Merge android-4.19.35 (3e16663) into msm-4.19

* refs/heads/tmp-3e16663:
  Linux 4.19.35
  KVM: x86: nVMX: fix x2APIC VTPR read intercept
  KVM: x86: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887)
  ACPICA: AML interpreter: add region addresses in global list during initialization
  arm64: dts: rockchip: Fix vcc_host1_5v GPIO polarity on rk3328-rock64
  arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64
  dm integrity: fix deadlock with overlapping I/O
  dm table: propagate BDI_CAP_STABLE_WRITES to fix sporadic checksum errors
  dm: revert 8f50e35815 ("dm: limit the max bio size as BIO_MAX_PAGES * PAGE_SIZE")
  dm integrity: change memcmp to strncmp in dm_integrity_ctr
  PCI: pciehp: Ignore Link State Changes after powering off a slot
  PCI: Add function 1 DMA alias quirk for Marvell 9170 SATA controller
  x86/perf/amd: Remove need to check "running" bit in NMI handler
  x86/perf/amd: Resolve NMI latency issues for active PMCs
  x86/perf/amd: Resolve race condition when disabling PMC
  x86/asm: Use stricter assembly constraints in bitops
  x86/asm: Remove dead __GNUC__ conditionals
  xtensa: fix return_address
  sched/fair: Do not re-read ->h_load_next during hierarchical load calculation
  xen: Prevent buffer overflow in privcmd ioctl
  arm64: backtrace: Don't bother trying to unwind the userspace stack
  arm64: dts: rockchip: fix rk3328 rgmii high tx error rate
  arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
  ARM: dts: at91: Fix typo in ISC_D0 on PC9
  ARM: dts: am335x-evm: Correct the regulators for the audio codec
  ARM: dts: am335x-evmsk: Correct the regulators for the audio codec
  ARM: dts: rockchip: fix rk3288 cpu opp node reference
  virtio: Honour 'may_reduce_num' in vring_create_virtqueue
  genirq: Initialize request_mutex if CONFIG_SPARSE_IRQ=n
  genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent()
  block: fix the return errno for direct IO
  block: do not leak memory in bio_copy_user_iov()
  riscv: Fix syscall_get_arguments() and syscall_set_arguments()
  btrfs: prop: fix vanished compression property after failed set
  btrfs: prop: fix zstd compression parameter validation
  Btrfs: do not allow trimming when a fs is mounted with the nologreplay option
  ASoC: fsl_esai: fix channel swap issue when stream starts
  ASoC: intel: Fix crash at suspend/resume after failed codec registration
  mm: writeback: use exact memcg dirty counts
  include/linux/bitrev.h: fix constant bitrev
  kvm: svm: fix potential get_num_contig_pages overflow
  drm/udl: add a release method and delay modeset teardown
  drm/i915/gvt: do not deliver a workload if its creation fails
  alarmtimer: Return correct remaining time
  parisc: also set iaoq_b in instruction_pointer_set()
  parisc: regs_return_value() should return gpr28
  parisc: Detect QEMU earlier in boot process
  arm64: dts: rockchip: fix rk3328 sdmmc0 write errors
  mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd()
  ALSA: hda - Add two more machines to the power_save_blacklist
  ALSA: hda/realtek - Add quirk for Tuxedo XC 1509
  ALSA: hda/realtek: Enable headset MIC of Acer TravelMate B114-21 with ALC233
  ALSA: seq: Fix OOB-reads from strlcpy
  ACPICA: Namespace: remove address node from global list after method termination
  ACPICA: Clear status of GPEs before enabling them
  hwmon: (w83773g) Select REGMAP_I2C to fix build error
  tty: ldisc: add sysctl to prevent autoloading of ldiscs
  tty: mark Siemens R3964 line discipline as BROKEN
  arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region
  netfilter: nfnetlink_cttimeout: fetch timeouts for udplite and gre, too
  netfilter: nfnetlink_cttimeout: pass default timeout policy to obj_to_nlattr
  Revert "clk: meson: clean-up clock registration"
  lib/string.c: implement a basic bcmp
  x86/vdso: Drop implicit common-page-size linker flag
  kbuild: clang: choose GCC_TOOLCHAIN_DIR not on LD
  kbuild: deb-pkg: fix bindeb-pkg breakage when O= is used
  net/mlx5e: Update xon formula
  net/mlx5e: Update xoff formula
  net: mlx5: Add a missing check on idr_find, free buf
  r8169: disable default rx interrupt coalescing on RTL8168
  net: core: netif_receive_skb_list: unlist skb before passing to pt->func
  net: ip6_gre: fix possible use-after-free in ip6erspan_rcv
  net: ip_gre: fix possible use-after-free in erspan_rcv
  bnxt_en: Reset device on RX buffer errors.
  bnxt_en: Improve RX consumer index validity check.
  nfp: disable netpoll on representors
  nfp: validate the return code from dev_queue_xmit()
  net/mlx5e: Add a lock on tir list
  net/mlx5e: Fix error handling when refreshing TIRs
  vrf: check accept_source_route on the original netdevice
  tcp: fix a potential NULL pointer dereference in tcp_sk_exit
  tcp: Ensure DCTCP reacts to losses
  sctp: initialize _pad of sockaddr_in before copying to user memory
  r8169: disable ASPM again
  qmi_wwan: add Olicard 600
  openvswitch: fix flow actions reallocation
  net/sched: fix ->get helper of the matchall cls
  net/sched: act_sample: fix divide by zero in the traffic path
  net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().
  netns: provide pure entropy for net_hash_mix()
  net/mlx5: Decrease default mr cache size
  net-gro: Fix GRO flush when receiving a GSO packet.
  net: ethtool: not call vzalloc for zero sized memory request
  kcm: switch order of device registration to fix a crash
  ipv6: sit: reset ip header pointer in ipip6_rcv
  ipv6: Fix dangling pointer when ipv6 fragment
  ip6_tunnel: Match to ARPHRD_TUNNEL6 for dev type
  ibmvnic: Fix completion structure initialization
  hv_netvsc: Fix unwanted wakeup after tx_disable
  powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM
  drm/i915/gvt: do not let pin count of shadow mm go negative
  kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 from HLT
  sched/fair: remove printk while schedule is in progress
  ANDROID: cuttlefish_defconfig: Enable CONFIG_FUSE_FS

Conflicts:
	drivers/tty/Kconfig
	kernel/sched/fair.c

Change-Id: I274ed1c395d53d718a0ad33f37f48afd423db510
Signed-off-by: Ivaylo Georgiev <irgeorgiev@codeaurora.org>

mm/huge_memory.c

@@ -734,6 +734,21 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
 	spinlock_t *ptl;
 
 	ptl = pmd_lock(mm, pmd);
+	if (!pmd_none(*pmd)) {
+		if (write) {
+			if (pmd_pfn(*pmd) != pfn_t_to_pfn(pfn)) {
+				WARN_ON_ONCE(!is_huge_zero_pmd(*pmd));
+				goto out_unlock;
+			}
+			entry = pmd_mkyoung(*pmd);
+			entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
+			if (pmdp_set_access_flags(vma, addr, pmd, entry, 1))
+				update_mmu_cache_pmd(vma, addr, pmd);
+		}
+
+		goto out_unlock;
+	}
+
 	entry = pmd_mkhuge(pfn_t_pmd(pfn, prot));
 	if (pfn_t_devmap(pfn))
 		entry = pmd_mkdevmap(entry);
@@ -745,11 +760,16 @@ static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
 	if (pgtable) {
 		pgtable_trans_huge_deposit(mm, pmd, pgtable);
 		mm_inc_nr_ptes(mm);
+		pgtable = NULL;
 	}
 
 	set_pmd_at(mm, addr, pmd, entry);
 	update_mmu_cache_pmd(vma, addr, pmd);
+
+out_unlock:
 	spin_unlock(ptl);
+	if (pgtable)
+		pte_free(mm, pgtable);
 }
 
 vm_fault_t vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
@@ -800,6 +820,20 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
 	spinlock_t *ptl;
 
 	ptl = pud_lock(mm, pud);
+	if (!pud_none(*pud)) {
+		if (write) {
+			if (pud_pfn(*pud) != pfn_t_to_pfn(pfn)) {
+				WARN_ON_ONCE(!is_huge_zero_pud(*pud));
+				goto out_unlock;
+			}
+			entry = pud_mkyoung(*pud);
+			entry = maybe_pud_mkwrite(pud_mkdirty(entry), vma);
+			if (pudp_set_access_flags(vma, addr, pud, entry, 1))
+				update_mmu_cache_pud(vma, addr, pud);
+		}
+		goto out_unlock;
+	}
+
 	entry = pud_mkhuge(pfn_t_pud(pfn, prot));
 	if (pfn_t_devmap(pfn))
 		entry = pud_mkdevmap(entry);
@@ -809,6 +843,8 @@ static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
 	}
 	set_pud_at(mm, addr, pud, entry);
 	update_mmu_cache_pud(vma, addr, pud);
+
+out_unlock:
 	spin_unlock(ptl);
 }