorder incorrect send context disable
	IB/hfi1: Optimize kthread pointer locking when queuing CQ entries
	IB/hfi1: Fix user context tail allocation for DMA_RTAIL
	RDMA/mlx4: Discard unknown SQP work requests
	xprtrdma: Return -ENOBUFS when no pages are available
	mtd: cfi_cmdset_0002: Change write buffer to check correct value
	mtd: cfi_cmdset_0002: Use right chip in do_ppb_xxlock()
	mtd: cfi_cmdset_0002: fix SEGV unlocking multiple chips
	mtd: cfi_cmdset_0002: Fix unlocking requests crossing a chip boudary
	mtd: cfi_cmdset_0002: Avoid walking all chips when unlocking.
	MIPS: BCM47XX: Enable 74K Core ExternalSync for PCIe erratum
	PCI: hv: Make sure the bus domain is really unique
	PCI: Add ACS quirk for Intel 7th & 8th Gen mobile
	PCI: Add ACS quirk for Intel 300 series
	PCI: pciehp: Clear Presence Detect and Data Link Layer Status Changed on resume
	auxdisplay: fix broken menu
	pinctrl: samsung: Correct EINTG banks order
	pinctrl: devicetree: Fix pctldev pointer overwrite
	cpufreq: intel_pstate: Fix scaling max/min limits with Turbo 3.0
	MIPS: io: Add barrier after register read in inX()
	time: Make sure jiffies_to_msecs() preserves non-zero time periods
	irqchip/gic-v3-its: Don't bind LPI to unavailable NUMA node
	X.509: unpack RSA signatureValue field from BIT STRING
	Btrfs: fix return value on rename exchange failure
	iio: adc: ad7791: remove sample freq sysfs attributes
	iio: sca3000: Fix an error handling path in 'sca3000_probe()'
	mm: fix __gup_device_huge vs unmap
	scsi: hpsa: disable device during shutdown
	scsi: qla2xxx: Fix setting lower transfer speed if GPSC fails
	scsi: qla2xxx: Mask off Scope bits in retry delay
	scsi: zfcp: fix missing SCSI trace for result of eh_host_reset_handler
	scsi: zfcp: fix missing SCSI trace for retry of abort / scsi_eh TMF
	scsi: zfcp: fix misleading REC trigger trace where erp_action setup failed
	scsi: zfcp: fix missing REC trigger trace on terminate_rport_io early return
	scsi: zfcp: fix missing REC trigger trace on terminate_rport_io for ERP_FAILED
	scsi: zfcp: fix missing REC trigger trace for all objects in ERP_FAILED
	scsi: zfcp: fix missing REC trigger trace on enqueue without ERP thread
	linvdimm, pmem: Preserve read-only setting for pmem devices
	clk: at91: PLL recalc_rate() now using cached MUL and DIV values
	rtc: sun6i: Fix bit_idx value for clk_register_gate
	md: fix two problems with setting the "re-add" device state.
	rpmsg: smd: do not use mananged resources for endpoints and channels
	ubi: fastmap: Cancel work upon detach
	ubi: fastmap: Correctly handle interrupted erasures in EBA
	UBIFS: Fix potential integer overflow in allocation
	backlight: as3711_bl: Fix Device Tree node lookup
	backlight: max8925_bl: Fix Device Tree node lookup
	backlight: tps65217_bl: Fix Device Tree node lookup
	mfd: intel-lpss: Program REMAP register in PIO mode
	mfd: intel-lpss: Fix Intel Cannon Lake LPSS I2C input clock
	arm: dts: mt7623: fix invalid memory node being generated
	perf tools: Fix symbol and object code resolution for vdso32 and vdsox32
	perf intel-pt: Fix sync_switch INTEL_PT_SS_NOT_TRACING
	perf intel-pt: Fix decoding to accept CBR between FUP and corresponding TIP
	perf intel-pt: Fix MTC timing after overflow
	perf intel-pt: Fix "Unexpected indirect branch" error
	perf intel-pt: Fix packet decoding of CYC packets
	perf vendor events: Add Goldmont Plus V1 event file
	perf/x86/intel/uncore: Add event constraint for BDX PCU
	media: vsp1: Release buffers for each video node
	media: v4l2-compat-ioctl32: prevent go past max size
	media: cx231xx: Add support for AverMedia DVD EZMaker 7
	media: dvb_frontend: fix locking issues at dvb_frontend_get_event()
	nfsd: restrict rd_maxcount to svc_max_payload in nfsd_encode_readdir
	NFSv4: Fix possible 1-byte stack overflow in nfs_idmap_read_and_verify_message
	NFSv4: Revert commit 5f83d86cf531d ("NFSv4.x: Fix wraparound issues..")
	NFSv4: Fix a typo in nfs41_sequence_process
	video: uvesafb: Fix integer overflow in allocation
	ACPI / LPSS: Add missing prv_offset setting for byt/cht PWM devices
	Input: elan_i2c - add ELAN0618 (Lenovo v330 15IKB) ACPI ID
	pwm: lpss: platform: Save/restore the ctrl register over a suspend/resume
	rbd: flush rbd_dev->watch_dwork after watch is unregistered
	mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm()
	mm: fix devmem_is_allowed() for sub-page System RAM intersections
	xen: Remove unnecessary BUG_ON from __unbind_from_irq()
	udf: Detect incorrect directory size
	Input: xpad - fix GPD Win 2 controller name
	Input: elan_i2c_smbus - fix more potential stack buffer overflows
	Input: elantech - enable middle button of touchpads on ThinkPad P52
	Input: elantech - fix V4 report decoding for module with middle key
	ALSA: timer: Fix UBSAN warning at SNDRV_TIMER_IOCTL_NEXT_DEVICE ioctl
	ALSA: hda/realtek - Fix pop noise on Lenovo P50 & co
	ALSA: hda/realtek - Add a quirk for FSC ESPRIMO U9210
	ALSA: hda/realtek - Fix the problem of two front mics on more machines
	slub: fix failure when we delete and create a slab cache
	block: Fix transfer when chunk sectors exceeds max
	block: Fix cloning of requests with a special payload
	x86/efi: Fix efi_call_phys_epilog() with CONFIG_X86_5LEVEL=y
	dm zoned: avoid triggering reclaim from inside dmz_map()
	dm thin: handle running out of data space vs concurrent discard
	xhci: Fix use-after-free in xhci_free_virt_device
	Linux 4.14.53

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>