Merge 6.12.6 into android16-6.12

GKI (arm64) relevant 39 out of 174 changes, affecting 58 files +843/-596
  9b53d2c2 bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors [1 file, +7/-0]
  26702b34 splice: do not checksum AF_UNIX sockets [1 file, +1/-0]
  8aa9d1ff tcp: check space before adding MPTCP SYN options [1 file, +4/-2]
  29d1e065 blk-cgroup: Fix UAF in blkcg_unpin_online() [1 file, +5/-1]
  cbd06d98 block: Switch to using refcount_t for zone write plugs [1 file, +10/-10]
  eea49fce block: Use a zone write plug BIO work for REQ_NOWAIT BIOs [1 file, +42/-20]
  a4b656ea dm: Fix dm-zoned-reclaim zone write pointer alignment [3 files, +124/-26]
  7fa80134 block: Prevent potential deadlocks in zone write plug error recovery [2 files, +61/-249]
  825bccd9 memcg: slub: fix SUnreclaim for post charged objects [1 file, +18/-3]
  3be6628c ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 [1 file, +2/-0]
  0eae680d block: Ignore REQ_NOWAIT for zone reset and zone finish operations [1 file, +9/-0]
  2588c29a usb: core: hcd: only check primary hcd skip_phy_initialization [1 file, +7/-1]
  5de70cdf bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL" [4 files, +9/-87]
  cab34b0c scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe [1 file, +1/-0]
  dd6b0ca6 usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer [1 file, +6/-3]
  d32babf3 usb: typec: ucsi: Fix completion notifications [1 file, +4/-2]
  2c3ca17a bpf: Check size for BTF-based ctx access of pointer members [3 files, +10/-4]
  e6d1dec1 bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() [2 files, +10/-9]
  dfb15ddf bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog [1 file, +4/-0]
  bf2318e2 bpf, sockmap: Fix race between element replace and close() [1 file, +2/-3]
  2bd517ba bpf, sockmap: Fix update element with same [1 file, +1/-0]
  b2fc4b17 bpf: Augment raw_tp arguments with PTR_MAYBE_NULL [1 file, +138/-0]
  a852c82e tipc: fix NULL deref in cleanup_bearer() [1 file, +6/-1]
  6610c7f8 net: defer final 'struct net' free in netns dismantle [2 files, +20/-1]
  e7b02a0f block: get wp_offset by bdev_offset_from_zone_start [1 file, +1/-1]
  13ba06e2 Bluetooth: Improve setsockopt() handling of malformed user input [6 files, +33/-40]
  45fe7657 netfilter: IDLETIMER: Fix for possible ABBA deadlock [1 file, +28/-24]
  7cf0bd23 netfilter: nf_tables: do not defer rule destruction via call_rcu [2 files, +15/-21]
  356078a5 net/sched: netem: account for backlog updates from child qdisc [1 file, +16/-6]
  f9ecc90b Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating [1 file, +11/-22]
  4ca50db1 Bluetooth: iso: Always release hdev at the end of iso_listen_bis [1 file, +1/-2]
  827f30b1 Bluetooth: iso: Fix recursive locking warning [1 file, +6/-2]
  d0f4a512 Bluetooth: SCO: Add support for 16 bits transparent voice setting [2 files, +16/-14]
  c541d7b5 Bluetooth: iso: Fix circular lock in iso_listen_bis [1 file, +12/-2]
  cbe640d6 Bluetooth: iso: Fix circular lock in iso_conn_big_sync [1 file, +27/-7]
  c1291ea1 blk-mq: move cpuhp callback registering out of q->sysfs_lock [1 file, +92/-6]
  f1a494df block: Fix potential deadlock while freezing queue and acquiring sysfs_lock [3 files, +26/-23]
  1e04ca11 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes [1 file, +52/-3]
  5013bd1e x86/static-call: fix 32-bit build [1 file, +6/-1]

Changes in 6.12.6
	usb: misc: onboard_usb_dev: skip suspend/resume sequence for USB5744 SMBus support
	serial: sh-sci: Check if TX data was written to device in .tx_empty()
	bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
	sched/deadline: Fix replenish_dl_new_period dl_server condition
	perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
	clk: en7523: Fix wrong BUS clock for EN7581
	ksmbd: fix racy issue from session lookup and expire
	splice: do not checksum AF_UNIX sockets
	tcp: check space before adding MPTCP SYN options
	perf ftrace: Fix undefined behavior in cmp_profile_data()
	virtio_net: correct netdev_tx_reset_queue() invocation point
	virtio_ring: add a func argument 'recycle_done' to virtqueue_resize()
	virtio_net: ensure netdev_tx_reset_queue is called on tx ring resize
	riscv: mm: Do not call pmd dtor on vmemmap page table teardown
	riscv: Fix wrong usage of __pa() on a fixmap address
	blk-cgroup: Fix UAF in blkcg_unpin_online()
	block: Switch to using refcount_t for zone write plugs
	block: Use a zone write plug BIO work for REQ_NOWAIT BIOs
	dm: Fix dm-zoned-reclaim zone write pointer alignment
	block: Prevent potential deadlocks in zone write plug error recovery
	gpio: graniterapids: Fix GPIO Ack functionality
	memcg: slub: fix SUnreclaim for post charged objects
	spi: rockchip: Fix PM runtime count on no-op cs
	gpio: ljca: Initialize num before accessing item in ljca_gpio_config
	ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
	ALSA: hda/realtek: Fix headset mic on Acer Nitro 5
	riscv: Fix IPIs usage in kfence_protect_page()
	crypto: hisilicon/debugfs - fix the struct pointer incorrectly offset problem
	drm/panic: remove spurious empty line to clean warning
	usb: host: max3421-hcd: Correctly abort a USB request.
	block: Ignore REQ_NOWAIT for zone reset and zone finish operations
	gpio: graniterapids: Fix vGPIO driver crash
	gpio: graniterapids: Fix incorrect BAR assignment
	gpio: graniterapids: Fix invalid GPI_IS register offset
	gpio: graniterapids: Fix invalid RXEVCFG register bitmask
	gpio: graniterapids: Determine if GPIO pad can be used by driver
	gpio: graniterapids: Check if GPIO line can be used for IRQs
	usb: core: hcd: only check primary hcd skip_phy_initialization
	bpf: Revert "bpf: Mark raw_tp arguments with PTR_MAYBE_NULL"
	ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
	usb: dwc2: Fix HCD resume
	usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
	usb: dwc2: Fix HCD port connection race
	scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
	usb: gadget: midi2: Fix interpretation of is_midi1 bits
	usb: ehci-hcd: fix call balance of clocks handling routines
	usb: typec: anx7411: fix fwnode_handle reference leak
	usb: dwc3: imx8mp: fix software node kernel dump
	usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe()
	usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
	usb: typec: ucsi: Fix completion notifications
	usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
	iommu/tegra241-cmdqv: do not use smp_processor_id in preemptible context
	iommu/vt-d: Remove cache tags before disabling ATS
	iommu/vt-d: Fix qi_batch NULL pointer with nested parent domain
	drm/xe: Call invalidation_fence_fini for PT inval fences in error state
	drm/amdkfd: pause autosuspend when creating pdd
	drm/i915: Fix memory leak by correcting cache object name in error handler
	drm/i915/color: Stop using non-posted DSB writes for legacy LUT
	drm/i915: Fix NULL pointer dereference in capture_engine
	drm/amdgpu: fix UVD contiguous CS mapping problem
	drm/amd/pm: Set SMU v13.0.7 default workload type
	drm/amdgpu: fix when the cleaner shader is emitted
	drm/amdkfd: Dereference null return value
	drm/amdkfd: hard-code cacheline size for gfx11
	drm/amdkfd: hard-code MALL cacheline size for gfx11, gfx12
	xfs: set XFS_SICK_INO_SYMLINK_ZAPPED explicitly when zapping a symlink
	xfs: update btree keys correctly when _insrec splits an inode root block
	xfs: don't drop errno values when we fail to ficlone the entire range
	xfs: return a 64-bit block count from xfs_btree_count_blocks
	xfs: fix null bno_hint handling in xfs_rtallocate_rtg
	xfs: return from xfs_symlink_verify early on V4 filesystems
	xfs: fix scrub tracepoints when inode-rooted btrees are involved
	xfs: only run precommits once per transaction object
	xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
	bpf: Check size for BTF-based ctx access of pointer members
	bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
	bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
	bpf, sockmap: Fix race between element replace and close()
	bpf, sockmap: Fix update element with same
	bpf: Augment raw_tp arguments with PTR_MAYBE_NULL
	perf tools: Fix build-id event recording
	wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
	wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon
	wifi: mac80211: fix a queue stall in certain cases of CSA
	wifi: mac80211: fix station NSS capability initialization order
	perf machine: Initialize machine->env to address a segfault
	acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
	amdgpu/uvd: get ring reference from rq scheduler
	batman-adv: Do not send uninitialized TT changes
	batman-adv: Remove uninitialized data in full table TT response
	batman-adv: Do not let TT changes list grows indefinitely
	tipc: fix NULL deref in cleanup_bearer()
	net/mlx5: DR, prevent potential error pointer dereference
	wifi: cfg80211: sme: init n_channels before channels[] access
	selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
	selftests: mlxsw: sharedbuffer: Remove duplicate test cases
	selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
	ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
	bnxt_en: Fix GSO type for HW GRO packets on 5750X chips
	net: lapb: increase LAPB_HEADER_LEN
	net: defer final 'struct net' free in netns dismantle
	net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
	net: mscc: ocelot: improve handling of TX timestamp for unknown skb
	net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-safe
	net: mscc: ocelot: be resilient to loss of PTP packets during transmission
	net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
	regulator: axp20x: AXP717: set ramp_delay
	spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
	net: sparx5: fix FDMA performance issue
	net: sparx5: fix the maximum frame length register
	ACPI: resource: Fix memory resource type union access
	cxgb4: use port number to set mac addr
	qca_spi: Fix clock speed for multiple QCA7000
	qca_spi: Make driver probing reliable
	ALSA: control: Avoid WARN() for symlink errors
	ASoC: amd: yc: Fix the wrong return value
	Documentation: PM: Clarify pm_runtime_resume_and_get() return value
	block: get wp_offset by bdev_offset_from_zone_start
	bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
	Documentation: networking: Add a caveat to nexthop_compat_mode sysctl
	cifs: Fix rmdir failure due to ongoing I/O on deleted file
	net: renesas: rswitch: fix possible early skb release
	net: renesas: rswitch: fix race window between tx start and complete
	net: renesas: rswitch: fix leaked pointer on error path
	net: renesas: rswitch: avoid use-after-put for a device tree node
	net: renesas: rswitch: handle stop vs interrupt race
	ASoC: tas2781: Fix calibration issue in stress test
	Bluetooth: Improve setsockopt() handling of malformed user input
	libperf: evlist: Fix --cpu argument on hybrid platform
	ASoC: fsl_xcvr: change IFACE_PCM to IFACE_MIXER
	ASoC: fsl_spdif: change IFACE_PCM to IFACE_MIXER
	selftests: netfilter: Stabilize rpath.sh
	netfilter: IDLETIMER: Fix for possible ABBA deadlock
	netfilter: nf_tables: do not defer rule destruction via call_rcu
	net: mana: Fix memory leak in mana_gd_setup_irqs
	net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs
	net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
	net/sched: netem: account for backlog updates from child qdisc
	net, team, bonding: Add netdev_base_features helper
	bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features
	bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
	team: Fix initial vlan_feature set in __team_compute_features
	team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
	ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array
	ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
	Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
	Bluetooth: iso: Always release hdev at the end of iso_listen_bis
	Bluetooth: iso: Fix recursive locking warning
	Bluetooth: SCO: Add support for 16 bits transparent voice setting
	Bluetooth: iso: Fix circular lock in iso_listen_bis
	Bluetooth: iso: Fix circular lock in iso_conn_big_sync
	Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
	net: renesas: rswitch: fix initial MPIC register setting
	net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
	net: dsa: tag_ocelot_8021q: fix broken reception
	drm/xe: fix the ERR_PTR() returned on failure to allocate tiny pt
	drm/xe/reg_sr: Remove register pool
	blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
	kselftest/arm64: abi: fix SVCR detection
	blk-mq: move cpuhp callback registering out of q->sysfs_lock
	block: Fix potential deadlock while freezing queue and acquiring sysfs_lock
	rust: kbuild: set `bindgen`'s Rust target version
	KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
	xen/netfront: fix crash when removing device
	x86: make get_cpu_vendor() accessible from Xen code
	objtool/x86: allow syscall instruction
	x86/static-call: provide a way to do very early static-call updates
	x86/xen: don't do PV iret hypercall through hypercall page
	x86/xen: add central hypercall functions
	x86/xen: use new hypercall functions instead of hypercall page
	x86/xen: remove hypercall page
	x86/static-call: fix 32-bit build
	Linux 6.12.6

Change-Id: I656537654d0b73440e5b76deee63abd58ea68b56
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>