Merge tag 'android14-6.1.155_r00' into android14-6.1

This merges the android14-6.1.155_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

*   6f6441d9 Merge 6.1.155 into android14-6.1-lts
|\
| * 882efbdd Linux 6.1.155
| * a333c5c5 drm/i915/backlight: Return immediately when scale() finds invalid parameters
| * b2f31ae2 minmax: simplify and clarify min_t()/max_t() implementation
| * ab55a0c6 minmax: add a few more MIN_T/MAX_T users
| * 7d4fa074 minmax: make generic MIN() and MAX() macros available everywhere
| * e6684ed3 kmsan: fix out-of-bounds access to shadow memory
| * d3b0d3f8 i40e: add validation for ring_len param
| * 27481c16 i40e: increase max descriptors for XL710
| * 8b9c7719 i40e: fix idx validation in config queues msg
| * 6c3981fd i40e: fix validation of VF state in get resources
| * bfe3a42b drm/ast: Use msleep instead of mdelay for edid read
| * 7800f13d minmax: avoid overly complicated constant expressions in VM code
| * fff222c3 minmax: fix indentation of __cmp_once() and __clamp_once()
| * bc9ff217 minmax: deduplicate __unconst_integer_typeof()
| * 079b92c3 minmax: Introduce {min,max}_array()
| * f9a6f9a8 minmax: add in_range() macro
| * 20fb6fc5 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
| * 192fe94c mm: migrate_device: use more folio in migrate_device_finalize()
| * d7dbe5f6 s390/cpum_cf: Fix uninitialized warning after backport of ce971233
| * af3d855d fbcon: Fix OOB access in font allocation
| * a6eb9f42 fbcon: fix integer overflow in fbcon_do_set_font
| * c1dc0524 mm/hugetlb: fix folio is still mapped when deleted
| * 7b8381f3 afs: Fix potential null pointer dereference in afs_put_server
| * 07b1f63b tracing: dynevent: Add a missing lockdown check on dynevent
| * 54506c63 crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
| * df42f84d i40e: improve VF MAC filters accounting
| * cf524fde i40e: add mask to apply valid bits for itr_idx
| * 02aae5fc i40e: add max boundary check for VF filters
| * 461e0917 i40e: fix input validation logic for action_meta
| * 4d5e804a i40e: fix idx validation in i40e_validate_queue_map
| * cb5d19a6 futex: Prevent use-after-free during requeue-PI
| * 02e4ff49 drm/gma500: Fix null dereference in hdmi teardown
| * 57231204 octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
| * e6b0a62b net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
| * 53ba2284 net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
| * 4863e2ec net: dsa: lantiq_gswip: do also enable or disable cpu port
| * 205ff8e4 selftests: fib_nexthops: Fix creation of non-FDB nexthops
| * ec428fff nexthop: Forbid FDB status change while nexthop is in a group
| * 6d422469 bnxt_en: correct offset handling for IPv6 destination address
| * 6243bda2 Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
| * fba6815a Bluetooth: hci_sync: Fix hci_resume_advertising_sync
| * b254550f ethernet: rvu-af: Remove slash from the driver name
| * 176c81cb can: peak_usb: fix shift-out-of-bounds issue
| * ca4e5135 can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
| * a61ff7ac can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
| * 57d332ce can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
| * c4e582e6 can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
| * 18c64b2a can: etas_es58x: sort the includes by alphabetic order
| * dd8b31ea bpf: Reject bpf_timer for PREEMPT_RT
| * 9507cbeb can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
| * 72ded830 smb: server: don't use delayed_work for post_recv_credits_work
| * 75d9fb6a cpufreq: Initialize cpufreq-based invariance before subsys
| * 38c4a28a arm64: dts: imx8mp: Correct thermal sensor index
| * 85fc3354 mm: folio_may_be_lru_cached() unless folio_test_large()
| * 9557ba5f mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
| * 54c774c6 mm/gup: check ref_count instead of lru before migration
| * 437b4237 mm: add folio_expected_ref_count() for reference count calculation
| * c22fcd23 mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
| * 8634e8eb IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
| * 2879ca58 ALSA: usb-audio: Add mute TLV for playback volumes on more devices
| * 0dbaae13 ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
| * d926dd23 ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
| * 5f7a5d62 usb: core: Add 0x prefix to quirks debug output
| * 5b422452 ALSA: usb-audio: Fix build with CONFIG_INPUT=n
| * 9e4be9a6 ALSA: usb-audio: Convert comma to semicolon
| * c2d5b0a6 ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
| * 6aeadc24 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
| * 279c8296 ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
| * 7bdc56f5 ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
| * 27bc2785 ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
| * 37778019 ALSA: usb-audio: Fix block comments in mixer_quirks
* | 2b0f2da2 Merge 6.1.154 into android14-6.1-lts
|\|
| * 7b34dc04 Linux 6.1.154
| * 1f323a48 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
| * 2b8bbc64 crypto: af_alg: Convert af_alg_sendpage() to use MSG_SPLICE_PAGES
| * 01d1ba10 ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
| * f6e1138d ASoC: q6apm-lpass-dai: close graph on prepare errors
| * 09ff1b1f ASoC: qcom: q6apm-lpass-dai: close graphs before opening a new one
| * 47ade5f9 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
| * 9ccec4f5 net: rfkill: gpio: add DT support
| * ff160500 selftests: mptcp: connect: catch IO errors on listen side
| * f18be272 mptcp: propagate shutdown to subflows when possible
| * 413c1b36 xhci: dbc: Fix full DbC transfer ring after several reconnects
| * 1bf3b024 xhci: dbc: decouple endpoint allocation from initialization
| * d6ef1c66 phy: ti: omap-usb2: fix device leak at unbind
| * aea48dce phy: Use device_get_match_data()
| * e07821a2 phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning
| * 8564416e selftests: mptcp: userspace pm: validate deny-join-id0 flag
| * f84281bb mptcp: pm: nl: announce deny-join-id0 flag
| * 3d7c075c smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
| * 6241b9e2 crypto: af_alg - Set merge to zero early in af_alg_sendmsg
| * 56566873 crypto: af_alg: Indent the loop in af_alg_sendmsg()
| * d85f0989 drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
| * f9a089d0 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
| * 509e5c23 ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
| * 7aa83b9e ASoC: wm8974: Correct PLL rate rounding
| * 7ed74f23 ASoC: wm8940: Correct typo in control name
| * 07471dfe io_uring: include dying ring in task_work "should cancel" state
| * 9d3489ba io_uring: backport io_should_terminate_tw()
| * ab064e01 ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
| * 9cbe7837 selftests: mptcp: avoid spurious errors on TCP disconnect
| * 35ff290c rds: ib: Increment i_fastreg_wrs before bailing out
| * 340c45bf KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
| * e650c91e mmc: mvsdio: Fix dma_unmap_sg() nents value
| * 9da9d29d ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
| * f7e4e954 ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
| * 8f8a08c8 btrfs: tree-checker: fix the incorrect inode ref size check
| * ba0e586d iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
| * 2605cf87 LoongArch: Check the return value when creating kobj
| * e481c2fd LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
| * 83ca7939 power: supply: bq27xxx: restrict no-battery detection to bq27000
| * 208c60d8 power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
| * 4c9b5078 nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
| * 196a3a76 ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
| * bdaab5c6 ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
| * 2786879a octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
| * e1fcd4a9 cnic: Fix use-after-free bugs in cnic_delete_task
| * 1d484058 net: liquidio: fix overflow in octeon_init_instr_queue()
| * e71dae11 Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
| * b3646214 tls: make sure to abort the stream if headers are bogus
| * 17d69972 tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
| * 71b57bfd bonding: don't set oif to bond dev when getting NS target destination
| * 931a7da7 i40e: remove redundant memory barrier when cleaning Tx descs
| * 8f3c4d01 net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
| * f87aa706 mptcp: set remote_deny_join_id0 on SYN recv
| * 81419108 qed: Don't collect too many protection override GRC elements
| * f08d205e dpaa2-switch: fix buffer pool seeding for control traffic
| * aaf900a8 um: virtio_uml: Fix use-after-free after put_device in probe
| * dea5b468 btrfs: fix invalid extref key setup when replaying dentry
| * 993049c9 cgroup: split cgroup_destroy_wq into 3 workqueues
| * ea6838b5 pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
| * 1f97f6cf wifi: mac80211: fix incorrect type for ret
| * 16c9244a wifi: mac80211: increase scan_ies_len for S1G
| * 7d2897fa ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
* | 080c8fab Merge 6.1.153 into android14-6.1-lts
|\|
| * 363a599d Linux 6.1.153
| * 2eaf0c0f net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
| * fa725a42 soc: qcom: mdt_loader: Deal with zero e_shentsize
| * 9ef594d1 soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
| * 23c00148 drm/i915/power: fix size for for_each_set_bit() in abox iteration
| * 9c2e5bb8 drm/amdgpu: fix a memory leak in fence cleanup when unloading
| * 98244fc8 phy: ti-pipe3: fix device leak at unbind
| * e8e20021 phy: tegra: xusb: fix device and OF node leak at probe
| * d9c8ad93 dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
| * 555bd163 dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
| * dfe634be USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
* | d3beb52b Revert "hrtimer: Remove unused function"
* | 4b6b0ee4 Merge 4a19dac7 ("hrtimers: Unconditionally update target CPU base after offline timer migration") into android14-6.1-lts
|\|
| * 4a19dac7 hrtimers: Unconditionally update target CPU base after offline timer migration
| * 5acc7d84 hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
| * f76b38f6 hrtimer: Remove unused function
* | a964fab0 Merge 34cac2d2 ("regulator: sy7636a: fix lifecycle of power good gpio") into android14-6.1-lts
|\|
| * 34cac2d2 regulator: sy7636a: fix lifecycle of power good gpio
| * 5e462fa0 dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
| * 25e6146c dmaengine: idxd: Fix double free in idxd_setup_wqs()
| * 1d9a6288 hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
| * c9ac729e hsr: use rtnl lock when iterating over ports
| * a2accc07 net: hsr: Add VLAN CTAG filter support
| * 6c8b7d47 net: hsr: Add support for MC filtering at the slave device
| * 33b3d3d1 net: hsr: Disable promiscuous mode in offload mode
| * 11393211 can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
| * 8a81aab8 can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
| * 2d8836fa can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
| * b905b2ac i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
| * b36bebb6 igb: fix link test skipping when interface is admin down
| * 5530acec docs: networking: can: change bcm_msg_head frames member to support flexible array
| * ab828b78 tunnels: reset the GSO metadata before reusing the skb
| * 5f1bb554 net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
| * fa879c62 USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
| * d1cf2a21 USB: serial: option: add Telit Cinterion FN990A w/audio compositions
| * e8338f4e dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
| * 9d4fa962 serial: sc16is7xx: fix bug in flow control levels init
| * 535ba454 tty: hvc_console: Call hvc_kick in hvc_write unconditionally
| * 02468e97 Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
| * bfb9520e Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
| * 2c79549b Input: iqs7222 - avoid enabling unused interrupts
| * e4ec6def mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
| * 34d9cafd kernfs: Fix UAF in polling when open file is released
| * f1385ec8 mm/khugepaged: fix the address passed to notifier on testing young
| * 429ed0a9 mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios
| * 2bae1bf3 mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
| * 03582bfb mtd: nand: raw: atmel: Fix comment in timings preparation
| * 74e391f7 mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()
| * 64dc351e mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
| * 3858c443 mm/damon/sysfs: fix use-after-free in state_show()
| * 591ea9c3 libceph: fix invalid accesses to ceph_connection_v1_info
| * c079916d fuse: prevent overflow in copy_file_range return value
| * d7300080 fuse: check if copy_file_range() returns larger than requested size
| * e9874dc4 mtd: rawnand: stm32_fmc2: fix ECC overwrite
| * 75686c49 mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
| * 20f89282 net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
| * 36054554 ocfs2: fix recursive semaphore deadlock in fiemap call
| * 6f3b2d80 mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
| * 17b41ca5 compiler-clang.h: define __SANITIZE_*__ macros only when undefined
| * f5489322 Revert "SUNRPC: Don't allow waiting for exiting tasks"
| * 41886580 EDAC/altera: Delete an inappropriate dma_free_coherent() call
| * 0b8f6420 KVM: SVM: Set synthesized TSA CPUID flags
| * 0389b069 KVM: SVM: Return TSA_SQ_NO and TSA_L1_NO bits in __do_cpuid_func()
| * 8d1e0db1 KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code
| * 7ce12a10 proc: fix type confusion in pde_set_flags()
| * 9c2a6456 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
| * 7583a73c tracing: Silence warning when chunk allocation fails in trace_pid_write
| * 9391ecf6 NFSv4/flexfiles: Fix layout merge mirror check.
| * df1bbf78 ftrace/samples: Fix function size computation
| * 0a14bd68 tracing: Fix tracing_marker may trigger page fault during preempt_disable
| * 65ae0730 NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
| * 330934d2 NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
| * fc4a817d NFSv4: Don't clear capabilities that won't be reset
| * e630fa0d flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
| * bfb05941 tracing: Do not add length to print format in synthetic events
| * a52be849 ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs
| * feda73ad net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
| * cc4a6c51 media: i2c: imx214: Fix link frequency validation
| * f508fc37 media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
| * 69dd5bbd media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
| * 80fc7c7e mm: introduce and use {pgd,p4d}_populate_kernel()
| * cee8913e kunit: kasan_test: disable fortify string checker on kasan_strings() test
* | 91023479 Merge android14-6.1 into android14-6.1-lts
* | 8c8937bc ANDROID: GKI: Disable KABI macros for !CONFIG_64BIT
* | e9420a00 Merge 6.1.152 into android14-6.1-lts
|/
* 3db754f5 Linux 6.1.152
* 0d8ca2b9 x86/vmscape: Add old Intel CPUs to affected list
* 24f90b75 x86/vmscape: Warn when STIBP is disabled with SMT
* 96ab7383 x86/bugs: Move cpu_bugs_smt_update() down
* 893387c1 x86/vmscape: Enable the mitigation
* 15006289 x86/vmscape: Add conditional IBPB mitigation
* 304d1fb2 x86/vmscape: Enumerate VMSCAPE bug
* 55ad07f8 Documentation/hw-vuln: Add VMSCAPE documentation

Change-Id: Ie7056cc366fb46be9ec1431c443a214fb105daa7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>