Merge 4.14.90 into android-4.14

Merge 4.14.90 into android-4.14

Changes in 4.14.90
	timer/debug: Change /proc/timer_list from 0444 to 0400
	pinctrl: sunxi: a83t: Fix IRQ offset typo for PH11
	aio: fix spectre gadget in lookup_ioctx
	userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered
	arm64: dma-mapping: Fix FORCE_CONTIGUOUS buffer clearing
	MMC: OMAP: fix broken MMC on OMAP15XX/OMAP5910/OMAP310
	mmc: sdhci: fix the timeout check window for clock and reset
	fuse: continue to send FUSE_RELEASEDIR when FUSE_OPEN returns ENOSYS
	ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt
	dm thin: send event about thin-pool state change _after_ making it
	dm cache metadata: verify cache has blocks in blocks_are_clean_separate_dirty()
	tracing: Fix memory leak in set_trigger_filter()
	tracing: Fix memory leak of instance function hash filters
	powerpc/msi: Fix NULL pointer access in teardown code
	drm/nouveau/kms: Fix memory leak in nv50_mstm_del()
	Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"
	drm/i915/execlists: Apply a full mb before execution for Braswell
	drm/amdgpu: update SMC firmware image for polaris10 variants
	x86/build: Fix compiler support check for CONFIG_RETPOLINE
	locking: Remove smp_read_barrier_depends() from queued_spin_lock_slowpath()
	locking/qspinlock: Ensure node is initialised before updating prev->next
	locking/qspinlock: Bound spinning on pending->locked transition in slowpath
	locking/qspinlock: Merge 'struct __qspinlock' into 'struct qspinlock'
	locking/qspinlock: Remove unbounded cmpxchg() loop from locking slowpath
	locking/qspinlock: Remove duplicate clear_pending() function from PV code
	locking/qspinlock: Kill cmpxchg() loop when claiming lock from head of queue
	locking/qspinlock: Re-order code
	locking/qspinlock/x86: Increase _Q_PENDING_LOOPS upper bound
	locking/qspinlock, x86: Provide liveness guarantee
	elevator: lookup mq vs non-mq elevators
	netfilter: ipset: Fix wraparound in hash:*net* types
	mac80211: don't WARN on bad WMM parameters from buggy APs
	mac80211: Fix condition validating WMM IE
	IB/hfi1: Remove race conditions in user_sdma send path
	locking/qspinlock: Fix build for anonymous union in older GCC compilers
	mac80211_hwsim: fix module init error paths for netlink
	Input: hyper-v - fix wakeup from suspend-to-idle
	scsi: libiscsi: Fix NULL pointer dereference in iscsi_eh_session_reset
	scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq during unload
	x86/earlyprintk/efi: Fix infinite loop on some screen widths
	drm/msm: Grab a vblank reference when waiting for commit_done
	ARC: io.h: Implement reads{x}()/writes{x}()
	bonding: fix 802.3ad state sent to partner when unbinding slave
	bpf: Fix verifier log string check for bad alignment.
	nfs: don't dirty kernel pages read by direct-io
	SUNRPC: Fix a potential race in xprt_connect()
	sbus: char: add of_node_put()
	drivers/sbus/char: add of_node_put()
	drivers/tty: add missing of_node_put()
	ide: pmac: add of_node_put()
	drm/msm: Fix error return checking
	clk: mvebu: Off by one bugs in cp110_of_clk_get()
	clk: mmp: Off by one in mmp_clk_add()
	Input: synaptics - enable SMBus for HP 15-ay000
	Input: omap-keypad - fix keyboard debounce configuration
	libata: whitelist all SAMSUNG MZ7KM* solid-state disks
	mv88e6060: disable hardware level MAC learning
	net/mlx4_en: Fix build break when CONFIG_INET is off
	ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address handling
	ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart
	ethernet: fman: fix wrong of_node_put() in probe function
	drm/ast: Fix connector leak during driver unload
	cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure cifs)
	vhost/vsock: fix reset orphans race with close timeout
	mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl
	i2c: axxia: properly handle master timeout
	i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI device node
	i2c: uniphier: fix violation of tLOW requirement for Fast-mode
	i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode
	nvmet-rdma: fix response use after free
	rtc: snvs: Add timeouts to avoid kernel lockups
	bpf, arm: fix emit_ldx_r and emit_mov_i using TMP_REG_1
	Linux 4.14.90

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>