Merge 4.19.175 into android-4.19-stable

Changes in 4.19.175
	USB: serial: cp210x: add pid/vid for WSDA-200-USB
	USB: serial: cp210x: add new VID/PID for supporting Teraoka AD2000
	USB: serial: option: Adding support for Cinterion MV31
	elfcore: fix building with clang
	Input: i8042 - unbreak Pegatron C15B
	rxrpc: Fix deadlock around release of dst cached on udp tunnel
	arm64: dts: ls1046a: fix dcfg address range
	net: lapb: Copy the skb before sending a packet
	net: mvpp2: TCAM entry enable should be written after SRAM data
	memblock: do not start bottom-up allocations with kernel_end
	USB: gadget: legacy: fix an error code in eth_bind()
	USB: usblp: don't call usb_set_interface if there's a single alt
	usb: renesas_usbhs: Clear pipe running flag in usbhs_pkt_pop()
	usb: dwc2: Fix endpoint direction check in ep_from_windex
	usb: dwc3: fix clock issue during resume in OTG mode
	ovl: fix dentry leak in ovl_get_redirect
	mac80211: fix station rate table updates on assoc
	kretprobe: Avoid re-registration of the same kretprobe earlier
	genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set
	xhci: fix bounce buffer usage for non-sg list case
	cifs: report error instead of invalid when revalidating a dentry fails
	smb3: Fix out-of-bounds bug in SMB2_negotiate()
	mmc: core: Limit retries when analyse of SDIO tuples fails
	nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs
	KVM: SVM: Treat SVM as unsupported when running as an SEV guest
	ARM: footbridge: fix dc21285 PCI configuration accessors
	mm: hugetlbfs: fix cannot migrate the fallocated HugeTLB page
	mm: hugetlb: fix a race between freeing and dissolving the page
	mm: hugetlb: fix a race between isolating and freeing page
	mm: hugetlb: remove VM_BUG_ON_PAGE from page_huge_active
	mm: thp: fix MADV_REMOVE deadlock on shmem THP
	x86/build: Disable CET instrumentation in the kernel
	x86/apic: Add extra serialization for non-serializing MSRs
	Input: xpad - sync supported devices with fork on GitHub
	iommu/vt-d: Do not use flush-queue when caching-mode is on
	md: Set prev_flush_start and flush_bio in an atomic way
	net: ip_tunnel: fix mtu calculation
	net: dsa: mv88e6xxx: override existent unicast portvec in port_fdb_add
	Linux 4.19.175

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iac6d5c4ad079946ef1c032791e8e583b9264917b

mm/huge_memory.c

@@ -2278,7 +2278,7 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 	spinlock_t *ptl;
 	struct mm_struct *mm = vma->vm_mm;
 	unsigned long haddr = address & HPAGE_PMD_MASK;
-	bool was_locked = false;
+	bool do_unlock_page = false;
 	pmd_t _pmd;
 
 	mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE);
@@ -2291,7 +2291,6 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 	VM_BUG_ON(freeze && !page);
 	if (page) {
 		VM_WARN_ON_ONCE(!PageLocked(page));
-		was_locked = true;
 		if (page != pmd_page(*pmd))
 			goto out;
 	}
@@ -2300,19 +2299,29 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 	if (pmd_trans_huge(*pmd)) {
 		if (!page) {
 			page = pmd_page(*pmd);
-			if (unlikely(!trylock_page(page))) {
-				get_page(page);
-				_pmd = *pmd;
-				spin_unlock(ptl);
-				lock_page(page);
-				spin_lock(ptl);
-				if (unlikely(!pmd_same(*pmd, _pmd))) {
-					unlock_page(page);
+			/*
+			 * An anonymous page must be locked, to ensure that a
+			 * concurrent reuse_swap_page() sees stable mapcount;
+			 * but reuse_swap_page() is not used on shmem or file,
+			 * and page lock must not be taken when zap_pmd_range()
+			 * calls __split_huge_pmd() while i_mmap_lock is held.
+			 */
+			if (PageAnon(page)) {
+				if (unlikely(!trylock_page(page))) {
+					get_page(page);
+					_pmd = *pmd;
+					spin_unlock(ptl);
+					lock_page(page);
+					spin_lock(ptl);
+					if (unlikely(!pmd_same(*pmd, _pmd))) {
+						unlock_page(page);
+						put_page(page);
+						page = NULL;
+						goto repeat;
+					}
 					put_page(page);
-					page = NULL;
-					goto repeat;
 				}
-				put_page(page);
+				do_unlock_page = true;
 			}
 		}
 		if (PageMlocked(page))
@@ -2322,7 +2331,7 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 	__split_huge_pmd_locked(vma, pmd, haddr, freeze);
 out:
 	spin_unlock(ptl);
-	if (!was_locked && page)
+	if (do_unlock_page)
 		unlock_page(page);
 	/*
 	 * No need to double call mmu_notifier->invalidate_range() callback.