Merge tag 'android13-5.15.194_r00' into android13-5.15

This merges the android13-5.15.194_r00 tag into the android13-5.15 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* bce84c40 ANDROID: GKI: fix crc issue with include/linux/can/dev.h
*   0049fcb9 Merge 5.15.194 into android13-5.15-lts
|\
| * 29e53a5b Linux 5.15.194
| * 1c532dd2 drm/i915/backlight: Return immediately when scale() finds invalid parameters
| * 45a7527c i40e: add validation for ring_len param
| * 8043ca48 i40e: increase max descriptors for XL710
| * 1fa0aada i40e: fix idx validation in config queues msg
| * 8e35c80f i40e: fix validation of VF state in get resources
| * 3e851448 mm/hugetlb: fix folio is still mapped when deleted
| * 4f52f7c5 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
| * 523edfed af_unix: Don't leave consecutive consumed OOB skbs.
| * ecbfd9ef fbcon: Fix OOB access in font allocation
| * b8a6e853 fbcon: fix integer overflow in fbcon_do_set_font
| * 0d41604d tracing: dynevent: Add a missing lockdown check on dynevent
| * 1b1c3bdb i40e: add mask to apply valid bits for itr_idx
| * 77a35be5 i40e: add max boundary check for VF filters
| * f8c8e118 i40e: fix input validation logic for action_meta
| * 34dfac0c i40e: fix idx validation in i40e_validate_queue_map
| * d382d6da crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
| * e4c1ec11 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
| * e15de807 drm/gma500: Fix null dereference in hdmi teardown
| * 37821b84 net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
| * e8687ab9 net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
| * b9010dba net: dsa: lantiq_gswip: do also enable or disable cpu port
| * cf2d597f selftests: fib_nexthops: Fix creation of non-FDB nexthops
| * 0e7bfe7a nexthop: Forbid FDB status change while nexthop is in a group
| * 5d4856a3 bnxt_en: correct offset handling for IPv6 destination address
| * d6463582 ethernet: rvu-af: Remove slash from the driver name
| * 48822a59 can: peak_usb: fix shift-out-of-bounds issue
| * 6eec67bf can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
| * 60463a1c can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
| * 7ab85762 can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
| * 72de0fac can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
| * 256b64f7 can: etas_es58x: sort the includes by alphabetic order
| * f44124f4 can: etas_es58x: advertise timestamping capabilities and add ioctl support
| * 0a6e1bd2 can: dev: add generic function can_eth_ioctl_hwts()
| * b9a0e6f3 can: dev: add generic function can_ethtool_op_get_ts_info_hwts()
| * 533e3220 can: bittiming: replace CAN units with the generic ones from linux/units.h
| * 33b83a90 can: bittiming: allow TDC{V,O} to be zero and add can_tdc_const::tdc{v,o,f}_min
| * d51c6b51 bpf: Reject bpf_timer for PREEMPT_RT
| * 9ebf8621 can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
| * b32c64db cpufreq: Initialize cpufreq-based invariance before subsys
| * db28f975 arm64: dts: imx8mp: Correct thermal sensor index
| * bb3eeb3a IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
| * 825c17c5 usb: core: Add 0x prefix to quirks debug output
| * 9ba349a3 ALSA: usb-audio: Fix build with CONFIG_INPUT=n
| * 1746e7a7 ALSA: usb-audio: Convert comma to semicolon
| * b4b94f09 ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
| * 4f929461 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
| * 790b167e ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
| * e4f6ae98 ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
| * a4bb77c1 ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
| * 2f56442a ALSA: usb-audio: Fix block comments in mixer_quirks
| * ada22822 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
| * 98c28945 net: rfkill: gpio: add DT support
| * 2f58e6d3 mptcp: propagate shutdown to subflows when possible
| * 773fddf9 ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
| * dde28a51 mptcp: set remote_deny_join_id0 on SYN recv
| * ca9e4e6a phy: ti: omap-usb2: fix device leak at unbind
| * f5648527 phy: Use device_get_match_data()
| * 0df0f4bc phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning
| * 662b75f7 USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
| * 94fac898 usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
| * dbf216ae xhci: dbc: Fix full DbC transfer ring after several reconnects
| * 503ba502 xhci: dbc: decouple endpoint allocation from initialization
| * 84870a62 serial: sc16is7xx: fix bug in flow control levels init
| * dfca6fa9 drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
| * 51a501e9 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
| * 79a06d96 ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
| * e07847f4 ASoC: wm8974: Correct PLL rate rounding
| * 0235a578 ASoC: wm8940: Correct typo in control name
| * 2e94bc64 rds: ib: Increment i_fastreg_wrs before bailing out
| * 96978907 KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
| * 8a297266 mmc: mvsdio: Fix dma_unmap_sg() nents value
| * 4f935a12 btrfs: tree-checker: fix the incorrect inode ref size check
| * 29d9125d power: supply: bq27xxx: restrict no-battery detection to bq27000
| * fe0f602a power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
| * 40fb833c nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
| * 04050559 cnic: Fix use-after-free bugs in cnic_delete_task
| * 428c1dd7 net: liquidio: fix overflow in octeon_init_instr_queue()
| * 3cae9480 Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
| * 33a4fdf0 tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
| * 17cb9b40 i40e: remove redundant memory barrier when cleaning Tx descs
| * 95235d29 net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
| * e0e24571 qed: Don't collect too many protection override GRC elements
| * e4343d40 dpaa2-switch: fix buffer pool seeding for control traffic
| * 5e94e44c um: virtio_uml: Fix use-after-free after put_device in probe
| * f2795d1b cgroup: split cgroup_destroy_wq into 3 workqueues
| * f2ede1f9 pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
| * 0f9cf946 wifi: mac80211: fix incorrect type for ret
| * d2587970 ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
| * 5f2f50aa net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
| * 99f70489 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
| * a8b00326 drm/i915/power: fix size for for_each_set_bit() in abox iteration
| * f1b34970 drm/amdgpu: fix a memory leak in fence cleanup when unloading
| * 91b2c8ee soc: qcom: mdt_loader: Deal with zero e_shentsize
| * e3d490ff phy: ti-pipe3: fix device leak at unbind
| * 4de4344e phy: tegra: xusb: fix device and OF node leak at probe
| * 6ac1599d dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
* | cf4cf828 Merge 24a65b46 ("hrtimers: Unconditionally update target CPU base after offline timer migration") into android13-5.15-lts
|\|
| * 24a65b46 hrtimers: Unconditionally update target CPU base after offline timer migration
| * e90b685c hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
| * 95b76ebe hrtimer: Remove unused function
* | d21b5b1e Revert "genirq: Provide new interfaces for affinity hints"
* | 096fb0dd Revert "i40e: Use irq_update_affinity_hint()"
* | f3106c24 Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path"
* | ae04d876 Merge 5d5385fe ("regulator: sy7636a: fix lifecycle of power good gpio") into android13-5.4-lts
|\|
| * 5d5385fe regulator: sy7636a: fix lifecycle of power good gpio
| * 301a96cc dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
| * 810167fa hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
| * cedfcd09 hsr: use rtnl lock when iterating over ports
| * 11002427 net: hsr: Add VLAN CTAG filter support
| * 7e0ef989 net: hsr: Add support for MC filtering at the slave device
| * d981b968 net: hsr: Disable promiscuous mode in offload mode
| * e202ffd9 can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
| * 5cf37a6f can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
| * 3245eb9c can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
| * b9721a02 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
| * 7d9bd1c2 i40e: Use irq_update_affinity_hint()
| * e7ddb59a genirq: Provide new interfaces for affinity hints
| * 582f5ce2 igb: fix link test skipping when interface is admin down
| * f39a1266 tunnels: reset the GSO metadata before reusing the skb
| * 93a699d6 net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
| * e818c352 USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
| * 93e44049 USB: serial: option: add Telit Cinterion FN990A w/audio compositions
| * 28d20ff4 dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
| * d91604c3 tty: hvc_console: Call hvc_kick in hvc_write unconditionally
| * 9cf2429f Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
| * e32a2ea5 mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
| * 6e2859c6 mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check
| * e0bca4dd mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
| * c3f1ea85 mtd: nand: raw: atmel: Fix comment in timings preparation
| * 123e31a5 mm/khugepaged: fix the address passed to notifier on testing young
| * ea12ab68 libceph: fix invalid accesses to ceph_connection_v1_info
| * 1e1bcbc5 fuse: prevent overflow in copy_file_range return value
| * 5d41589f fuse: check if copy_file_range() returns larger than requested size
| * b8af2e74 mtd: rawnand: stm32_fmc2: fix ECC overwrite
| * ef304049 ocfs2: fix recursive semaphore deadlock in fiemap call
| * 23092f67 mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
| * 5d7267ab compiler-clang.h: define __SANITIZE_*__ macros only when undefined
| * 8178ccf5 EDAC/altera: Delete an inappropriate dma_free_coherent() call
| * 34b87ac4 KVM: SVM: Set synthesized TSA CPUID flags
| * 54270c1b KVM: SVM: Return TSA_SQ_NO and TSA_L1_NO bits in __do_cpuid_func()
| * 2fab1e2a KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code
| * 7429b8b9 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
| * 5f756d18 NFSv4/flexfiles: Fix layout merge mirror check.
| * 9a38cd92 tracing: Fix tracing_marker may trigger page fault during preempt_disable
| * c10744fd NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
| * 89f40500 NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
| * 91902607 NFSv4: Don't clear capabilities that won't be reset
| * 929de8cc flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
| * 76b1a7c2 mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
| * 1cdb41d4 tracing: Do not add length to print format in synthetic events
| * d51e47e2 net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
| * 85d1c5d4 media: i2c: imx214: Fix link frequency validation
| * 6e315852 media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
| * 10d8884e mm: introduce and use {pgd,p4d}_populate_kernel()
| * adb2f26b kunit: kasan_test: disable fortify string checker on kasan_strings() test
| * 69944b3c xfs: short circuit xfs_growfs_data_private() if delta is zero
| * c0950ee2 Revert "fbdev: Disable sysfb device registration when removing conflicting FBs"
* | 2bbc2937 Merge android13-5.15 into android13-5.15-lts
* | 8d934e00 Merge 5.15.193 into android13-5.15-lts
|/
* 43bb8522 Linux 5.15.193
* 70de6783 x86/vmscape: Add old Intel CPUs to affected list
* 79ec330d x86/vmscape: Warn when STIBP is disabled with SMT
* 1cd71b05 x86/bugs: Move cpu_bugs_smt_update() down
* 2f4f2f8f x86/vmscape: Enable the mitigation
* d5490dfa x86/vmscape: Add conditional IBPB mitigation
* f2ed886b x86/vmscape: Enumerate VMSCAPE bug
* a4fff4e5 Documentation/hw-vuln: Add VMSCAPE documentation

Change-Id: Ifc2ca09e4d9b49f7c8f385f431ef9a464bbaa8fe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>