Merge 4.19.45 into android-4.19-q

Changes in 4.19.45
	locking/rwsem: Prevent decrement of reader count before increment
	x86/speculation/mds: Revert CPU buffer clear on double fault exit
	x86/speculation/mds: Improve CPU buffer clear documentation
	objtool: Fix function fallthrough detection
	arm64: dts: rockchip: Disable DCMDs on RK3399's eMMC controller.
	ARM: dts: exynos: Fix interrupt for shared EINTs on Exynos5260
	ARM: dts: exynos: Fix audio (microphone) routing on Odroid XU3
	mmc: sdhci-of-arasan: Add DTS property to disable DCMDs.
	ARM: exynos: Fix a leaked reference by adding missing of_node_put
	power: supply: axp288_charger: Fix unchecked return value
	power: supply: axp288_fuel_gauge: Add ACEPC T8 and T11 mini PCs to the blacklist
	arm64: mmap: Ensure file offset is treated as unsigned
	arm64: arch_timer: Ensure counter register reads occur with seqlock held
	arm64: compat: Reduce address limit
	arm64: Clear OSDLR_EL1 on CPU boot
	arm64: Save and restore OSDLR_EL1 across suspend/resume
	sched/x86: Save [ER]FLAGS on context switch
	crypto: crypto4xx - fix ctr-aes missing output IV
	crypto: crypto4xx - fix cfb and ofb "overran dst buffer" issues
	crypto: salsa20 - don't access already-freed walk.iv
	crypto: chacha20poly1305 - set cra_name correctly
	crypto: ccp - Do not free psp_master when PLATFORM_INIT fails
	crypto: vmx - fix copy-paste error in CTR mode
	crypto: skcipher - don't WARN on unprocessed data after slow walk step
	crypto: crct10dif-generic - fix use via crypto_shash_digest()
	crypto: x86/crct10dif-pcl - fix use via crypto_shash_digest()
	crypto: arm64/gcm-aes-ce - fix no-NEON fallback code
	crypto: gcm - fix incompatibility between "gcm" and "gcm_base"
	crypto: rockchip - update IV buffer to contain the next IV
	crypto: arm/aes-neonbs - don't access already-freed walk.iv
	crypto: arm64/aes-neonbs - don't access already-freed walk.iv
	mmc: core: Fix tag set memory leak
	ALSA: line6: toneport: Fix broken usage of timer for delayed execution
	ALSA: usb-audio: Fix a memory leak bug
	ALSA: hda/hdmi - Read the pin sense from register when repolling
	ALSA: hda/hdmi - Consider eld_valid when reporting jack event
	ALSA: hda/realtek - EAPD turn on later
	ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
	ASoC: max98090: Fix restore of DAPM Muxes
	ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
	ASoC: fsl_esai: Fix missing break in switch statement
	ASoC: codec: hdac_hdmi add device_link to card device
	bpf, arm64: remove prefetch insn in xadd mapping
	crypto: ccree - remove special handling of chained sg
	crypto: ccree - fix mem leak on error path
	crypto: ccree - don't map MAC key on stack
	crypto: ccree - use correct internal state sizes for export
	crypto: ccree - don't map AEAD key and IV on stack
	crypto: ccree - pm resume first enable the source clk
	crypto: ccree - HOST_POWER_DOWN_EN should be the last CC access during suspend
	crypto: ccree - add function to handle cryptocell tee fips error
	crypto: ccree - handle tee fips error during power management resume
	mm/mincore.c: make mincore() more conservative
	mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses
	mm/hugetlb.c: don't put_page in lock of hugetlb_lock
	hugetlb: use same fault hash key for shared and private mappings
	ocfs2: fix ocfs2 read inode data panic in ocfs2_iget
	userfaultfd: use RCU to free the task struct when fork fails
	ACPI: PM: Set enable_for_wake for wakeup GPEs during suspend-to-idle
	mfd: da9063: Fix OTP control register names to match datasheets for DA9063/63L
	mfd: max77620: Fix swapped FPS_PERIOD_MAX_US values
	mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary on read/write
	tty: vt.c: Fix TIOCL_BLANKSCREEN console blanking if blankinterval == 0
	tty/vt: fix write/write race in ioctl(KDSKBSENT) handler
	jbd2: check superblock mapped prior to committing
	ext4: make sanity check in mballoc more strict
	ext4: ignore e_value_offs for xattrs with value-in-ea-inode
	ext4: avoid drop reference to iloc.bh twice
	ext4: fix use-after-free race with debug_want_extra_isize
	ext4: actually request zeroing of inode table after grow
	ext4: fix ext4_show_options for file systems w/o journal
	btrfs: Check the first key and level for cached extent buffer
	btrfs: Correctly free extent buffer in case btree_read_extent_buffer_pages fails
	btrfs: Honour FITRIM range constraints during free space trim
	Btrfs: send, flush dellaloc in order to avoid data loss
	Btrfs: do not start a transaction during fiemap
	Btrfs: do not start a transaction at iterate_extent_inodes()
	bcache: fix a race between cache register and cacheset unregister
	bcache: never set KEY_PTRS of journal key to 0 in journal_reclaim()
	ipmi:ssif: compare block number correctly for multi-part return messages
	crypto: ccm - fix incompatibility between "ccm" and "ccm_base"
	fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount
	tty: Don't force RISCV SBI console as preferred console
	ext4: zero out the unused memory region in the extent tree block
	ext4: fix data corruption caused by overlapping unaligned and aligned IO
	ext4: fix use-after-free in dx_release()
	ext4: avoid panic during forced reboot due to aborted journal
	ALSA: hda/realtek - Corrected fixup for System76 Gazelle (gaze14)
	ALSA: hda/realtek - Fixup headphone noise via runtime suspend
	ALSA: hda/realtek - Fix for Lenovo B50-70 inverted internal microphone bug
	jbd2: fix potential double free
	KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
	KVM: lapic: Busy wait for timer to expire when using hv_timer
	kbuild: turn auto.conf.cmd into a mandatory include file
	xen/pvh: set xen_domain_type to HVM in xen_pvh_init
	libnvdimm/namespace: Fix label tracking error
	iov_iter: optimize page_copy_sane()
	pstore: Centralize init/exit routines
	pstore: Allocate compression during late_initcall()
	pstore: Refactor compression initialization
	ext4: fix compile error when using BUFFER_TRACE
	ext4: don't update s_rev_level if not required
	Linux 4.19.45

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

kernel/fork.c

@@ -910,6 +910,15 @@ static void mm_init_aio(struct mm_struct *mm)
 #endif
 }
 
+static __always_inline void mm_clear_owner(struct mm_struct *mm,
+					   struct task_struct *p)
+{
+#ifdef CONFIG_MEMCG
+	if (mm->owner == p)
+		WRITE_ONCE(mm->owner, NULL);
+#endif
+}
+
 static void mm_init_owner(struct mm_struct *mm, struct task_struct *p)
 {
 #ifdef CONFIG_MEMCG
@@ -1289,6 +1298,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk)
 free_pt:
 	/* don't put binfmt in mmput, we haven't got module yet */
 	mm->binfmt = NULL;
+	mm_init_owner(mm, NULL);
 	mmput(mm);
 
 fail_nomem:
@@ -1620,6 +1630,21 @@ static inline void rcu_copy_process(struct task_struct *p)
 #endif /* #ifdef CONFIG_TASKS_RCU */
 }
 
+static void __delayed_free_task(struct rcu_head *rhp)
+{
+	struct task_struct *tsk = container_of(rhp, struct task_struct, rcu);
+
+	free_task(tsk);
+}
+
+static __always_inline void delayed_free_task(struct task_struct *tsk)
+{
+	if (IS_ENABLED(CONFIG_MEMCG))
+		call_rcu(&tsk->rcu, __delayed_free_task);
+	else
+		free_task(tsk);
+}
+
 /*
  * This creates a new process as a copy of the old one,
  * but does not actually start it yet.
@@ -2081,8 +2106,10 @@ static __latent_entropy struct task_struct *copy_process(
 bad_fork_cleanup_namespaces:
 	exit_task_namespaces(p);
 bad_fork_cleanup_mm:
-	if (p->mm)
+	if (p->mm) {
+		mm_clear_owner(p->mm, p);
 		mmput(p->mm);
+	}
 bad_fork_cleanup_signal:
 	if (!(clone_flags & CLONE_THREAD))
 		free_signal_struct(p->signal);
@@ -2113,7 +2140,7 @@ static __latent_entropy struct task_struct *copy_process(
 bad_fork_free:
 	p->state = TASK_DEAD;
 	put_task_stack(p);
-	free_task(p);
+	delayed_free_task(p);
 fork_out:
 	spin_lock_irq(&current->sighand->siglock);
 	hlist_del_init(&delayed.node);