Merge 5.15.181 into android13-5.15-lts

Changes in 5.15.181
	ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()
	tipc: fix memory leak in tipc_link_xmit
	net: tls: explicitly disallow disconnect
	net: ethtool: Don't call .cleanup_data when prepare_data fails
	ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
	ata: sata_sx4: Add error handling in pdc20621_i2c_read()
	nvmet-fcloop: swap list_add_tail arguments
	net: ppp: Add bound checking for skb data on ppp_sync_txmung
	nft_set_pipapo: fix incorrect avx2 match of 5th field octet
	umount: Allow superblock owners to force umount
	pm: cpupower: bench: Prevent NULL dereference on malloc failure
	x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
	perf: arm_pmu: Don't disable counter in armpmu_add()
	arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD
	xen/mcelog: Add __nonstring annotations for unterminated strings
	HID: pidff: Convert infinite length from Linux API to PID standard
	HID: pidff: Do not send effect envelope if it's empty
	HID: pidff: Fix null pointer dereference in pidff_find_fields
	ALSA: hda: intel: Fix Optimus when GPU has no sound
	ASoC: fsl_audmix: register card device depends on 'dais' property
	ALSA: usb-audio: Fix CME quirk for UF series keyboards
	page_pool: avoid infinite loop to schedule delayed worker
	jfs: Fix uninit-value access of imap allocated in the diMount() function
	fs/jfs: cast inactags to s64 to prevent potential overflow
	fs/jfs: Prevent integer overflow in AG size calculation
	jfs: Prevent copying of nlink with value 0 from disk inode
	jfs: add sanity check for agwidth in dbMount
	ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
	f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks()
	ahci: add PCI ID for Marvell 88SE9215 SATA Controller
	ext4: protect ext4_release_dquot against freezing
	ext4: ignore xattrs past end
	scsi: st: Fix array overflow in st_setup()
	wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
	net: vlan: don't propagate flags on open
	tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
	Bluetooth: hci_uart: fix race during initialization
	drm: allow encoder mode_set even when connectors change for crtc
	drm/amd/display: Update Cursor request mode to the beginning prefetch always
	drm: panel-orientation-quirks: Add support for AYANEO 2S
	drm: panel-orientation-quirks: Add new quirk for GPD Win 2
	drm/bridge: panel: forbid initializing a panel with unknown connector type
	drivers: base: devres: Allow to release group on device release
	drm/amdkfd: clamp queue size to minimum
	drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
	drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
	PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type
	fbdev: omapfb: Add 'plane' value check
	ktest: Fix Test Failures Due to Missing LOG_FILE Directories
	pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
	pwm: rcar: Simplify multiplication/shift logic
	pwm: rcar: Improve register calculation
	pwm: fsl-ftm: Handle clk_get_rate() returning 0
	bpf: Add endian modifiers to fix endian warnings
	bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
	ext4: don't treat fhandle lookup of ea_inode as FS corruption
	media: i2c: adv748x: Fix test pattern selection mask
	media: venus: hfi: add a check to handle OOB in sfr region
	media: venus: hfi: add check to handle incorrect queue size
	media: vim2m: print device name after registering device
	media: siano: Fix error handling in smsdvb_module_init()
	xenfs/xensyms: respect hypervisor's "next" indication
	arm64: cputype: Add MIDR_CORTEX_A76AE
	arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list
	arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB
	arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list
	spi: cadence-qspi: Fix probe on AM62A LP SK
	mtd: rawnand: brcmnand: fix PM resume warning
	media: streamzap: prevent processing IR data on URB failure
	media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
	media: i2c: ccs: Set the device's runtime PM status correctly in remove
	media: i2c: ccs: Set the device's runtime PM status correctly in probe
	media: i2c: ov7251: Set enable GPIO low in probe
	media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
	media: venus: hfi_parser: add check to avoid out of bound access
	media: venus: hfi_parser: refactor hfi packet parsing logic
	mtd: Add check for devm_kcalloc()
	net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
	mtd: Replace kcalloc() with devm_kcalloc()
	clocksource/drivers/stm32-lptimer: Use wakeup capable instead of init wakeup
	wifi: mt76: Add check for devm_kstrdup()
	wifi: mac80211: fix integer overflow in hwmp_route_info_get()
	ASoC: qdsp6: q6asm-dai: fix q6asm_dai_compr_set_params error path
	bus: mhi: host: Fix race between unprepare and queue_buf
	ext4: fix off-by-one error in do_split
	vdpa/mlx5: Fix oversized null mkey longer than 32bit
	i3c: master: svc: Use readsb helper for reading MDB
	i3c: Add NULL pointer check in i3c_master_queue_ibi()
	jbd2: remove wrong sb->s_sequence check
	mfd: ene-kb3930: Fix a potential NULL pointer dereference
	locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
	lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
	mptcp: fix NULL pointer in can_accept_new_subflow
	mptcp: only inc MPJoinAckHMacFailure for HMAC failures
	mtd: inftlcore: Add error check for inftl_read_oob()
	mtd: rawnand: Add status chack in r852_ready()
	arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
	sparc/mm: disable preemption in lazy mmu mode
	mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
	mm/hwpoison: do not send SIGBUS to processes with recovered clean pages
	sctp: detect and prevent references to a freed transport in sendmsg
	thermal/drivers/rockchip: Add missing rk3328 mapping entry
	crypto: ccp - Fix check for the primary ASP device
	dm-integrity: set ti->error on memory allocation failure
	ftrace: Add cond_resched() to ftrace_graph_set_hash()
	gpio: zynq: Fix wakeup source leaks on device unbind
	ntb: use 64-bit arithmetic for the MSI doorbell mask
	of/irq: Fix device node refcount leakages in of_irq_count()
	of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
	of/irq: Fix device node refcount leakages in of_irq_init()
	PCI: brcmstb: Fix missing of_node_put() in brcm_pcie_probe()
	PCI: Fix reference leak in pci_alloc_child_bus()
	pinctrl: qcom: Clear latched interrupt status when changing IRQ type
	HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
	arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists
	ACPI: platform-profile: Fix CFI violation when accessing sysfs files
	x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
	Bluetooth: hci_uart: Fix another race during initialization
	scsi: hisi_sas: Start delivery hisi_sas_task_exec() directly
	scsi: hisi_sas: Pass abort structure for internal abort
	scsi: hisi_sas: Factor out task prep and delivery code
	scsi: hisi_sas: Fix setting of hisi_sas_slot.is_internal
	scsi: libsas: Delete lldd_clear_aca callback
	scsi: libsas: Add struct sas_tmf_task
	scsi: hisi_sas: Enable force phy when SATA disk directly connected
	wifi: at76c50x: fix use after free access in at76_disconnect
	wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
	wifi: mac80211: Purge vif txq in ieee80211_do_stop()
	wifi: wl1251: fix memory leak in wl1251_tx_work
	scsi: iscsi: Fix missing scsi_host_put() in error path
	md/raid10: fix missing discard IO accounting
	RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
	RDMA/hns: Fix wrong maximum DMA segment size
	RDMA/core: Silence oversized kvmalloc() warning
	Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
	Bluetooth: btrtl: Prevent potential NULL dereference
	Bluetooth: l2cap: Check encryption key size on incoming connection
	Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
	igc: fix PTM cycle trigger logic
	igc: move ktime snapshot into PTM retry loop
	igc: handle the IGC_PTP_ENABLED flag correctly
	igc: cleanup PTP module if probe fails
	net: mctp: Set SOCK_RCU_FREE
	net: openvswitch: fix nested key length validation in the set() action
	cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path
	net: b53: enable BPDU reception for management port
	net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered
	net: dsa: avoid refcount warnings when ds->ops->tag_8021q_vlan_del() fails
	riscv: Properly export reserved regions in /proc/iomem
	riscv: KGDB: Do not inline arch_kgdb_breakpoint()
	riscv: KGDB: Remove ".option norvc/.option rvc" for kgdb_compiled_break
	cpufreq/sched: Fix the usage of CPUFREQ_NEED_UPDATE_LIMITS
	writeback: fix false warning in inode_to_wb()
	Revert "PCI: Avoid reset when disabled via sysfs"
	ASoC: codecs:lpass-wsa-macro: Fix vi feedback rate
	ASoC: codecs:lpass-wsa-macro: Fix logic of enabling vi channels
	asus-laptop: Fix an uninitialized variable
	nfs: move nfs_fhandle_hash to common include file
	nfs: add missing selections of CONFIG_CRC32
	nfsd: decrease sc_count directly if fail to queue dl_recall
	btrfs: correctly escape subvol in btrfs_show_options()
	crypto: caam/qi - Fix drv_ctx refcount bug
	hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
	i2c: cros-ec-tunnel: defer probe if parent EC is not present
	isofs: Prevent the use of too small fid
	loop: properly send KOBJ_CHANGED uevent for disk device
	loop: LOOP_SET_FD: send uevents for partitions
	mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable()
	riscv: Avoid fortify warning in syscall_get_arguments()
	tracing: Fix filter string testing
	virtiofs: add filesystem context source name check
	perf/x86/intel: Allow to update user space GPRs from PEBS records
	perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
	perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX
	perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR
	drm/repaper: fix integer overflows in repeat functions
	drm/amd/pm: Prevent division by zero
	drm/amd/pm/powerplay: Prevent division by zero
	drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero
	drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero
	drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero
	drm/amdgpu/dma_buf: fix page_link check
	drm/nouveau: prime: fix ttm_bo_delayed_delete oops
	drm/sti: remove duplicate object names
	KVM: arm64: Get rid of host SVE tracking/saving
	KVM: arm64: Always start with clearing SVE flag on load
	KVM: arm64: Discard any SVE state when entering KVM guests
	arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE
	arm64/fpsimd: Have KVM explicitly say which FP registers to save
	arm64/fpsimd: Stop using TIF_SVE to manage register saving in KVM
	KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state
	KVM: arm64: Remove host FPSIMD saving for non-protected KVM
	KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN
	KVM: arm64: Calculate cptr_el2 traps on activating traps
	KVM: arm64: Eagerly switch ZCR_EL{1,2}
	cpufreq: Reference count policy in cpufreq_update_limits()
	kbuild: Add '-fno-builtin-wcslen'
	mptcp: sockopt: fix getting IPV6_V6ONLY
	misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
	misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
	misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
	ipv6: release nexthop on device removal
	net: fix crash when config small gso_max_size/gso_ipv4_max_size
	filemap: Fix bounds checking in filemap_read()
	phonet/pep: fix racy skb_queue_empty() use
	bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq
	net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
	x86/pvh: Call C code via the kernel virtual mapping
	powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()
	phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function
	wifi: ath10k: avoid NULL pointer error during sdio remove
	drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links
	drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
	drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencing
	drm/amdgpu: fix usage slab after free
	landlock: Add the errata interface
	nvmet-fc: Remove unused functions
	smb: client: fix potential UAF in cifs_dump_full_key()
	ksmbd: fix potencial out-of-bounds when buffer offset is invalid
	net: make sock_inuse_add() available
	smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
	cifs: Fix UAF in cifs_demultiplex_thread()
	smb: client: fix UAF in async decryption
	smb: client: fix NULL ptr deref in crypto_aead_setkey()
	smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()
	smb: client: fix potential deadlock when releasing mids
	smb: client: fix potential UAF in cifs_stats_proc_show()
	sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
	bpf: avoid holding freeze_mutex during mmap operation
	bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers
	blk-cgroup: support to track if policy is online
	blk-iocost: do not WARN if iocg was already offlined
	ext4: fix timer use-after-free on failed mount
	ipvs: properly dereference pe in ip_vs_add_service
	net: openvswitch: fix race on port output
	openvswitch: fix lockup on tx to unregistering netdev with carrier
	scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan()
	scsi: ufs: bsg: Set bsg_queue to NULL after removal
	net: defer final 'struct net' free in netns dismantle
	MIPS: dec: Declare which_prom() as static
	MIPS: cevt-ds1287: Add missing ds1287.h include
	MIPS: ds1287: Match ds1287_set_base_clock() function types
	jfs: Fix shift-out-of-bounds in dbDiscardAG
	dm cache: fix flushing uninitialized delayed_work on cache_ctr error
	drm/i915/gt: Cleanup partial engine discovery failures
	fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
	mm: fix apply_to_existing_page_range()
	f2fs: check validation of fault attrs in f2fs_build_fault_attr()
	pmdomain: ti: Add a null pointer check to the omap_prm_domain_init
	scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
	f2fs: Add inline to f2fs_build_fault_attr() stub
	Bluetooth: SCO: Fix UAF on sco_sock_timeout
	module: sign with sha512 instead of sha1 by default
	media: streamzap: remove unnecessary ir_raw_event_reset and handle
	media: streamzap: no need for usb pid/vid in device name
	media: streamzap: less chatter
	media: streamzap: remove unused struct members
	media: streamzap: fix race between device disconnection and urb callback
	auxdisplay: hd44780: Convert to platform remove callback returning void
	auxdisplay: hd44780: Fix an API misuse in hd44780.c
	net: dsa: mv88e6xxx: fix VTU methods for 6320 family
	soc: samsung: exynos-chipid: avoid soc_device_to_device()
	soc: samsung: exynos-chipid: Pass revision reg offsets
	soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe()
	iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
	iio: adc: ad7768-1: Fix conversion result sign
	backlight: led_bl: Convert to platform remove callback returning void
	backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
	cifs: print TIDs as hex
	cifs: avoid NULL pointer dereference in dbg call
	cifs: fix integer overflow in match_server()
	gpio: tegra186: Force one interrupt per bank
	gpio: tegra186: fix resource handling in ACPI probe path
	PCI: Coalesce host bridge contiguous apertures
	PCI: Assign PCI domain IDs by ida_alloc()
	PCI: Fix reference leak in pci_register_host_bridge()
	ksmbd: Prevent integer overflow in calculation of deadtime
	selftests/mm: generate a temporary mountpoint for cgroup filesystem
	kmsan: disable strscpy() optimization under KMSAN
	string: Add load_unaligned_zeropad() code path to sized_strscpy()
	drm/msm/a6xx: Improve gpu recovery sequence
	drm/msm/a6xx: Handle GMU prepare-slumber hfi failure
	drm/msm/a6xx: Avoid gx gbit halt during rpm suspend
	drm/msm/a6xx: Fix stale rpmh votes from GPU
	dma/contiguous: avoid warning about unused size_bytes
	cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()
	cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
	cpufreq: cppc: Fix invalid return value in .get() callback
	net: phy: leds: fix memory leak
	tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
	net_sched: hfsc: Fix a UAF vulnerability in class handling
	net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
	iommu/amd: Return an error if vCPU affinity is set for non-vCPU IRTE
	virtio_console: fix missing byte order handling for cols and rows
	net: selftests: initialize TCP header and skb payload with zero
	drm/amd/display: Fix gpu reset in multidisplay config
	KVM: SVM: Allocate IR data using atomic allocation
	mcb: fix a double free bug in chameleon_parse_gdd()
	USB: storage: quirk for ADATA Portable HDD CH94
	mei: me: add panther lake H DID
	KVM: x86: Reset IRTE to host control if *new* route isn't postable
	serial: sifive: lock port in startup()/shutdown() callbacks
	USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
	USB: serial: option: add Sierra Wireless EM9291
	USB: serial: simple: add OWON HDS200 series oscilloscope support
	usb: cdns3: Fix deadlock when using NCM gadget
	usb: chipidea: ci_hdrc_imx: fix usbmisc handling
	usb: chipidea: ci_hdrc_imx: fix call balance of regulator routines
	usb: chipidea: ci_hdrc_imx: implement usb_phy_init() error handling
	USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
	usb: dwc3: gadget: check that event count does not exceed event buffer length
	usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
	usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
	USB: VLI disk crashes if LPM is used
	USB: wdm: handle IO errors in wdm_wwan_port_start
	USB: wdm: close race between wdm_open and wdm_wwan_port_stop
	USB: wdm: wdm_wwan_port_tx_complete mutex in atomic context
	USB: wdm: add annotation
	MIPS: cm: Detect CM quirks from device tree
	crypto: null - Use spin lock instead of mutex
	clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
	parisc: PDT: Fix missing prototype warning
	s390/sclp: Add check for get_zeroed_page()
	s390/tty: Fix a potential memory leak bug
	usb: host: max3421-hcd: Add missing spi_device_id table
	fs/ntfs3: Fix WARNING in ntfs_extend_initialized_size
	usb: dwc3: gadget: Avoid using reserved endpoints on Intel Merrifield
	sound/virtio: Fix cancel_sync warnings on uninitialized work_structs
	dmaengine: dmatest: Fix dmatest waiting less when interrupted
	usb: xhci: Avoid Stop Endpoint retry loop if the endpoint seems Running
	usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
	objtool, ASoC: codecs: wcd934x: Remove potential undefined behavior in wcd934x_slim_irq_handler()
	qibfs: fix _another_ leak
	ntb: reduce stack usage in idt_scan_mws
	sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
	KVM: s390: Don't use %pK through tracepoints
	udmabuf: fix a buf size overflow issue during udmabuf creation
	selftests: ublk: fix test_stripe_04
	xen: Change xen-acpi-processor dom0 dependency
	nvme: requeue namespace scan on missed AENs
	ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
	nvme: re-read ANA log page after ns scan completes
	objtool: Stop UNRET validation on UD2
	selftests/mincore: Allow read-ahead pages to reach the end of the file
	x86/bugs: Use SBPB in write_ibpb() if applicable
	x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
	x86/bugs: Don't fill RSB on context switch with eIBRS
	nvmet-fc: take tgtport reference only once
	nvmet-fc: put ref when assoc->del_work is already scheduled
	ext4: make block validity check resistent to sb bh corruption
	scsi: hisi_sas: Fix I/O errors caused by hardware port ID changes
	scsi: pm80xx: Set phy_attached to zero when device is gone
	loop: aio inherit the ioprio of original request
	ubsan: Fix panic from test_ubsan_out_of_bounds
	md/raid1: Add check for missing source disk in process_checks()
	jfs: define xtree root and page independently
	comedi: jr3_pci: Fix synchronous deletion of timer
	crypto: atmel-sha204a - Set hwrng quality to lowest possible
	net: dsa: mv88e6xxx: fix atu_move_port_mask for 6341 family
	net: dsa: mv88e6xxx: enable PVT for 6321 switch
	net: dsa: mv88e6xxx: enable .port_set_policy() for 6320 family
	drm/amd/display: fix double free issue during amdgpu module unload
	xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
	MIPS: cm: Fix warning if MIPS_CM is disabled
	nvme: fixup scan failure for non-ANA multipath controllers
	PCI: Fix use-after-free in pci_bus_release_domain_nr()
	PCI: Fix dropping valid root bus resources with .end = zero
	PCI: Release resource invalidated by coalescing
	Linux 5.15.181

Change-Id: I6415b75e79b513b0a2539c01290857e175508a19
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>