Merge 5.15.195 into android14-5.15-lts

Changes in 5.15.195
	iommu/amd: Add map/unmap_pages() iommu_domain_ops callback support
	scsi: target: target_core_configfs: Add length check to avoid buffer overflow
	media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
	media: rc: fix races with imon_disconnect()
	KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
	udp: Fix memory accounting leak.
	media: tunner: xc5000: Refactor firmware load
	media: tuner: xc5000: Fix use-after-free in xc5000_release
	media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
	USB: serial: option: add SIMCom 8230C compositions
	wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188
	dm-integrity: limit MAX_TAG_SIZE to 255
	perf subcmd: avoid crash in exclude_cmds when excludes is empty
	hid: fix I2C read buffer overflow in raw_event() for mcp2221
	serial: stm32: allow selecting console when the driver is module
	staging: axis-fifo: fix maximum TX packet length check
	staging: axis-fifo: flush RX FIFO on read errors
	driver core/PM: Set power.no_callbacks along with power.no_pm
	platform/x86: int3472: Check for adev == NULL
	crypto: rng - Ensure set_ent is always present
	minmax: add in_range() macro
	net/9p: fix double req put in p9_fd_cancelled
	filelock: add FL_RECLAIM to show_fl_flags() macro
	selftests: arm64: Check fread return value in exec_target
	coresight: trbe: Prevent overflow in PERF_IDX2OFF()
	perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
	x86/vdso: Fix output operand size of RDPID
	regmap: Remove superfluous check for !config in __regmap_init()
	libbpf: Fix reuse of DEVMAP
	cpufreq: scmi: Account for malformed DT in scmi_dev_used_by_cpus()
	ACPI: processor: idle: Fix memory leak when register cpuidle device failed
	soc: qcom: rpmh-rsc: Unconditionally clear _TRIGGER bit for TCS
	pinctrl: meson-gxl: add missing i2c_d pinmux
	blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
	ARM: at91: pm: fix MCKx restore routine
	regulator: scmi: Use int type to store negative error codes
	block: use int to store blk_stack_limits() return value
	PM: sleep: core: Clear power.must_resume in noirq suspend error path
	pinctrl: renesas: Use int type to store negative error codes
	firmware: firmware: meson-sm: fix compile-test default
	arm64: dts: mediatek: mt8516-pumpkin: Fix machine compatible
	pwm: tiehrpwm: Fix corner case in clock divisor calculation
	nvmet-fc: move lsop put work to nvmet_fc_ls_req_op
	i3c: master: svc: Recycle unused IBI slot
	selftests: watchdog: skip ping loop if WDIOF_KEEPALIVEPING not supported
	bpf: Explicitly check accesses to bpf_sock_addr
	smp: Fix up and expand the smp_call_function_many() kerneldoc
	tools/nolibc: make time_t robust if __kernel_old_time_t is missing in host headers
	thermal/drivers/qcom: Make LMH select QCOM_SCM
	thermal/drivers/qcom/lmh: Add missing IRQ includes
	i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD
	i2c: designware: Add disabling clocks when probe fails
	drm/radeon/r600_cs: clean up of dead code in r600_cs
	usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup
	scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
	scsi: myrs: Fix dma_alloc_coherent() error check
	media: rj54n1cb0c: Fix memleak in rj54n1_probe()
	ALSA: lx_core: use int type to store negative error codes
	drm/amdgpu: Power up UVD 3 for FW validation (v2)
	wifi: mwifiex: send world regulatory domain to driver
	PCI: tegra: Fix devm_kcalloc() argument order for port->phys allocation
	tcp: fix __tcp_close() to only send RST when required
	drm/amdkfd: Fix error code sign for EINVAL in svm_ioctl()
	usb: phy: twl6030: Fix incorrect type for ret
	usb: gadget: configfs: Correctly set use_os_string at bind
	misc: genwqe: Fix incorrect cmd field being reported in error
	pps: fix warning in pps_register_cdev when register device fail
	ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping
	ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping
	ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
	fs: ntfs3: Fix integer overflow in run_unpack()
	iio: consumers: Fix offset handling in iio_convert_raw_to_processed()
	netfilter: ipset: Remove unused htable_bits in macro ahash_region
	watchdog: mpc8xxx_wdt: Reload the watchdog timer when enabling the watchdog
	drivers/base/node: handle error properly in register_one_node()
	RDMA/cm: Rate limit destroy CM ID timeout error message
	wifi: mt76: fix potential memory leak in mt76_wmac_probe()
	ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message
	scsi: qla2xxx: edif: Fix incorrect sign of error code
	scsi: qla2xxx: Fix incorrect sign of error code in START_SP_W_RETRIES()
	Revert "usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running"
	RDMA/core: Resolve MAC of next-hop device without ARP support
	IB/sa: Fix sa_local_svc_timeout_ms read race
	Documentation: trace: historgram-design: Separate sched_waking histogram section heading and the following diagram
	wifi: ath10k: avoid unnecessary wait for service ready message
	sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
	sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III
	sparc: fix accurate exception reporting in copy_{from_to}_user for Niagara
	sparc: fix accurate exception reporting in copy_to_user for Niagara 4
	sparc: fix accurate exception reporting in copy_{from,to}_user for M7
	remoteproc: qcom: q6v5: Avoid disabling handover IRQ twice
	coresight: trbe: Return NULL pointer for allocation failures
	NFSv4.1: fix backchannel max_resp_sz verification check
	ipvs: Defer ip_vs_ftp unregister during netns cleanup
	scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
	usb: vhci-hcd: Prevent suspending virtually attached devices
	RDMA/siw: Always report immediate post SQ errors
	net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
	Bluetooth: MGMT: Fix not exposing debug UUID on MGMT_OP_READ_EXP_FEATURES_INFO
	hwrng: ks-sa - fix division by zero in ks_sa_rng_init
	ocfs2: fix double free in user_cluster_connect()
	drivers/base/node: fix double free in register_one_node()
	nfp: fix RSS hash key size when RSS is not supported
	net: ena: return 0 in ena_get_rxfh_key_size() when RSS hash key is not configurable
	net: dlink: handle copy_thresh allocation failure
	Revert "net/mlx5e: Update and set Xon/Xoff upon MTU set"
	Squashfs: fix uninit-value in squashfs_get_parent
	uio_hv_generic: Let userspace take care of interrupt mask
	fs: udf: fix OOB read in lengthAllocDescs handling
	net: nfc: nci: Add parameter validation for packet data
	mfd: vexpress-sysreg: Check the return value of devm_gpiochip_add_data()
	ext4: fix checks for orphan inodes
	mm: hugetlb: avoid soft lockup when mprotect to large memory area
	nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe()
	Input: atmel_mxt_ts - allow reset GPIO to sleep
	Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
	pinctrl: check the return value of pinmux_ops::get_function_name()
	bus: fsl-mc: Check return value of platform_get_resource()
	usb: cdns3: cdnsp-pci: remove redundant pci_disable_device() call
	fs: always return zero on success from replace_fd()
	clocksource/drivers/clps711x: Fix resource leaks in error paths
	iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
	perf evsel: Avoid container_of on a NULL leader
	libperf event: Ensure tracing data is multiple of 8 sized
	clk: at91: peripheral: fix return value
	perf util: Fix compression checks returning -1 as bool
	rtc: x1205: Fix Xicor X1205 vendor prefix
	perf session: Fix handling when buffer exceeds 2 GiB
	perf test: Don't leak workload gopipe in PERF_RECORD_*
	clk: nxp: lpc18xx-cgu: convert from round_rate() to determine_rate()
	clk: nxp: Fix pll0 rate check condition in LPC18xx CGU driver
	cpufreq: tegra186: Set target frequency for all cpus in policy
	scsi: libsas: Add sas_task_find_rq()
	scsi: mvsas: Delete mvs_tag_init()
	scsi: mvsas: Use sas_task_find_rq() for tagging
	scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
	net/mlx4: prevent potential use after free in mlx4_en_do_uc_filter()
	s390/cio: unregister the subchannel while purging
	drm/vmwgfx: Copy DRM hash-table code into driver
	drm/vmwgfx: Fix Use-after-free in validation
	net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
	tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
	net: fsl_pq_mdio: Fix device node reference leak in fsl_pq_mdio_probe
	tools build: Align warning options with perf
	mailbox: zynqmp-ipi: Remove redundant mbox_controller_unregister() call
	mailbox: zynqmp-ipi: Remove dev.parent check in zynqmp_ipi_free_mboxes
	bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
	drm/amdgpu: Add additional DCE6 SCL registers
	drm/amd/display: Add missing DCE6 SCL_HORZ_FILTER_INIT* SRIs
	drm/amd/display: Properly clear SCL_*_FILTER_CONTROL on DCE6
	drm/amd/display: Properly disable scaling on DCE6
	bridge: br_vlan_fill_forward_path_pvid: use br_vlan_group_rcu()
	crypto: essiv - Check ssize for decryption and in-place encryption
	tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single
	gpio: wcd934x: Remove duplicate assignment of of_gpio_n_cells
	gpio: wcd934x: mark the GPIO controller as sleeping
	bpf: Avoid RCU context warning when unpinning htab with internal structs
	ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT
	ACPI: debug: fix signedness issues in read/write helpers
	arm64: dts: qcom: msm8916: Add missing MDSS reset
	ARM: OMAP2+: pm33xx-core: ix device node reference leaks in amx3_idle_init
	xen/events: Cleanup find_virq() return codes
	xen/manage: Fix suspend error path
	firmware: meson_sm: fix device leak at probe
	media: i2c: mt9v111: fix incorrect type for ret
	drm/nouveau: fix bad ret code in nouveau_bo_move_prep
	btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
	bus: mhi: host: Do not use uninitialized 'dev' pointer in mhi_init_irq_setup()
	copy_sighand: Handle architectures where sizeof(unsigned long) < sizeof(u64)
	cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
	crypto: atmel - Fix dma_unmap_sg() direction
	fs/ntfs3: Fix a resource leak bug in wnd_extend()
	iio: dac: ad5360: use int type to store negative error codes
	iio: dac: ad5421: use int type to store negative error codes
	iio: frequency: adf4350: Fix prescaler usage.
	init: handle bootloader identifier in kernel parameters
	iio: imu: inv_icm42600: Drop redundant pm_runtime reinitialization in resume
	iommu/vt-d: PRS isn't usable if PDS isn't supported
	KEYS: trusted_tpm1: Compare HMAC values in constant time
	lib/genalloc: fix device leak in of_gen_pool_get()
	openat2: don't trigger automounts with RESOLVE_NO_XDEV
	parisc: don't reference obsolete termio struct for TC* constants
	nvme-pci: Add TUXEDO IBS Gen8 to Samsung sleep quirk
	powerpc/powernv/pci: Fix underflow and leak issue
	powerpc/pseries/msi: Fix potential underflow and leak issue
	pwm: berlin: Fix wrong register in suspend/resume
	scsi: hpsa: Fix potential memory leak in hpsa_big_passthru_ioctl()
	sctp: Fix MAC comparison to be constant-time
	sparc64: fix hugetlb for sun4u
	sparc: fix error handling in scan_one_device()
	mtd: rawnand: fsmc: Default to autodetect buswidth
	mmc: core: SPI mode remove cmd7
	memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
	rtc: interface: Ensure alarm irq is enabled when UIE is enabled
	rtc: interface: Fix long-standing race when setting alarm
	rseq/selftests: Use weak symbol reference, not definition, to link with glibc
	PCI/sysfs: Ensure devices are powered for config reads
	PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV
	PCI/ERR: Fix uevent on failure to recover
	PCI/AER: Fix missing uevent on recovery when a reset is requested
	PCI/AER: Support errors introduced by PCIe r6.0
	PCI: keystone: Use devm_request_irq() to free "ks-pcie-error-irq" on exit
	PCI: tegra194: Fix broken tegra_pcie_ep_raise_msi_irq()
	spi: cadence-quadspi: Flush posted register writes before INDAC access
	spi: cadence-quadspi: Flush posted register writes before DAC access
	x86/umip: Check that the instruction opcode is at least two bytes
	x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases)
	mm/page_alloc: only set ALLOC_HIGHATOMIC for __GPF_HIGH allocations
	NFSD: Fix destination buffer size in nfsd4_ssc_setup_dul()
	nfsd: nfserr_jukebox in nlm_fopen should lead to a retry
	ext4: verify orphan file size is not too big
	ext4: increase i_disksize to offset + len in ext4_update_disksize_before_punch()
	ext4: correctly handle queries for metadata mappings
	ext4: guard against EA inode refcount underflow in xattr update
	ext4: free orphan info with kvfree
	lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older
	KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
	ASoC: codecs: wcd934x: Simplify with dev_err_probe
	ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()
	Squashfs: add additional inode sanity checking
	Squashfs: reject negative file sizes in squashfs_read_inode()
	media: mc: Clear minor number before put device
	mfd: intel_soc_pmic_chtdc_ti: Fix invalid regmap-config max_register value
	mfd: intel_soc_pmic_chtdc_ti: Drop unneeded assignment for cache_type
	mfd: intel_soc_pmic_chtdc_ti: Set use_single_read regmap_config flag
	net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
	ksmbd: fix error code overwriting in smb2_get_info_filesystem()
	tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
	dm: fix NULL pointer dereference in __dm_suspend()
	locking: Introduce __cleanup() based infrastructure
	fscontext: do not consume log entries when returning -EMSGSIZE
	btrfs: fix the incorrect max_bytes value for find_lock_delalloc_range()
	arm64: dts: qcom: sdm845: Fix slimbam num-channels/ees
	minmax: Introduce {min,max}_array()
	minmax: deduplicate __unconst_integer_typeof()
	minmax: fix indentation of __cmp_once() and __clamp_once()
	minmax: avoid overly complicated constant expressions in VM code
	minmax: add a few more MIN_T/MAX_T users
	minmax: simplify and clarify min_t()/max_t() implementation
	minmax: make generic MIN() and MAX() macros available everywhere
	minmax: don't use max() in situations that want a C constant expression
	minmax: simplify min()/max()/clamp() implementation
	minmax: improve macro expansion and type checking
	minmax: fix up min3() and max3() too
	minmax.h: add whitespace around operators and after commas
	minmax.h: update some comments
	minmax.h: reduce the #define expansion of min(), max() and clamp()
	minmax.h: use BUILD_BUG_ON_MSG() for the lo < hi test in clamp()
	minmax.h: move all the clamp() definitions after the min/max() ones
	minmax.h: simplify the variants of clamp()
	minmax.h: remove some #defines that are only expanded once
	minixfs: Verify inode mode when loading from disk
	pid: Add a judgment for ns null in pid_nr_ns
	fs: Add 'initramfs_options' to set initramfs mount options
	cramfs: Verify inode mode when loading from disk
	writeback: Avoid softlockup when switching many inodes
	writeback: Avoid excessively long inode switching times
	media: switch from 'pci_' to 'dma_' API
	media: cx18: Add missing check after DMA map
	arm64: mte: Do not flag the zero page as PG_mte_tagged
	media: pci/ivtv: switch from 'pci_' to 'dma_' API
	media: pci: ivtv: Add missing check after DMA map
	xen/events: Update virq_to_irq on migration
	media: pci: ivtv: Add check for DMA map result
	mm/slab: make __free(kfree) accept error pointers
	mptcp: pm: in-kernel: usable client side with C-flag
	selftests: mptcp: join: validate C-flag + def limit
	Linux 5.15.195

Change-Id: I4255c957f9f5741e70dfe1b85904e0b454fd1223
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>