Merge 6.6.87 into android15-6.6-lts

GKI (arm64) relevant 53 out of 269 changes, affecting 63 files +538/-235
  e4b3585a cpufreq: scpi: compare kHz instead of Hz [1 file, +3/-2]
  62173b2f cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() [1 file, +23/-22]
  913b739c lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock [1 file, +0/-2]
  3c64a5ba PM: sleep: Adjust check before setting power.must_resume [3 files, +9/-8]
  01c5ab29 PM: sleep: Fix handling devices with direct_complete set on errors [1 file, +4/-4]
  477b6882 lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*() [1 file, +4/-4]
  36aee810 perf/ring_buffer: Allow the EPOLLRDNORM flag for poll [1 file, +1/-1]
  347641b0 PCI: Use downstream bridges for distributing resources [1 file, +1/-2]
  8b930ddc PCI/ASPM: Fix link state exit during switch upstream function removal [1 file, +9/-8]
  0aad0d29 PCI/portdrv: Only disable pciehp interrupts early when needed [1 file, +5/-3]
  431f5106 PCI: Avoid reset when disabled via sysfs [1 file, +4/-0]
  74578330 PCI: Remove stray put_device() in pci_register_host_bridge() [1 file, +2/-3]
  7c6bb82a remoteproc: core: Clear table_sz when rproc_shutdown [1 file, +1/-0]
  ba1a885c of: property: Increase NR_FWNODE_REFERENCE_ARGS [1 file, +1/-1]
  43681d60 bpf: Use preempt_count() directly in bpf_send_signal_common() [1 file, +1/-1]
  4dc22562 pinctrl: tegra: Set SFIO mode to Mux Register [1 file, +3/-0]
  966fdfc4 leds: Fix LED_OFF brightness race [1 file, +18/-4]
  0566a11d usb: xhci: correct debug message page size calculation [1 file, +3/-3]
  4159cb40 kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page() [1 file, +12/-1]
  0a3bf3bc tty: n_tty: use uint for space returned by tty_write_room() [1 file, +7/-6]
  e6fe7f82 fs/procfs: fix the comment above proc_pid_wchan() [1 file, +1/-1]
  af089264 exfat: fix the infinite loop in exfat_find_last_cluster() [1 file, +1/-1]
  15f15077 rtnetlink: Allocate vfinfo size for VF GUIDs when supported [1 file, +3/-0]
  de37b82b ring-buffer: Fix bytes_dropped calculation issue [1 file, +2/-2]
  69824323 sched/smt: Always inline sched_smt_active() [1 file, +1/-1]
  0a0813d1 context_tracking: Always inline ct_{nmi,irq}_{enter,exit}() [1 file, +4/-4]
  a3160e7f rcu-tasks: Always inline rcu_irq_work_resched() [1 file, +1/-1]
  a74dad10 nvme-pci: clean up CMBMSC when registering CMB fails [1 file, +1/-0]
  d9189555 nvme-pci: skip CMB blocks incompatible with PCI P2P DMA [1 file, +12/-8]
  68ee6f71 perf/core: Fix perf_pmu_register() vs. perf_init_event() [1 file, +26/-2]
  e7d8c570 locking/semaphore: Use wake_q to wake up processes outside lock critical section [1 file, +9/-4]
  5272e986 nvme-pci: fix stuck reset on concurrent DPC and HP [1 file, +12/-1]
  68adc6f1 can: statistics: use atomic access in hot path [3 files, +39/-31]
  aeef6456 udp: Fix memory accounting leak. [1 file, +7/-9]
  b0a1055e vsock: avoid timeout during connect() if the socket is closing [1 file, +5/-1]
  85869532 tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). [2 files, +1/-7]
  ccc331fd net: decrease cached dst counters in dst_release [1 file, +8/-0]
  fbab7bbf ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS [1 file, +25/-12]
  5a2976cc net: fix geneve_opt length integer overflow [4 files, +4/-4]
  21f678f6 ipv6: Start path selection from the first nexthop [1 file, +35/-3]
  fa2f9fc3 ipv6: Do not consider link down nexthops in path selection [1 file, +4/-2]
  1913adb5 perf/core: Fix child_total_time_enabled accounting bug at task exit [1 file, +9/-9]
  77b7dbd3 tracing: Switch trace_events_hist.c code over to use guard() [1 file, +10/-22]
  13edaf99 tracing/hist: Add poll(POLLIN) support on hist file [3 files, +95/-3]
  d24e5e63 tracing/hist: Support POLLPRI event for poll on histogram [1 file, +26/-3]
  41a2c7ab tracing: Correct the refcount if the hist/hist_debug file fails to open [1 file, +18/-6]
  acacd48a usbnet:fix NPE during rx_complete [1 file, +3/-3]
  fc128e85 tracing: Ensure module defining synth event cannot be unloaded while tracing [1 file, +29/-1]
  fad52c9a tracing: Fix synth event printk format for str fields [1 file, +1/-1]
  d12a6016 ext4: don't over-report free space or inodes in statvfs [1 file, +17/-10]
  52a5509a ext4: fix OOB read when checking dotdot dir [1 file, +3/-0]
  753a620a exec: fix the racy usage of fs_struct->in_exec [1 file, +9/-6]
  47ee8328 tracing: Do not use PERF enums when perf is not defined [1 file, +6/-2]

Changes in 6.6.87
	watch_queue: fix pipe accounting mismatch
	x86/mm/pat: cpa-test: fix length for CPA_ARRAY test
	cpufreq: scpi: compare kHz instead of Hz
	smack: dont compile ipv6 code unless ipv6 is configured
	cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
	EDAC/{skx_common,i10nm}: Fix some missing error reports on Emerald Rapids
	x86/fpu: Fix guest FPU state buffer allocation size
	x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()
	x86/platform: Only allow CONFIG_EISA for 32-bit
	x86/sev: Add missing RIP_REL_REF() invocations during sme_enable()
	lockdep/mm: Fix might_fault() lockdep check of current->mm->mmap_lock
	PM: sleep: Adjust check before setting power.must_resume
	RISC-V: KVM: Disable the kernel perf counter during configure
	selinux: Chain up tool resolving errors in install_policy.sh
	EDAC/ie31200: Fix the size of EDAC_MC_LAYER_CHIP_SELECT layer
	EDAC/ie31200: Fix the DIMM size mask for several SoCs
	EDAC/ie31200: Fix the error path order of ie31200_init()
	thermal: int340x: Add NULL check for adev
	PM: sleep: Fix handling devices with direct_complete set on errors
	lockdep: Don't disable interrupts on RT in disable_irq_nosync_lockdep.*()
	perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
	x86/traps: Make exc_double_fault() consistently noreturn
	x86/fpu/xstate: Fix inconsistencies in guest FPU xfeatures
	media: verisilicon: HEVC: Initialize start_bit field
	media: platform: allgro-dvt: unregister v4l2_device on the error path
	platform/x86: dell-ddv: Fix temperature calculation
	ASoC: cs35l41: check the return value from spi_setup()
	HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER
	dt-bindings: vendor-prefixes: add GOcontroll
	ALSA: hda/realtek: Always honor no_shutup_pins
	ASoC: ti: j721e-evm: Fix clock configuration for ti,j7200-cpb-audio compatible
	drm/bridge: ti-sn65dsi86: Fix multiple instances
	drm/dp_mst: Fix drm RAD print
	drm/bridge: it6505: fix HDCP V match check is not performed correctly
	drm: xlnx: zynqmp: Fix max dma segment size
	drm/vkms: Fix use after free and double free on init error
	PCI: Use downstream bridges for distributing resources
	drm/mediatek: mtk_hdmi: Unregister audio platform device on failure
	drm/mediatek: mtk_hdmi: Fix typo for aud_sampe_size member
	PCI/ASPM: Fix link state exit during switch upstream function removal
	drm/msm/dpu: don't use active in atomic_check()
	drm/msm/dsi: Use existing per-interface slice count in DSC timing
	drm/msm/dsi: Set PHY usescase (and mode) before registering DSI host
	drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables'
	PCI: cadence-ep: Fix the driver to send MSG TLP for INTx without data payload
	PCI: brcmstb: Use internal register to change link capability
	PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
	PCI: brcmstb: Fix potential premature regulator disabling
	PCI/portdrv: Only disable pciehp interrupts early when needed
	PCI: Avoid reset when disabled via sysfs
	drm/amd/display: fix type mismatch in CalculateDynamicMetadataParameters()
	PCI: Remove stray put_device() in pci_register_host_bridge()
	PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe
	drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
	drm/mediatek: dsi: fix error codes in mtk_dsi_host_transfer()
	drm/amd/display: avoid NPD when ASIC does not support DMUB
	PCI: histb: Fix an error handling path in histb_pcie_probe()
	PCI: pciehp: Don't enable HPIE when resuming in poll mode
	fbdev: au1100fb: Move a variable assignment behind a null pointer check
	mdacon: rework dependency list
	fbdev: sm501fb: Add some geometry checks.
	clk: amlogic: gxbb: drop incorrect flag on 32k clock
	crypto: hisilicon/sec2 - fix for aead authsize alignment
	crypto: hisilicon/sec2 - fix for sec spec check
	remoteproc: core: Clear table_sz when rproc_shutdown
	of: property: Increase NR_FWNODE_REFERENCE_ARGS
	remoteproc: qcom_q6v5_pas: Make single-PD handling more robust
	libbpf: Fix hypothetical STT_SECTION extern NULL deref case
	selftests/bpf: Fix string read in strncmp benchmark
	x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()
	clk: samsung: Fix UBSAN panic in samsung_clk_init()
	clk: qcom: gcc-msm8953: fix stuck venus0_core0 clock
	RDMA/mana_ib: Ensure variable err is initialized
	remoteproc: qcom_q6v5_pas: Use resource with CX PD for MSM8226
	bpf: Use preempt_count() directly in bpf_send_signal_common()
	lib: 842: Improve error handling in sw842_compress()
	pinctrl: renesas: rza2: Fix missing of_node_put() call
	pinctrl: renesas: rzg2l: Fix missing of_node_put() call
	clk: rockchip: rk3328: fix wrong clk_ref_usb3otg parent
	RDMA/core: Don't expose hw_counters outside of init net namespace
	RDMA/mlx5: Fix calculation of total invalidated pages
	RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
	remoteproc: qcom_q6v5_mss: Handle platforms with one power domain
	IB/mad: Check available slots before posting receive WRs
	pinctrl: tegra: Set SFIO mode to Mux Register
	clk: amlogic: g12b: fix cluster A parent data
	clk: amlogic: gxbb: drop non existing 32k clock parent
	selftests/bpf: Select NUMA_NO_NODE to create map
	clk: clk-imx8mp-audiomix: fix dsp/ocram_a clock parents
	clk: amlogic: g12a: fix mmc A peripheral clock
	x86/entry: Fix ORC unwinder for PUSH_REGS with save_ret=1
	power: supply: max77693: Fix wrong conversion of charge input threshold value
	crypto: nx - Fix uninitialised hv_nxc on error
	RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
	pinctrl: renesas: rzv2m: Fix missing of_node_put() call
	mfd: sm501: Switch to BIT() to mitigate integer overflows
	leds: Fix LED_OFF brightness race
	x86/dumpstack: Fix inaccurate unwinding from exception stacks due to misplaced assignment
	crypto: hisilicon/sec2 - fix for aead auth key length
	pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm()
	clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock
	perf stat: Fix find_stat for mixed legacy/non-legacy events
	isofs: fix KMSAN uninit-value bug in do_isofs_readdir()
	soundwire: slave: fix an OF node reference leak in soundwire slave device
	coresight: catu: Fix number of pages while using 64k pages
	vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
	coresight-etm4x: add isb() before reading the TRCSTATR
	perf pmu: Don't double count common sysfs and json events
	ucsi_ccg: Don't show failed to get FW build information error
	iio: accel: mma8452: Ensure error return on failure to matching oversampling ratio
	iio: accel: msa311: Fix failure to release runtime pm if direct mode claim fails.
	perf arm-spe: Fix load-store operation checking
	perf bench: Fix perf bench syscall loop count
	usb: xhci: correct debug message page size calculation
	fs/ntfs3: Fix a couple integer overflows on 32bit systems
	fs/ntfs3: Prevent integer overflow in hdr_first_de()
	dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister
	iio: adc: ad4130: Fix comparison of channel setups
	iio: adc: ad7124: Fix comparison of channel configs
	perf evlist: Add success path to evlist__create_syswide_maps
	perf units: Fix insufficient array space
	kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()
	kexec: initialize ELF lowest address to ULONG_MAX
	ocfs2: validate l_tree_depth to avoid out-of-bounds access
	arch/powerpc: drop GENERIC_PTDUMP from mpc885_ads_defconfig
	NFSv4: Don't trigger uneccessary scans for return-on-close delegations
	fuse: fix dax truncate/punch_hole fault path
	selftests/mm/cow: fix the incorrect error handling
	um: remove copy_from_kernel_nofault_allowed
	um: hostfs: avoid issues on inode number reuse by host
	i3c: master: svc: Fix missing the IBI rules
	perf python: Fixup description of sample.id event member
	perf python: Decrement the refcount of just created event on failure
	perf python: Don't keep a raw_data pointer to consumed ring buffer space
	perf python: Check if there is space to copy all the event
	staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES
	tty: n_tty: use uint for space returned by tty_write_room()
	fs/procfs: fix the comment above proc_pid_wchan()
	perf tools: annotate asm_pure_loop.S
	objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
	NFS: Shut down the nfs_client only after all the superblocks
	smb: client: Fix netns refcount imbalance causing leaks and use-after-free
	exfat: fix the infinite loop in exfat_find_last_cluster()
	rtnetlink: Allocate vfinfo size for VF GUIDs when supported
	rndis_host: Flag RNDIS modems as WWAN devices
	ksmbd: use aead_request_free to match aead_request_alloc
	ksmbd: fix multichannel connection failure
	ksmbd: fix r_count dec/increment mismatch
	net/mlx5e: SHAMPO, Make reserved size independent of page size
	ring-buffer: Fix bytes_dropped calculation issue
	objtool: Fix segfault in ignore_unreachable_insn()
	LoongArch: Fix help text of CMDLINE_EXTEND in Kconfig
	LoongArch: Rework the arch_kgdb_breakpoint() implementation
	ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid
	octeontx2-af: Fix mbox INTR handler when num VFs > 64
	octeontx2-af: Free NIX_AF_INT_VEC_GEN irq
	objtool: Fix verbose disassembly if CROSS_COMPILE isn't set
	sched/smt: Always inline sched_smt_active()
	context_tracking: Always inline ct_{nmi,irq}_{enter,exit}()
	rcu-tasks: Always inline rcu_irq_work_resched()
	wifi: iwlwifi: fw: allocate chained SG tables for dump
	wifi: iwlwifi: mvm: use the right version of the rate API
	nvme-tcp: fix possible UAF in nvme_tcp_poll
	nvme-pci: clean up CMBMSC when registering CMB fails
	nvme-pci: skip CMB blocks incompatible with PCI P2P DMA
	wifi: brcmfmac: keep power during suspend if board requires it
	affs: generate OFS sequence numbers starting at 1
	affs: don't write overlarge OFS data block size fields
	ALSA: hda/realtek: Fix Asus Z13 2025 audio
	ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0
	perf/core: Fix perf_pmu_register() vs. perf_init_event()
	cifs: fix incorrect validation for num_aces field of smb_acl
	platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet
	platform/x86/intel/vsec: Add Diamond Rapids support
	HID: i2c-hid: improve i2c_hid_get_report error message
	ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA
	ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA
	sched/deadline: Use online cpus for validating runtime
	x86/hyperv/vtl: Stop kernel from probing VTL0 low memory
	wifi: mac80211: flush the station before moving it to UN-AUTHORIZED state
	locking/semaphore: Use wake_q to wake up processes outside lock critical section
	x86/hyperv: Fix output argument to hypercall that changes page visibility
	x86/sgx: Warn explicitly if X86_FEATURE_SGX_LC is not enabled
	nvme-pci: fix stuck reset on concurrent DPC and HP
	drm/amd: Keep display off while going into S4
	ALSA: hda/realtek: Add mute LED quirk for HP Pavilion x360 14-dy1xxx
	can: statistics: use atomic access in hot path
	memory: omap-gpmc: drop no compatible check
	hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9}
	spufs: fix a leak on spufs_new_file() failure
	spufs: fix gang directory lifetimes
	spufs: fix a leak in spufs_create_context()
	riscv: ftrace: Add parentheses in macro definitions of make_call_t0 and make_call_ra
	ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
	ntb: intel: Fix using link status DB's
	firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success
	ALSA: hda/realtek: Fix built-in mic breakage on ASUS VivoBook X515JA
	RISC-V: errata: Use medany for relocatable builds
	x86/uaccess: Improve performance by aligning writes to 8 bytes in copy_user_generic(), on non-FSRM/ERMS CPUs
	ASoC: codecs: rt5665: Fix some error handling paths in rt5665_probe()
	riscv: Fix hugetlb retrieval of number of ptes in case of !present pte
	ASoC: imx-card: Add NULL check in imx_card_probe()
	e1000e: change k1 configuration on MTP and later platforms
	netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only
	netfilter: nf_tables: don't unregister hook when table is dormant
	netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
	net_sched: skbprio: Remove overly strict queue assertions
	net: mvpp2: Prevent parser TCAM memory corruption
	udp: Fix memory accounting leak.
	vsock: avoid timeout during connect() if the socket is closing
	tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu().
	net: decrease cached dst counters in dst_release
	netfilter: nft_tunnel: fix geneve_opt type confusion addition
	ipv6: fix omitted netlink attributes when using RTEXT_FILTER_SKIP_STATS
	net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy
	net: fix geneve_opt length integer overflow
	ipv6: Start path selection from the first nexthop
	ipv6: Do not consider link down nexthops in path selection
	arcnet: Add NULL check in com20020pci_probe()
	net: ibmveth: make veth_pool_store stop hanging
	drm/amdgpu/gfx11: fix num_mec
	perf/core: Fix child_total_time_enabled accounting bug at task exit
	tracing: Allow creating instances with specified system events
	tracing: Switch trace_events_hist.c code over to use guard()
	tracing/hist: Add poll(POLLIN) support on hist file
	tracing/hist: Support POLLPRI event for poll on histogram
	tracing: Correct the refcount if the hist/hist_debug file fails to open
	drm/amd/display: Check link_index before accessing dc->links[]
	usbnet:fix NPE during rx_complete
	LoongArch: Increase ARCH_DMA_MINALIGN up to 16
	LoongArch: BPF: Fix off-by-one error in build_prologue()
	LoongArch: BPF: Don't override subprog's return value
	LoongArch: BPF: Use move_addr() for BPF_PSEUDO_FUNC
	x86/hyperv: Fix check of return value from snp_set_vmsa()
	x86/microcode/AMD: Fix __apply_microcode_amd()'s return value
	ACPI: x86: Extend Lenovo Yoga Tab 3 quirk with skip GPIO event-handlers
	platform/x86: ISST: Correct command storage data length
	ntb_perf: Delete duplicate dmaengine_unmap_put() call in perf_copy_chunk()
	perf/x86/intel: Apply static call for drain_pebs
	perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read
	kunit/overflow: Fix UB in overflow_allocation_test
	btrfs: handle errors from btrfs_dec_ref() properly
	x86/tsc: Always save/restore TSC sched_clock() on suspend/resume
	x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
	acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
	ACPI: resource: Skip IRQ override on ASUS Vivobook 14 X1404VAP
	mmc: omap: Fix memory leak in mmc_omap_new_slot
	mmc: sdhci-pxav3: set NEED_RSP_BUSY capability
	mmc: sdhci-omap: Disable MMC_CAP_AGGRESSIVE_PM for eMMC/SD
	ksmbd: add bounds check for durable handle context
	ksmbd: add bounds check for create lease context
	ksmbd: fix use-after-free in ksmbd_sessions_deregister()
	ksmbd: fix session use-after-free in multichannel connection
	ksmbd: validate zero num_subauth before sub_auth is accessed
	tracing: Fix use-after-free in print_graph_function_flags during tracer switching
	tracing: Ensure module defining synth event cannot be unloaded while tracing
	tracing: Fix synth event printk format for str fields
	tracing/osnoise: Fix possible recursive locking for cpus_read_lock()
	arm64: Don't call NULL in do_compat_alignment_fixup()
	ext4: don't over-report free space or inodes in statvfs
	ext4: fix OOB read when checking dotdot dir
	jfs: fix slab-out-of-bounds read in ea_get()
	jfs: add index corruption check to DT_GETPAGE()
	exec: fix the racy usage of fs_struct->in_exec
	media: streamzap: fix race between device disconnection and urb callback
	nfsd: put dl_stid if fail to queue dl_recall
	NFSD: Skip sending CB_RECALL_ANY when the backchannel isn't up
	tracing: Do not use PERF enums when perf is not defined
	Linux 6.6.87

Change-Id: I87e26d208a45a360e47b50eef0cd31b31045aba5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>