Merge tag 'android15-6.6.50_r00' into android15-6.6

This merges up to the 6.6.50 LTS release into android15-6.6.  Changes
included in here are:

* 71e124c7 ANDROID: db845c: add hwspin_lock_bus() to symbol list
* 8b26096a Revert "scsi: ufs: core: Check LSDBS cap when !mcq"
*   ffff4c67 Merge 6.6.50 into android15-6.6-lts
|\
| * ad07a290 Linux 6.6.50
| * 9d24eaa2 i2c: Use IS_REACHABLE() for substituting empty ACPI functions
| * f5e9a22d virtio_net: Fix napi_skb_cache_put warning
| * d8915d27 media: uvcvideo: Enforce alignment of frame and interval
| * e3a95f29 drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
| * e50bec62 drm/amd/display: Check BIOS images before it is used
| * 67cf14c0 drm/amd/display: use preferred link settings for dp signal only
| * 800a5ab6 drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
| * 154a50bf drm/amd/display: added NULL check at start of dc_validate_stream
| * da696cbb drm/amd/display: Don't use fsleep for PSR exit waits on dmub replay
| * 381113ef drm/amdgpu: add lock in kfd_process_dequeue_from_device
| * ddfe95f2 drm/amdgpu: add lock in amdgpu_gart_invalidate_tlb
| * 494b42f3 drm/amdgpu: add skip_hw_access checks for sriov
| * 2e91ea29 block: remove the blk_flush_integrity call in blk_integrity_unregister
| * 72f022eb driver: iio: add missing checks on iio_info's callback access
| * 6290d3f5 f2fs: fix to do sanity check on blocks for inline_data inode
| * 862b19f0 wifi: cfg80211: make hash table duplicates more survivable
| * 63ca5b46 hwmon: (k10temp) Check return value of amd_smn_read()
| * 20bf2920 dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
| * cd3851ef dmaengine: altera-msgdma: use irq variant of spin_lock/unlock while invoking callbacks
| * 9d567126 drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
| * d9612c66 gfs2: Revert "Add quota_change type"
| * d93a2f86 crypto: stm32/cryp - call finalize with bh disabled
| * 68957f51 drm/meson: plane: Add error handling
| * ae9018e3 net/mlx5e: SHAMPO, Fix incorrect page release
| * 0b722b81 platform/chrome: cros_ec_lpc: MEC access can use an AML mutex
| * 4be9fd15 smack: tcp: ipv4, fix incorrect labeling
| * 4c114514 regmap: spi: Fix potential off-by-one when calculating reserved size
| * 54a11ce4 drm/amdgu: fix Unintentional integer overflow for mall size
| * 69f397e6 net: remove NULL-pointer net parameter in ip_metrics_convert
| * fc1b1e13 fsnotify: clear PARENT_WATCHED flags lazily
| * 3b9f2d93 usb: typec: ucsi: Fix null pointer dereference in trace
| * 73ec94aa usbip: Don't submit special requests twice
| * f576acf7 media: v4l2-cci: Always assign *val
| * 37d9fd31 rcu/nocb: Remove buggy bypass lock contention mitigation
| * f9a9cf96 pwm: xilinx: Fix u32 overflow issue in 32-bit width PWM mode.
| * 04e787f8 ionic: fix potential irq name truncation
| * fd867e74 RDMA/efa: Properly handle unexpected AQ completions
| * 220725de soc: qcom: smem: Add qcom_smem_bust_hwspin_lock_by_host()
| * a6978d1b hwspinlock: Introduce hwspin_lock_bust()
| * e51077ad wifi: mac80211: check ieee80211_bss_info_change_notify() against MLD
| * 7cdb5158 PCI: al: Check IORESOURCE_BUS existence during probe
| * ea37096a cpufreq: scmi: Avoid overflow of target_freq in fast switch
| * 0bd1be7e wifi: iwlwifi: remove fw_running op
| * 0798e433 drm/amdgpu: update type of buf size to u32 for eeprom functions
| * cdc65b5f drm/kfd: Correct pinned buffer handling at kfd restore and validate process
| * 11071293 wifi: rtw89: ser: avoid multiple deinit on same CAM
| * 7e8d106c drm/amd/pm: check negtive return for table entries
| * 7d265772 drm/amdgpu: the warning dereferencing obj for nbio_v7_4
| * 025798f4 drm/amd/pm: check specific index for smu13
| * d0230b37 drm/amd/pm: check specific index for aldebaran
| * 4ab720b6 drm/amdgpu: fix the waring dereferencing hive
| * 0aad97bf drm/amdgpu: fix dereference after null check
| * d116bb92 drm/amdgpu: Fix the warning division or modulo by zero
| * 58350786 drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs
| * eba7c58b wifi: ath11k: initialize 'ret' in ath11k_qmi_load_file_target_mem()
| * 17d89c79 wifi: ath12k: initialize 'ret' in ath12k_qmi_load_file_target_mem()
| * 59f742e5 apparmor: fix possible NULL pointer dereference
| * f163ba83 drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device
| * d0a43bf3 drm/amdgpu: fix mc_data out-of-bounds read warning
| * f2b7a9f3 drm/amdgpu: fix ucode out-of-bounds read warning
| * f9267972 drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
| * e6ea3b8f drm/amdkfd: Check debug trap enable before write dbg_ev_file
| * a60d1f7f drm/amdgpu: Fix out-of-bounds write warning
| * f71ef2bb drm/amdgpu: Fix the uninitialized variable warning
| * 3ad44174 drm/amdgpu/pm: Fix uninitialized variable agc_btc_response
| * 3e04fa97 drm/amdgpu/pm: Fix uninitialized variable warning for smu10
| * 97667de3 drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt
| * 4dfec5f5 drm/amd/amdgpu: Check tbo resource pointer
| * 4003bac7 drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box
| * 8406158a drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
| * 3dc6bb57 drm/amd/display: Ensure index calculation will not overflow
| * 94b06899 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within decide_fallback_link_setting_max_bw_policy
| * af43ed72 drm/amd/display: Spinlock before reading event
| * 313d3dd4 drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create
| * 13faa9d4 drm/amd/display: Fix Coverity INTERGER_OVERFLOW within construct_integrated_info
| * cb63090a drm/amd/display: Check msg_id before processing transcation
| * 21f9cb44 drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
| * 8b5ccf3d drm/amd/display: Add array index check for hdcp ddc access
| * 48e0b68e drm/amd/display: Check index for aux_rd_interval before using
| * 94cb7770 drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
| * 08e7755f drm/amd/display: Check gpio_id before used as array index
| * 30e60db4 drm/amdgpu: avoid reading vf2pf info size from FB
| * 1a2c8939 drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr
| * f1e261ce drm/amd/pm: fix the Out-of-bounds read warning
| * 4711b134 drm/amd/pm: Fix negative array index read
| * 59dd0d4b drm/amd/pm: fix warning using uninitialized value of max_vid_step
| * 1dbce92f drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr
| * fc0cb02e drm/amd/pm: fix uninitialized variable warning
| * a2f2beab drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc
| * da22d1b9 drm/amdgpu: fix overflowed array index read warning
| * d2fe7ac6 drm/amd/display: Assign linear_pitch_alignment even for VM
| * 761964b7 drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
| * 3d2e1b82 mptcp: pr_debug: add missing \n at the end
| * a088190f mptcp: avoid duplicated SUB_CLOSED events
| * 1f4ca105 selftests: mptcp: join: stop transfer when check is done (part 2.2)
| * 5803af65 selftests: mptcp: join: disable get and dump addr checks
| * 81f2e73e selftests: mptcp: join: test for flush/re-add endpoints
| * f9ca09be selftests: mptcp: join: check re-re-adding ID 0 signal
| * a417ef47 selftests: mptcp: join: validate event numbers
| * b66609e9 selftests: mptcp: add mptcp_lib_events helper
| * 0a37a0ec selftests: mptcp: join: check re-adding init endp with != id
| * 43ca9a10 selftests: mptcp: join: check re-using ID of unused ADD_ADDR
| * a95e3e70 selftests: mptcp: add explicit test case for remove/readd
| * 8863e430 selftests: mptcp: join: cannot rm sf if closed
| * a17d1419 selftests: mptcp: declare event macros in mptcp_lib
| * 485bb198 selftests: mptcp: userspace pm get addr tests
| * 1b8af4ba selftests: mptcp: dump userspace addrs list
| * 05867195 selftests: mptcp: userspace pm create id 0 subflow
| * 2a72ceb8 mptcp: pm: fix RM_ADDR ID for the initial subflow
| * 0229074a mptcp: make pm_remove_addrs_and_subflows static
| * 489f245e ASoC: codecs: ES8326: button detect issue
| * 2eb143e0 ASoC: amd: yc: Support mic on Lenovo Thinkpad E14 Gen 6
| * cc300463 net: usb: qmi_wwan: add MeiG Smart SRM825L
| * 2ea1fab2 dma-debug: avoid deadlock between dma debug vs printk and netconsole
| * b1322bc3 i2c: Fix conditional for substituting empty ACPI functions
| * 8b28f8c5 spi: hisi-kunpeng: Add validation for the minimum value of speed_hz
| * 533e175c ASoC: amd: yc: Support mic on HP 14-em0002la
| * 77e5d743 smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp
| * ad3bc43e net/mlx5: DR, Fix 'stack guard page was hit' error in dr_rule
| * f8b39e2d ALSA: seq: ump: Explicitly reset RPN with Null RPN
| * 9062e984 ALSA: seq: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
| * 7c34c689 ALSA: seq: ump: Use the common RPN/bank conversion context
| * 4ed4e849 ALSA: ump: Explicitly reset RPN with Null RPN
| * 5a494fdb ALSA: ump: Transmit RPN/NRPN message at each MSB/LSB data reception
| * bd819563 ALSA: hda/conexant: Mute speakers at suspend / shutdown
| * 8f11fbe1 ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown
| * 9b090ccd btrfs: tree-checker: validate dref root and objectid
| * 02c19d76 scsi: ufs: core: Bypass quick recovery if force reset is needed
| * 8d1af5c6 scsi: ufs: core: Check LSDBS cap when !mcq
| * 512bd0cd drm: panel-orientation-quirks: Add quirk for OrangePi Neo
| * d5618eae drm/fb-helper: Don't schedule_work() to flush frame buffer during panic()
* | 5d5d11c1 Merge 6.6.49 into android15-6.6-lts
|\|
| * df1a7cc5 Linux 6.6.49
| * d60839a7 apparmor: fix policy_unpack_test on big endian systems
| * 8a3995a3 scsi: aacraid: Fix double-free on probe failure
| * 790a8d36 arm64: dts: freescale: imx93-tqma9352-mba93xxla: fix typo
| * 7cf7de0f arm64: dts: freescale: imx93-tqma9352: fix CMA alloc-ranges
| * f8fb2cd4 arm64: dts: imx93: update default value for snps,clk-csr
| * d0c54c29 arm64: dts: imx93: add nvmem property for eqos
| * 1e59301f arm64: dts: imx93: add nvmem property for fec1
| * 228d69f9 arm64: dts: imx8mp-beacon-kit: Fix Stereo Audio on WM8962
| * 8aaca1c9 ARM: dts: omap3-n900: correct the accelerometer orientation
| * d5469681 usb: cdnsp: fix for Link TRB with TC
| * 72be846d usb: cdnsp: fix incorrect index in cdnsp_get_hw_deq function
| * 8fc7c9dc usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes()
| * 70b43c33 usb: dwc3: st: add missing depopulate in probe error path
| * e1e5e8ea usb: dwc3: st: fix probed platform device ref count on probe error path
| * 7bb11a75 usb: dwc3: core: Prevent USB core invalid event buffer address access
| * df2daed5 usb: dwc3: omap: add missing depopulate in probe error path
| * b3e8696e ARM: dts: imx6dl-yapp43: Increase LED current to match the yapp4 HW design
| * 6d9f4783 USB: serial: option: add MeiG Smart SRM825L
| * 03e3156e scsi: sd: Ignore command SYNCHRONIZE CACHE error if format in progress
| * cdf7efe4 firmware: qcom: scm: Mark get_wq_ctx() as atomic call
| * ea3b6ec3 cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller
| * 1efdbf53 soc: qcom: pmic_glink: Fix race during initialization
| * c704091b soc: qcom: pmic_glink: Actually communicate when remote goes down
| * ef80520b soc: qcom: cmd-db: Map shared memory as WC, not WB
| * 56ad559c nfc: pn533: Add poll mod list filling check
| * 55526afd net: busy-poll: use ktime_get_ns() instead of local_clock()
| * f6f5e39a drm/amd/display: avoid using null object of framebuffer
| * b65116be sctp: fix association labeling in the duplicate COOKIE-ECHO case
| * 28c67f0f gtp: fix a potential NULL pointer dereference
| * 6b598069 bonding: change ipsec_lock from spin lock to mutex
| * 19792758 bonding: extract the use of real_device into local variable
| * 124a688e bonding: implement xdo_dev_state_free and call it after deletion
| * 7aa9f978 selftests: forwarding: local_termination: Down ports on cleanup
| * 7e7d0bd5 selftests: forwarding: no_forwarding: Down ports on cleanup
| * 84f17718 netfilter: nf_tables_ipv6: consider network offset in netdev/egress validation
| * 94ab3170 ethtool: check device is present when getting link settings
| * 1a525d99 wifi: iwlwifi: fw: fix wgds rev 3 exact size
| * 8e51088d netfilter: nf_tables: restore IP sanity checks for netdev/egress
| * 99912d85 iommu: Do not return 0 from map_pages if it doesn't do anything
| * c8525821 Bluetooth: hci_core: Fix not handling hibernation actions
| * 662a5598 Bluetooth: btnxpuart: Fix random crash seen while removing driver
| * 9aa6e15c Bluetooth: btnxpuart: Handle FW Download Abort scenario
| * 9d5df94c Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test
| * 7df36cce dmaengine: dw: Add memory bus width verification
| * e1b63d05 dmaengine: dw: Add peripheral bus width verification
| * 24775bfd phy: xilinx: phy-zynqmp: Fix SGMII linkup failure on resume
| * ffd2e852 dmaengine: dw-edma: Do not enable watermark interrupts for HDMA
| * d3c9a2a6 dmaengine: dw-edma: Fix unmasking STOP and ABORT interrupts for HDMA
| * b47ff45c soundwire: stream: fix programming slave ports for non-continous port maps
| * 954e1893 phy: fsl-imx8mq-usb: fix tuning parameter name
| * b547cab1 iommufd: Do not allow creating areas without READ or WRITE
| * 45958425 selinux,smack: don't bypass permissions check in inode_setsecctx hook
| * 05d2e16a Revert "change alloc_pages name in dma_map_ops to avoid name conflicts"
| * 288d398d cifs: Fix FALLOC_FL_PUNCH_HOLE support
| * 881aee27 mm: Fix missing folio invalidation calls during truncation
| * 9de10f5b ovl: ovl_parse_param_lowerdir: Add missed '\n' for pr_err
| * dce7cbea ovl: fix wrong lowerdir number check for parameter Opt_lowerdir
| * 0e1c9709 ovl: pass string to ovl_parse_layer()
| * c15123bb pinctrl: starfive: jh7110: Correct the level trigger configuration of iev register
| * 2ebdb6e9 pinctrl: mediatek: common-v2: Fix broken bias-disable for PULL_PU_PD_RSEL_TYPE
| * 805cb277 ASoC: SOF: amd: Fix for acp init sequence
| * 30464c31 ASoC: amd: acp: fix module autoloading
| * 2dfbf899 thermal: of: Fix OF node leak in of_thermal_zone_find() error paths
| * 31019a2a thermal: of: Fix OF node leak in thermal_of_trips_init() error path
| * 0199a29e of: Introduce for_each_*_child_of_node_scoped() to automate of_node_put() handling
| * d967f6ae usb: typec: fix up incorrectly backported "usb: typec: tcpm: unregister existing source caps before re-registration"
| * 4ed03758 tracing: Have format file honor EVENT_FILE_FL_FREED
| * 9a9716bb drm/vmwgfx: Fix prime with external buffers
| * 39defab0 drm/amdgpu/swsmu: always force a state reprogram on init
| * 11182b33 drm/amdgpu: align pp_power_profile_mode with kernel docs
| * 09c423d6 selftests: mptcp: join: check re-re-adding ID 0 endp
| * 99c17b3b selftests: mptcp: join: no extra msg if no counter
| * a81c87ac selftests: mptcp: join: check removing ID 0 endpoint
| * dc14d542 mptcp: pm: ADD_ADDR 0 is not a new address
| * 53e21731 mptcp: pm: fix ID 0 endp usage after multiple re-creations
| * 78b04149 mptcp: pm: do not remove already closed subflows
| * edfbc14a mptcp: pm: send ACK on an active subflow
| * 26e0f274 mptcp: pm: reset MPC endp ID when re-added
| * 6d6c1456 mptcp: pm: skip connecting to already established sf
| * 1448d9a3 mptcp: pm: reuse ID 0 after delete and re-add
| * 9e40cd79 mptcp: sched: check both backup in retrans
| * 255bc4fc mptcp: close subflow when receiving TCP+FIN
| * c04cac9a net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response
| * 8e4084ed wifi: mwifiex: duplicate static structs used in driver instances
| * 9d5e5908 wifi: wfx: repair open network AP mode
| * cb739d3c of: Add cleanup.h based auto release via __free(device_node) markings
| * 4ed45fe9 pinctrl: single: fix potential NULL dereference in pcs_get_function()
| * d80bdfaa pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins
| * a01859dd smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()
| * 44013260 btrfs: run delayed iputs when flushing delalloc
| * 51722b99 btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()
| * f6758eb7 LoongArch: Remove the unused dma-direct.h
| * b1922c31 ALSA: seq: Skip event type filtering for UMP events
* | 15dc13fe UPSTREAM: Revert "change alloc_pages name in dma_map_ops to avoid name conflicts"
* | 5d953d23 ANDROID: add two drm symbols to db845c list
* | 387ae830 ANDROID: db845c: add drm_rect_rotate_inv to symbol list
* | 9006a880 Merge 6.6.48 into android15-6.6-lts
|\|
| * c77dee53 Linux 6.6.48
| * a2081b8c tools: move alignment-related macros to new <linux/align.h>
| * 8f04edd5 Input: MT - limit max slots
| * 3d68d107 Revert "s390/dasd: Establish DMA alignment"
| * b8d7b897 net: ngbe: Fix phy mode set to external phy
| * 118fd997 ksmbd: fix race condition between destroy_previous_session() and smb2 operations()
| * c6372cbd drm/amdgpu/vcn: not pause dpg for unified queue
| * 44bb8f18 drm/amdgpu/vcn: identify unified queue in sw init
| * e0aeb26b NFSD: simplify error paths in nfsd_svc()
| * b12caa8f selftests/bpf: Add a test to verify previous stacksafe() fix
| * 7cad3174 bpf: Fix a kernel verifier crash in stacksafe()
| * 19b4397c mm/numa: no task_numa_fault() call if PTE is changed
| * c789a781 mm/numa: no task_numa_fault() call if PMD is changed
| * bb121128 ALSA: timer: Relax start tick time check for slave timer elements
| * 1f3b52c0 igc: Fix qbv tx latency by setting gtxoffset
| * ad569ac6 drm/panel: nt36523: Set 120Hz fps for xiaomi,elish panels
| * ab7554fb drm/msm/mdss: specify cfg bandwidth for SDM670
| * cc9006d0 hwmon: (ltc2992) Fix memory leak in ltc2992_parse_dt()
| * f0974e6b tcp: do not export tcp_twsk_purge()
| * 3d3a8654 platform/x86/intel/ifs: Call release_firmware() when handling errors.
| * 50fe8565 Revert "drm/amd/display: Validate hw_points_num before using it"
| * 8e1f64d4 Revert "usb: gadget: uvc: cleanup request when not in correct state"
| * ce2f28a5 selftests: mptcp: join: check re-using ID of closed subflow
| * f845af67 selftests: mptcp: join: validate fullmesh endp on 1st sf
| * 9a9afbbc mptcp: pm: avoid possible UaF when selecting endp
| * b762e1e3 mptcp: pm: fullmesh: select the right ID later
| * a7a692b7 mptcp: pm: only in-kernel cannot have entries with ID 0
| * 9907af6a mptcp: pm: check add_addr_accept_max before accepting new ADD_ADDR
| * d20bf2c9 mptcp: pm: only decrement add_addr_accepted for MPJ req
| * 43cf912b mptcp: pm: only mark 'subflow' endp as available
| * 01db5184 mptcp: pm: remove mptcp_pm_remove_subflow()
| * 257d56fb mptcp: pm: re-using ID of unused flushed subflows
| * 7b64bdbf mptcp: pm: re-using ID of unused removed subflows
| * cb24bdcd mptcp: pm: re-using ID of unused removed ADD_ADDR
| * cc29c554 nouveau/firmware: use dma non-coherent allocator
| * d25fd6eb pmdomain: imx: wait SSAR when i.MX93 power domain on
| * e6d49dd4 pmdomain: imx: scu-pd: Remove duplicated clocks
| * 7bbf8f8b mmc: dw_mmc: allow biu and ciu clocks to defer
| * c1b17191 mmc: mtk-sd: receive cmd8 data when hs400 tuning fail
| * 9d7629be KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
| * 2d7cb80b cxgb4: add forgotten u64 ivlan cast before shift
| * 11343059 Input: i8042 - use new forcenorestore quirk to replace old buggy quirk combination
| * fdda14ab Input: i8042 - add forcenorestore quirk to leave controller untouched even on s3
| * 2b5f22ea HID: wacom: Defer calculation of resolution until resolution_code is known
| * ac5d3baf MIPS: Loongson64: Set timer mode in cpu-probe
| * 242665bd net: dsa: microchip: fix PTP config failure when using multiple ports
| * 50553ea7 drm/amdgpu: Validate TA binary size
| * 09982d41 ksmbd: the buffer of smb2 query dir response has at least 1 byte
| * 76df3a19 scsi: core: Fix the return value of scsi_logical_block_count()
| * 064dd929 Bluetooth: MGMT: Add error handling to pair_device()
| * 0fa4b4aa smb: client: ignore unhandled reparse tags
| * cac2815f mmc: mmc_test: Fix NULL dereference on allocation failure
| * 88c232fd drm/msm: fix the highest_bank_bit for sc7180
| * aba75693 drm/msm/mdss: Handle the reg bus ICC path
| * 707601fc drm/msm/mdss: Rename path references to mdp_path
| * 9611899f drm/msm/mdss: switch mdss to use devm_of_icc_get()
| * 8b93b3e1 drm/msm/dpu: take plane rotation into account for wide planes
| * 1af8f3db drm/msm/dpu: try multirect based on mdp clock limits
| * a3c5815b drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
| * 6f3aea37 drm/msm/dp: reset the link phy params before link training
| * 3fb61718 drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable()
| * 8e7ef27e drm/msm/dpu: capture snapshot on the first commit_done timeout
| * 801f49c8 drm/msm/dpu: split dpu_encoder_wait_for_event into two functions
| * da7243e5 drm/msm/dpu: drop MSM_ENC_VBLANK support
| * e86721b0 drm/msm/dpu: use drmm-managed allocation for dpu_encoder_phys
| * 4a2798cc drm/msm/dp: fix the max supported bpp logic
| * 69da87fb drm/msm/dpu: don't play tricks with debug macros
| * 6be50c89 net: ovs: fix ovs_drop_reasons error
| * 4bf322e5 net: xilinx: axienet: Fix dangling multicast addresses
| * 14ebcb4a net: xilinx: axienet: Always disable promiscuous mode
| * 7a8c74df octeontx2-af: Fix CPT AF register offset calculation
| * 0279c35d netfilter: flowtable: validate vlan header
| * fa4e6ae3 bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
| * 124b428f ipv6: prevent possible UAF in ip6_xmit()
| * 6ab6bf73 ipv6: fix possible UAF in ip6_finish_output2()
| * af1dde07 ipv6: prevent UAF in ip6_send_skb()
| * cfa692e7 udp: fix receiving fraglist GSO packets
| * 577d6c06 netem: fix return value if duplicate enqueue fails
| * f7d8c2fa net: dsa: mv88e6xxx: Fix out-of-bound access
| * 8ea80ff5 igb: cope with large MAX_SKB_FRAGS
| * da7d3fdd dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()
| * c864bf01 ice: fix truesize operations for PAGE_SIZE >= 8192
| * e9a1df12 ice: fix ICE_LAST_OFFSET formula
| * 58985252 ice: fix page reuse when PAGE_SIZE is over 8k
| * 996ba2f0 bonding: fix xfrm state handling when clearing active slave
| * 4582d4ff bonding: fix xfrm real_dev null pointer dereference
| * 0707260a bonding: fix null pointer deref in bond_ipsec_offload_ok
| * f2b3d38d bonding: fix bond_ipsec_offload_ok return type
| * 467ee0d4 ip6_tunnel: Fix broken GRO
| * 9a131a50 netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
| * b1ac8348 netfilter: nft_counter: Disable BH in nft_counter_offload_stats().
| * 00425508 kcm: Serialise kcm_sendmsg() for the same socket.
| * ed37ac43 net: mctp: test: Use correct skb for route input check
| * 99580ae8 tcp: prevent concurrent execution of tcp_sk_exit_batch
| * 73480616 tcp/dccp: do not care about families in inet_twsk_purge()
| * 9624febd tcp/dccp: bypass empty buckets in inet_twsk_purge()
| * 03225025 selftests: udpgro: report error when receive failed
| * 440efd86 tc-testing: don't access non-existent variable on exception
| * e83b49ec net: mscc: ocelot: serialize access to the injection/extraction groups
| * ff7f554b net: mscc: ocelot: fix QoS class for injected packets with "ocelot-8021q"
| * dd17e1e6 net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and register injection
| * 4177f2b0 Bluetooth: SMP: Fix assumption of Central always being Initiator
| * 50ce4911 Bluetooth: hci_core: Fix LE quote calculation
| * 9b707444 drm/amdkfd: reserve the BO before validating it
| * 15e3bbd8 ALSA: hda/tas2781: Use correct endian conversion
| * 9dcb933a platform/surface: aggregator: Fix warning when controller is destroyed in probe
| * 114858d7 drm/amd/amdgpu: command submission parser for JPEG
| * a50a25dc drm/amd/display: fix cursor offset on rotation 180
| * 6490f063 drm/amd/display: Enable otg synchronization logic for DCN321
| * d15fc910 drm/amd/display: Adjust cursor position
| * f0e86587 btrfs: send: allow cloning non-aligned extent if it ends at i_size
| * 1bca9776 btrfs: replace sb::s_blocksize by fs_info::sectorsize
| * de7bad86 mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0
| * 983e6b26 change alloc_pages name in dma_map_ops to avoid name conflicts
| * f2ce5746 selftests: memfd_secret: don't build memfd_secret test on unsupported arches
| * 7b0e822d selftests/mm: log run_vmtests.sh results in TAP format
| * b4426da8 tools/testing/selftests/mm/run_vmtests.sh: lower the ptrace permissions
| * b77471c6 mm: fix endless reclaim on machines with unaccepted memory
| * 00b395e9 dm suspend: return -ERESTARTSYS instead of -EINTR
| * 84557cd6 riscv: entry: always initialize regs->a0 to -ENOSYS
| * e84f4400 i2c: stm32f7: Add atomic_xfer method to driver
| * 2ff51719 jfs: define xtree root and page independently
| * 34ba4f29 gtp: pull network headers in gtp_dev_xmit()
| * 9c375a95 nvme: fix namespace removal list
| * 6019283e EDAC/skx_common: Allow decoding of SGX addresses
| * 81bd4b07 ionic: check cmd_regs before copying in or out
| * 1ae3ff27 ionic: use pci_is_enabled not open code
| * a855d129 hrtimer: Prevent queuing of hrtimer without a function callback
| * 3cc03d1d drm/amdgpu: fix dereference null return value for the function amdgpu_vm_pt_parent
| * 82f20194 nvme: use srcu for iterating namespace list
| * 913c30f8 Revert "bpf, sockmap: Prevent lock inversion deadlock in map delete elem"
| * 1b2631dd selftests/bpf: Fix a few tests for GCC related warnings.
| * 73c50bd1 nvmet-rdma: fix possible bad dereference when freeing rsps
| * e9c0aa6c ext4: set the type of max_zeroout to unsigned int to avoid overflow
| * 4ca54748 irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
| * def4422f usb: dwc3: core: Skip setting event buffers for host only controllers
| * c0076d2c platform/x86: lg-laptop: fix %s null argument warning
| * 14bd62d5 clocksource: Make watchdog and suspend-timing multiplication overflow safe
| * 831420f2 irqchip/renesas-rzg2l: Do not set TIEN and TINT source at the same time
| * d8d4da5c s390/iucv: fix receive buffer virtual vs physical address confusion
| * 7ad21517 openrisc: Call setup_memory() earlier in the init sequence
| * fbc63fb1 NFS: avoid infinite loop in pnfs_update_layout.
| * 4ff710fd nvmet-tcp: do not continue for invalid icreq
| * be285b8d net: hns3: add checking for vf id of mailbox
| * 454ba174 rtc: nct3018y: fix possible NULL dereference
| * 664ad87c firmware: cirrus: cs_dsp: Initialize debugfs_root to invalid
| * 7ff15407 Bluetooth: bnep: Fix out-of-bound access
| * 5469f609 nvme: clear caller pointer on identify failure
| * 5419f300 usb: gadget: fsl: Increase size of name buffer for endpoints
| * 428fb40b f2fs: fix to do sanity check in update_sit_entry
| * b9b019ac btrfs: delete pointless BUG_ON check on quota root in btrfs_qgroup_account_extent()
| * c7e0e8ac btrfs: change BUG_ON to assertion in tree_move_down()
| * 48256173 btrfs: send: handle unexpected inode in header process_recorded_refs()
| * 4eb8be94 btrfs: send: handle unexpected data in header buffer in begin_cmd()
| * 46ca3ec9 btrfs: handle invalid root reference found in may_destroy_subvol()
| * 6be93055 btrfs: push errors up from add_async_extent()
| * 981a749c btrfs: tests: allocate dummy fs_info and root in test_find_delalloc()
| * f379c3f4 btrfs: change BUG_ON to assertion when checking for delayed_node root
| * 31547100 btrfs: defrag: change BUG_ON to assertion in btrfs_defrag_leaves()
| * a7fec145 btrfs: delayed-inode: drop pointless BUG_ON in __btrfs_remove_delayed_item()
| * 97db7b59 powerpc/boot: Only free if realloc() succeeds
| * 9c96b5b0 powerpc/boot: Handle allocation failure in simple_realloc()
| * 881613a9 f2fs: stop checkpoint when get a out-of-bounds segment
| * 23494bcc rxrpc: Don't pick values out of the wire header when setting up security
| * cbdac824 parisc: Use irq_enter_rcu() to fix warning at kernel/context_tracking.c:367
| * 0f7acd8c memory: stm32-fmc2-ebi: check regmap_read return value
| * 1a45994f x86: Increase brk randomness entropy for 64-bit systems
| * 60563755 md: clean up invalid BUG_ON in md_ioctl
| * 9cf3b89b netlink: hold nlk->cb_mutex longer in __netlink_dump_start()
| * 0e07c0c8 tick: Move got_idle_tick away from common flags
| * 6d4fbad0 clocksource/drivers/arm_global_timer: Guard against division by zero
| * 533893c2 accel/habanalabs: fix debugfs files permissions
| * 0b9f748d virtiofs: forbid newlines in tags
| * a48d1279 hrtimer: Select housekeeping CPU during migration
| * 53b2f353 gpio: sysfs: extend the critical section for unregistering sysfs devices
| * 93249026 drm/lima: set gp bus_stop bit before hard reset
| * aeecb08b net/sun3_82586: Avoid reading past buffer in debug output
| * 6d3ff043 wifi: iwlwifi: mvm: avoid garbage iPN
| * 2f50c1ea media: drivers/media/dvb-core: copy user arrays safely
| * 12b5b959 scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
| * 342352ca fs: binfmt_elf_efpic: don't use missing interpreter's properties
| * b1397fb4 media: pci: cx23885: check cx23885_vdev_init() return
| * 1fb112ce kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open_files
| * d5a9588c riscv: blacklist assembly symbols for kprobe
| * 18b9264a quota: Remove BUG_ON from dqget()
| * 30bbdff9 wifi: ath12k: Add missing qmi_txn_cancel() calls
| * 535e9bd0 fuse: fix UAF in rcu pathwalks
| * e968edf6 afs: fix __afs_break_callback() / afs_drop_open_mmap() race
| * 56a1bf2b btrfs: zlib: fix and simplify the inline extent decompression
| * 0a56dcce ext4: do not trim the group with corrupted block bitmap
| * 5b7766ab nvmet-trace: avoid dereferencing pointer too early
| * 9b139b16 EDAC/skx_common: Filter out the invalid address
| * 73567149 gfs2: Refcounting fix in gfs2_thaw_super
| * 3cde81f8 Bluetooth: hci_conn: Check non NULL function before calling for HFP offload
| * 7a3e7f1e evm: don't copy up 'security.evm' xattr
| * e9c902dd drm/rockchip: vop2: clear afbc en and transform bit for cluster window at linear mode
| * 9324cbc4 ionic: no fw read when PCI reset failed
| * b41d5ce6 ionic: prevent pci disable of already disabled device
| * fb768e05 powerpc/pseries/papr-sysparm: Validate buffer object lengths
| * cbd7ab7d hwmon: (pc87360) Bounds check data->innr usage
| * 61db7910 ASoC: SOF: ipc4: check return value of snd_sof_ipc_msg_data
| * 9badede6 powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
| * dff1afea memory: tegra: Skip SID programming if SID registers aren't set
| * 9064a70e drm/msm: Reduce fallout of fence signaling vs reclaim hangs
| * edb39f62 block: Fix lockdep warning in blk_mq_mark_tag_wait
| * c58f7770 arm64: Fix KASAN random tag seed initialization
| * 85553837 powerpc/topology: Check if a core is online
| * f17c3a37 cpu/SMT: Enable SMT only if a core is online
| * 881eb2fa rust: fix the default format for CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
| * b4dad0ca rust: suppress error messages from CONFIG_{RUSTC,BINDGEN}_VERSION_TEXT
| * 34e13359 rust: work around `bindgen` 0.69.0 issue
| * 7d805d92 hwmon: (ltc2992) Avoid division by zero
| * 67288cbb IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
| * c357e4cf clk: visconti: Add bounds-checking coverage for struct visconti_pll_provider
| * 30819471 wifi: iwlwifi: check for kmemdup() return value in iwl_parse_tlv_firmware()
| * 0a1a3c11 wifi: iwlwifi: fw: Fix debugfs command sending
| * 1cbdaf14 wifi: iwlwifi: abort scan when rfkill on but device enabled
| * 355aec2e gfs2: setattr_chown: Add missing initialization
| * 1a327862 wifi: mac80211: flush STA queues on unauthorization
| * e9f61005 scsi: spi: Fix sshdr use
| * 3b2f3606 ASoC: SOF: Intel: hda-dsp: Make sure that no irq handler is pending before suspend
| * 66ddb976 iommu/arm-smmu-qcom: Add SDM670 MDSS compatible
| * 9649d26d media: qcom: venus: fix incorrect return value
| * abbba076 drm/tegra: Zero-initialize iosys_map
| * 5ee7df81 binfmt_misc: cleanup on filesystem umount
| * ebf6f517 md/raid5-cache: use READ_ONCE/WRITE_ONCE for 'conf->log'
| * 03be3489 accel/habanalabs: fix bug in timestamp interrupt handling
| * db5ba2c1 accel/habanalabs: export dma-buf only if size/offset multiples of PAGE_SIZE
| * fa8cb310 accel/habanalabs/gaudi2: unsecure tpc count registers
| * e6571cff media: s5p-mfc: Fix potential deadlock on condlock
| * 14dde93c platform/x86/intel/ifs: Validate image size
| * 8464e99e staging: ks7010: disable bh on tx_dev_lock
| * a8b30d53 drm/amd/display: Validate hw_points_num before using it
| * 1b60d354 usb: gadget: uvc: cleanup request when not in correct state
| * d2defcdd wifi: mt76: fix race condition related to checking tx queue fill status
| * b87691d7 staging: iio: resolver: ad2s1210: fix use before initialization
| * 84d61738 wifi: ath11k: fix ath11k_mac_op_remain_on_channel() stack usage
| * 55e9057c media: radio-isa: use dev_name to fill in bus_info
| * 14fafdfd drm/amdkfd: Move dma unmapping after TLB flush
| * 7620f9c3 i3c: mipi-i3c-hci: Do not unmap region not mapped for transfer
| * 6c85c7c9 i3c: mipi-i3c-hci: Remove BUG() when Ring Abort request times out
| * 98ed3f40 wifi: ath12k: fix WARN_ON during ath12k_mac_update_vif_chan
| * 10b1f852 drm/bridge: tc358768: Attempt to fix DSI horizontal timings
| * 8653d7bd s390/smp,mcck: fix early IPI handling
| * 0b9c00d9 RDMA/rtrs: Fix the problem of variable not initialized fully
| * 75a92689 i2c: riic: avoid potential division by zero
| * a2225b7a cgroup: Avoid extra dereference in css_populate_dir()
| * a4dc7424 wifi: cw1200: Avoid processing an invalid TIM IE
| * 97f38170 sched/topology: Handle NUMA_NO_NODE in sched_numa_find_nth_cpu()
| * 7ede6ef0 net: ethernet: mtk_wed: check update_wo_rx_stats in mtk_wed_update_rx_stats()
| * 81ba4dd3 rcu: Eliminate rcu_gp_slow_unregister() false positive
| * e160de34 rcu: Dump memory object info if callback function is invalid
| * 4a2f0946 mm: Remove kmem_valid_obj()
| * ee6669b4 wifi: iwlwifi: mvm: fix recovery flow in CSA
| * 86f22e7c wifi: mac80211: fix BA session teardown race
| * 268f84a8 wifi: cfg80211: check wiphy mutex is held for wdev mutex
| * f34056c3 wifi: mac80211: lock wiphy in IP address notifier
| * 5a002f41 ASoC: cs35l45: Checks index of cs35l45_irqs[]
| * 8574cdab ssb: Fix division by zero issue in ssb_calc_clock_rate
| * ec71cc24 drm/amdgpu: access RLC_SPM_MC_CNTL through MMIO in SRIOV runtime
| * 695f692b drm/amd/amdgpu/imu_v11_0: Increase buffer size to ensure all possible values can be stored
| * 51e4630e drm/amd/pm: fix error flow in sensor fetching
| * c3254bc0 ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
| * a8544dec gpio: mlxbf3: Support shutdown() function
| * fa1d4de7 net: hns3: fix a deadlock problem when config TC during resetting
| * 1d2f4a73 net: hns3: use the user's cfg after reset
| * a6c0178c net: hns3: fix wrong use of semaphore up
| * d4b8c4bb selftests: net: lib: kill PIDs before del netns
| * fc9cae21 selftests: net: lib: ignore possible errors
| * 921f1acf vsock: fix recursive ->recvmsg calls
| * f123293d netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests
| * 4340de3e netfilter: nf_tables: Introduce nf_tables_getobj_single
| * cf4ebf77 netfilter: nf_tables: Carry reset boolean in nft_obj_dump_ctx
| * f3b7dc8b netfilter: nf_tables: nft_obj_filter fits into cb->ctx
| * 959c9bf8 netfilter: nf_tables: Carry s_idx in nft_obj_dump_ctx
| * 2c6a79b9 netfilter: nf_tables: A better name for nft_obj_filter
| * ba9b99d9 netfilter: nf_tables: Unconditionally allocate nft_obj_filter
| * 83d37714 netfilter: nf_tables: Drop pointless memset in nf_tables_dump_obj
| * bb6231e5 netfilter: nf_tables: Audit log dump reset after the fact
| * 74e6eb7f netfilter: nf_queue: drop packets with cloned unconfirmed conntracks
| * c7b76049 netfilter: flowtable: initialise extack before use
| * 7b825f91 netfilter: allow ipv6 fragments to arrive on different devices
| * 227355ad tcp: Update window clamping condition
| * ff8292bb mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size
| * c920ab13 mlxbf_gige: disable RX filters until RX path initialized
| * 326a8932 net: ethernet: mtk_wed: fix use-after-free panic in mtk_wed_setup_tc_block_cb()
| * b3917d8a net: dsa: vsc73xx: check busy flag in MDIO operations
| * cec51553 net: dsa: vsc73xx: use read_poll_timeout instead delay loop
| * e077f519 net: dsa: vsc73xx: pass value in phy_write operation
| * 948ee178 net: axienet: Fix register defines comment description
| * ef23c18a atm: idt77252: prevent use after free in dequeue_rx()
| * 6c88d53b net/mlx5e: Correctly report errors for ethtool rx flows
| * b3b9a87a net/mlx5e: Take state lock during tx timeout reporter
| * 920dff7f igc: Fix reset adapter logics when tx mode change
| * 01ad5058 igc: Fix qbv_config_change_errors logics
| * 3fa593db igc: Fix packet still tx after gate close by reducing i226 MAC retry buffer
| * 944f2d4d bpf: Fix updating attached freplace prog in prog_array map
| * 730f7a5e s390/uv: Panic for set and remove shared access UVC errors
| * 09717678 drm/amdgpu/jpeg4: properly set atomics vmid field
| * 0e93fa40 drm/amdgpu/jpeg2: properly set atomics vmid field
| * f1aa7c50 memcg_write_event_control(): fix a user-triggerable oops
| * 2685a2b9 drm/amdgpu: Actually check flags for all context ops.
| * d3ba98ce btrfs: tree-checker: add dev extent item checks
| * 9baca56e btrfs: zoned: properly take lock to read/update block group's zoned variables
| * 251508b9 btrfs: tree-checker: reject BTRFS_FT_UNKNOWN dir type
| * f7668d03 mm/memory-failure: use raw_spinlock_t in struct memory_failure_cpu
| * 5295951b selinux: add the processing of the failure of avc_add_xperms_decision()
| * 01a6b34b selinux: fix potential counting error in avc_add_xperms_decision()
| * dfaa39b0 fs/netfs/fscache_cookie: add missing "n_accesses" check
| * 4291f94f wifi: brcmfmac: cfg80211: Handle SSID based pmksa deletion
| * 221cf832 net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings
| * 65f20b17 net: mana: Fix RX buf alloc_size alignment and atomic op panic
| * 753f1745 rtla/osnoise: Prevent NULL dereference in error handling
| * 67d1d8cc i2c: qcom-geni: Add missing geni_icc_disable in geni_i2c_runtime_resume
| * dd72ae8b fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
| * 97a532c3 bitmap: introduce generic optimized bitmap_size()
| * ef725854 btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
| * 9805a881 s390/cio: rename bitmap_size() -> idset_bitmap_size()
| * 706cc802 fs/ntfs3: add prefix to bitmap_size() and use BITS_TO_U64()
| * b9bda5f6 vfs: Don't evict inode under the inode lru traversing context
| * a6bba25f dm persistent data: fix memory allocation failure
| * 00df2f48 dm resume: don't return EINVAL when signalled
| * 0237b551 arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to NUMA_NO_NODE
| * d2c76802 ACPI: EC: Evaluate _REG outside the EC scope more carefully
| * 03fd525d ACPICA: Add a depth argument to acpi_execute_reg_methods()
| * 6861faf4 i2c: tegra: Do not mark ACPI devices as irq safe
| * 36ebafda riscv: change XIP's kernel_map.size to be size of the entire kernel
| * 051c0a55 KVM: s390: fix validity interception issue when gisa is switched off
| * 93a7e285 s390/dasd: fix error recovery leading to data corruption on ESE devices
| * 31ba1320 ALSA: hda/tas2781: fix wrong calibrated data order
| * 18b3ad2a thunderbolt: Mark XDomain as unplugged when router is removed
| * 6b99de30 xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
| * 9dd90784 ALSA: usb-audio: Support Yamaha P-125 quirk entry
| * 82d06b81 ALSA: usb-audio: Add delay quirk for VIVO USB-C-XE710 HEADSET
| * 5cff7546 char: xillybus: Check USB endpoints when probing device
| * 435fc9ca char: xillybus: Refine workqueue handling
| * a7ad105b char: xillybus: Don't destroy workqueue from work item running on it
| * ac42e0f0 fuse: Initialize beyond-EOF page contents before setting uptodate
| * 61eb7aae selinux: revert our use of vma_is_initial_heap()
| * c2a3b181 Revert "usb: typec: tcpm: clear pd_event queue in PORT_RESET"
| * ea13bd80 Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"
| * 7adc8a3d Revert "ACPI: EC: Evaluate orphan _REG under EC device"
| * 63e80efa tty: atmel_serial: use the correct RTS flag.
| * 8eb92cfc tty: serial: fsl_lpuart: mark last busy before uart_add_one_port
* | 0475cf04 Revert "cgroup: Make operations on the cgroup root_list RCU safe"
* | 4cf14976 Revert "cgroup: Move rcu_head up near the top of cgroup_root"
* | 01ed5e66 Revert "fs: Convert to bdev_open_by_dev()"
* | a8167db0 Revert "jfs: Convert to bdev_open_by_dev()"
* | a1f8d07b Revert "jfs: fix log->bdev_handle null ptr deref in lbmStartIO"
* | d09a1b6c Merge 6.6.47 into android15-6.6-lts
|\|
| * 4c1a2d4c Linux 6.6.47
| * 88042e41 Revert "ata: libata-scsi: Honor the D_SENSE bit for CK_COND=1 and no error"
| * fb6f5624 media: Revert "media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()"
| * 60d90e15 KVM: arm64: Don't pass a TLBI level hint when zapping table entries
| * 2c770086 KVM: arm64: Don't defer TLB invalidation when zapping table entries
| * f3c60ab6 cgroup: Move rcu_head up near the top of cgroup_root
| * 6419341b mm/debug_vm_pgtable: drop RANDOM_ORVALUE trick
| * e2bf9ba1 Revert "Input: bcm5974 - check endpoint type before starting traffic"
| * 6fb93eeb Revert "jfs: fix shift-out-of-bounds in dbJoin"
| * 49df34d2 binfmt_flat: Fix corruption when not offsetting data start
| * f95d175a ALSA: usb: Fix UBSAN warning in parse_audio_unit()
| * 5472b587 fs/ntfs3: Do copy_to_user out of run_lock
| * f650148b jfs: Fix shift-out-of-bounds in dbDiscardAG
| * 6ea10dbb jfs: fix null ptr deref in dtInsertEntry
| * 3db43953 fou: remove warn in gue_gro_receive on unsupported protocol
| * 263df781 f2fs: fix to cover read extent cache access with lock
| * ae00e653 f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
| * bd104cbb bpf, net: Use DEV_STAT_INC()
| * 3f6bbe6e ext4: sanity check for NULL pointer after ext4_force_shutdown
| * 3a2c70ba ext4: convert ext4_da_do_write_end() to take a folio
| * 8a3ac7fb wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
| * 5b485efc mm/page_table_check: support userfault wr-protect entries
| * 737fb785 ext4: do not create EA inode under buffer lock
| * f2a77188 ext4: fold quota accounting into ext4_xattr_inode_lookup_create()
| * 4ea65e20 Bluetooth: RFCOMM: Fix not validating setsockopt user input
| * 0f106133 nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
| * ae7f73e6 net: add copy_safe_from_sockptr() helper
| * bae45e9b mISDN: fix MISDN_TIME_STAMP handling
| * 107449cf fs: Annotate struct file_handle with __counted_by() and use struct_size()
| * 63f13eb5 bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.
| * ef33f029 bpf: Replace bpf_lpm_trie_key 0-length array with flexible array
| * 5fbbd952 pppoe: Fix memory leak in pppoe_sendmsg()
| * 84c176fb net: sctp: fix skb leak in sctp_inq_free()
| * 6cee13d8 net:rds: Fix possible deadlock in rds_message_put
| * a2f2e5a4 quota: Detect loops in quota tree
| * 0252e359 Input: bcm5974 - check endpoint type before starting traffic
| * 2cea502f net: tls, add test to capture error on large splice
| * 2fdcf3c4 erofs: avoid debugging output for (de)compressed data
| * ca9b877a reiserfs: fix uninit-value in comp_keys
| * 984ed056 Squashfs: fix variable overflow triggered by sysbot
| * 2dbaa757 squashfs: squashfs_read_data need to check if the length is 0
| * 0b24b794 jfs: fix shift-out-of-bounds in dbJoin
| * 3999d269 net: don't dump stack on queue timeout
| * e4a44357 jfs: fix log->bdev_handle null ptr deref in lbmStartIO
| * 9641706c jfs: Convert to bdev_open_by_dev()
| * 4365d0d6 fs: Convert to bdev_open_by_dev()
| * e58695f6 wifi: mac80211: fix change_address deadlock during unregister
| * be31c9be wifi: mac80211: take wiphy lock for MAC addr change
| * 77100f2e tcp_metrics: optimize tcp_metrics_flush_all()
| * dd9542ae cgroup: Make operations on the cgroup root_list RCU safe
| * bcd51480 genirq/cpuhotplug: Retry with cpu_online_mask when migration fails
| * 20dbad75 genirq/cpuhotplug: Skip suspended interrupts when restoring affinity
| * a47b5484 nvme/pci: Add APST quirk for Lenovo N60z laptop
| * 26273f5f mm: gup: stop abusing try_grab_folio
| * 9eae1900 nfsd: make svc_stat per-network namespace instead of global
| * 9ae63aab nfsd: remove nfsd_stats, make th_cnt a global counter
| * b670a598 nfsd: make all of the nfsd stats per-network namespace
| * 6f8d6ed3 nfsd: expose /proc/net/sunrpc/nfsd in net namespaces
| * 5b3a1ecf nfsd: rename NFSD_NET_* to NFSD_STATS_*
| * 2e8076df sunrpc: use the struct net as the svc proc private
| * 791be93c sunrpc: remove ->pg_stats from svc_program
| * 465bb0f1 sunrpc: pass in the sv_stats struct through svc_create_pooled
| * 032ed4c6 nfsd: stop setting ->pg_stats for unused stats
| * 1257fe22 sunrpc: don't change ->sv_stats if it doesn't exist
| * 9b31d561 NFSD: Fix frame size warning in svc_export_parse()
| * 5bc2b8f2 NFSD: Rewrite synopsis of nfsd_percpu_counters_init()
| * 9d91b004 LoongArch: Define __ARCH_WANT_NEW_STAT in unistd.h
| * 7c3e55d8 ASoC: topology: Fix route memory corruption
| * bd865c76 ASoC: topology: Clean up route loading
| * d2a2a471 exec: Fix ToCToU between perm check and set-uid/gid usage
* d247f814 Merge branch 'android15-6.6' into android15-6.6-lts
* 1bd56c7d Merge branch 'android15-6.6' into android15-6.6-lts

Change-Id: I004b670039412931c68a39f6ebd72ce8207d730c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>