Merge 3.18.49 into android-3.18

Changes in 3.18.49:
	Revert "af_unix: Fix splice-bind deadlock"
	can: Fix kernel panic at security_sock_rcv_skb
	ipv6: fix ip6_tnl_parse_tlv_enc_lim()
	ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
	tcp: fix 0 divide in __tcp_select_window()
	net: use a work queue to defer net_disable_timestamp() work
	ipv4: keep skb->dst around in presence of IP options
	netlabel: out of bound access in cipso_v4_validate()
	mlx4: Invoke softirqs after napi_reschedule
	sctp: avoid BUG_ON on sctp_wait_for_sndbuf
	sit: fix a double free on error path
	ping: fix a null pointer dereference
	l2tp: do not use udp_ioctl()
	ip6_gre: fix ip6gre_err() invalid reads
	ipv6: tcp: restore IP6CB for pktoptions skbs
	ipv6: tcp: add a missing tcp_v6_restore_cb()
	tcp: avoid infinite loop in tcp_splice_read()
	iommu/vt-d: Fix IOMMU lookup for SR-IOV Virtual Functions
	usb: chipidea: move the lock initialization to core file
	tcp: fix overflow in __tcp_retransmit_skb()
	ANDROID: binder: Add strong ref checks
	ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct
	ALSA: usb-audio: Add quirk for Syntek STK1160
	Fix potential infoleak in older kernels
	tty: vt, fix bogus division in csi_J
	ARM: 8584/1: floppy: avoid gcc-6 warning
	drm/exynos: fix error handling in exynos_drm_subdrv_open
	smc91x: avoid self-comparison warning
	UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header
	pwm: Unexport children before chip removal
	HID: usbhid: add ATEN CS962 to list of quirky devices
	selinux: fix off-by-one in setprocattr
	fbdev: color map copying bounds checking
	tcp: fix wrong checksum calculation on MTU probing
	tcp: fix a compile error in DBGUNDO()
	ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()
	ipmr, ip6mr: fix scheduling while atomic and a deadlock with ipmr_get_route
	net: Add netdev all_adj_list refcnt propagation to fix panic
	packet: call fanout_release, while UNREGISTERING a netdev
	ipv6: correctly add local routes when lo goes up
	net: pktgen: remove rcu locking in pktgen_change_name()
	ipv4: disable BH in set_ping_group_range()
	net: sctp, forbid negative length
	sctp: validate chunk len before actually using it
	packet: on direct_xmit, limit tso and csum to supported devices
	netlink: do not enter direct reclaim from netlink_dump()
	ASoC: cs4270: fix DAPM stream name mismatch
	dib0700: fix nec repeat handling
	swapfile: fix memory corruption via malformed swapfile
	coredump: fix unfreezable coredumping task
	staging: iio: ad5933: avoid uninitialized variable in error case
	drivers: staging: nvec: remove bogus reset command for PS/2 interface
	Revert "staging: nvec: ps2: change serio type to passthrough"
	USB: cdc-acm: fix TIOCMIWAIT
	usb: gadget: u_ether: remove interrupt throttling
	drbd: Fix kernel_sendmsg() usage - potential NULL deref
	net/llc: avoid BUG_ON() in skb_orphan()
	dccp: fix freeing skb too early for IPV6_RECVPKTINFO
	net: socket: fix recvmmsg not returning error from sock_error
	lib/vsprintf.c: improve sanity check in vsnprintf()
	TTY: n_hdlc, fix lockdep false positive
	tty: n_hdlc: get rid of racy n_hdlc.tbuf
	cancel the setfilesize transation when io error happen
	raid10: increment write counter after bio is split
	xfrm: policy: init locks early
	xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
	xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
	staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
	serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards
	KVM: s390: Disable dirty log retrieval for UCONTROL guests
	Bluetooth: Add another AR3012 04ca:3018 device
	IB/ipoib: Fix deadlock between rmmod and set_mode
	USB: serial: digi_acceleport: fix OOB data sanity check
	USB: serial: digi_acceleport: fix OOB-event processing
	nlm: Ensure callback code also checks that the files match
	xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD
	mac80211: flush delayed work when entering suspend
	libceph: use BUG() instead of BUG_ON(1)
	fat: fix using uninitialized fields of fat_inode/fsinfo_inode
	ktest: Fix child exit code processing
	crypto: improve gcc optimization flags for serpent and wp512
	mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy
	usb: gadget: dummy_hcd: clear usb_gadget region before registration
	usb: dwc3: gadget: make Set Endpoint Configuration macros safe
	usb: gadget: function: f_fs: pass companion descriptor along
	usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers
	USB: serial: safe_serial: fix information leak in completion handler
	USB: serial: omninet: fix reference leaks at open
	USB: iowarrior: fix NULL-deref at probe
	USB: iowarrior: fix NULL-deref in write
	USB: serial: io_ti: fix NULL-deref in interrupt callback
	USB: serial: io_ti: fix information leak in completion handler
	mvsas: fix misleading indentation
	dm: flush queued bios when process blocks to avoid deadlock
	padata: avoid race in reordering
	samples: move mic/mpssd example code from Documentation
	drm/ast: Fix test for VGA enabled
	drm/ast: Call open_key before enable_mmio in POST code
	drm/ast: Fix AST2400 POST failure without BMC FW or VBIOS
	drm/ttm: Make sure BOs being swapped out are cacheable
	cpmac: remove hopeless #warning
	tracing: Add #undef to fix compile error
	netlink: remove mmapped netlink support
	vxlan: correctly validate VXLAN ID against VXLAN_N_VID
	vti6: return GRE_KEY for vti6
	ipv4: mask tos for input route
	l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
	net: don't call strlen() on the user buffer in packet_bind_spkt()
	dccp: Unlock sock before calling sk_free()
	net/packet: fix overflow in check for priv area size
	usb: hub: Wait for connection to be reestablished after port reset
	net/mlx4_en: Fix bad WQE issue
	net/mlx4_core: Fix racy CQ (Completion Queue) free
	net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT transitions
	futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
	futex: Add missing error handling to FUTEX_REQUEUE_PI
	crypto: cryptd - Assign statesize properly
	crypto: mcryptd - Fix load failure
	crypto: algif_hash - avoid zero-sized array
	crypto: ghash-clmulni - Fix load failure
	s390/qdio: clear DSCI prior to scanning multiple input queues
	s390: TASK_SIZE for kernel threads
	s390: make setup_randomness work
	s390: use correct input data address for setup_randomness
	KVM: s390: Fix guest migration for huge guests resulting in panic
	USB: serial: qcserial: add Dell DW5811e
	usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
	usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
	USB: uss720: fix NULL-deref at probe
	USB: lvtest: fix NULL-deref at probe
	USB: idmouse: fix NULL-deref at probe
	USB: wusbcore: fix NULL-deref at probe
	usb: hub: Fix crash after failure to read BOS descriptor
	USB: fix linked-list corruption in rh_call_control()
	MIPS: ip27: Disable qlge driver in defconfig
	MIPS: ip22: Fix ip28 build for modern gcc
	MIPS: DEC: Avoid la pseudo-instruction in delay slots
	powerpc: Emulation support for load/store instructions on LE
	libceph: don't set weight to IN when OSD is destroyed
	tcp: fix various issues for sockets morphing to listen state
	net: fix socket refcounting in skb_complete_wifi_ack()
	net: fix socket refcounting in skb_complete_tx_timestamp()
	uapi: fix linux/packet_diag.h userspace compilation error
	dccp/tcp: fix routing redirect race
	dccp: fix memory leak during tear-down of unsuccessful connection request
	Input: gscps2 - fix MODULE_DEVICE_TABLE invocation
	Linux 3.18.49

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>