Merge tag 'android15-6.6.100_r00' into android15-6.6

This merges the android15-6.6.100_r00 tag into the android15-6.6 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 5e029729 Revert "sched: Change nr_uninterruptible type to unsigned long"
* e6e2e2e3 Revert "net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime"
* f8cf584f Revert "spi: Add check for 8-bit transfer with 8 IO mode support"
*   0a94163e Merge 6.6.100 into android15-6.6-lts
|\
| * dbcb8d8e Linux 6.6.100
| * 3ee59c38 KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
| * 48e87918 nvmem: layouts: u-boot-env: remove crc32 endianness conversion
| * 35542cbe i2c: omap: fix deprecated of_property_read_bool() use
| * 056b65a0 Revert "selftests/bpf: dummy_st_ops should reject 0 for non-nullable params"
| * c148b728 Revert "selftests/bpf: adjust dummy_st_ops_success to detect additional error"
| * b9e50a51 ASoC: fsl_sai: Force a software reset when starting in consumer mode
| * 8f2852c1 regulator: pwm-regulator: Manage boot-on with disabled PWM channels
| * cad3ec23 regulator: pwm-regulator: Calculate the output voltage for disabled PWMs
| * 7e5ec005 i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
| * a7b84035 i2c: omap: Fix an error handling path in omap_i2c_probe()
| * caa86f8b i2c: omap: Add support for setting mux
| * 6cfbff5f usb: dwc3: qcom: Don't leave BCR asserted
| * 824fa25c usb: hub: Don't try to recover devices lost during warm reset.
| * 668c7b47 usb: hub: Fix flushing of delayed work used for post resume purposes
| * 71f5c98d usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
| * 15fea75a usb: hub: fix detection of high tier USB3 devices behind suspended hubs
| * d5024dc5 arm64: Filter out SME hwcaps when FEAT_SME isn't implemented
| * dc6a6640 clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
| * 4cb17b11 ipv6: make addrconf_wq single threaded
| * 496efa22 sched: Change nr_uninterruptible type to unsigned long
| * f371ad64 Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
| * 74bb4de3 rxrpc: Fix transmission of an abort in response to an abort
| * 7692bde8 rxrpc: Fix recv-recv race of completed call
| * 7ff2d83e net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
| * 7b0d4231 net: bridge: Do not offload IGMP/MLD messages
| * bb515c41 net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
| * 1f3a429c tls: always refresh the queue when reading sock
| * 007142a2 hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
| * bd3051a8 Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
| * 76179961 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
| * dcbc346f ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
| * 6a213143 net/mlx5: Correctly set gso_size when LRO is used
| * ab94e7af Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
| * 4ceefc9c Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
| * f3323b18 Bluetooth: SMP: If an unallowed command is received consider it a failure
| * 32e62491 Bluetooth: hci_sync: fix connectable extended advertising when using static random address
| * c4f16f6b Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
| * 5dd6a441 usb: net: sierra: check for no status endpoint
| * 27591d92 ice: add NULL check in eswitch lag check
| * eda5e38c hwmon: (corsair-cpro) Validate the size of the received input buffer
| * c1872660 selftests: net: increase inter-packet timeout in udpgro.sh
| * 167006f7 wifi: cfg80211: remove scan request n_channels counted_by
| * a2f02a87 nvme: fix misaccounting of nvme-mpath inflight I/O
| * ec158d05 net: phy: Don't register LEDs for genphy
| * 5d95fbbf nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
| * 2baaf5bb smb: client: fix use-after-free in cifs_oplock_break
| * 62dcd9d6 rpl: Fix use-after-free in rpl_do_srh_inline().
| * fbe48f06 net/sched: sch_qfq: Fix race condition on qfq_aggregate
| * 21033b49 block: fix kobject leak in blk_unregister_queue
| * c20dd7e8 net: emaclite: Fix missing pointer increment in aligned_read()
| * bc016b78 cachefiles: Fix the incorrect return value in __cachefiles_write()
| * e7be6791 bpf: Reject %p% format string in bprintf-like helpers
| * 12e023df soundwire: amd: fix for clearing command status register
| * 84830e03 soundwire: amd: fix for handling slave alerts after link is down
| * 673ee92b comedi: Fix initialization of data for instructions that write to subdevice
| * 10f9024a comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
| * 63390b85 comedi: Fix some signed shift left operations
| * c9d3d966 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
| * 8a363702 comedi: das6402: Fix bit shift out of bounds
| * adb7df8a comedi: das16m1: Fix bit shift out of bounds
| * 955e8835 comedi: aio_iiro_16: Fix bit shift out of bounds
| * 7e470d8e comedi: pcl812: Fix bit shift out of bounds
| * 8d8519ae iio: adc: stm32-adc: Fix race in installing chained IRQ handler
| * 6471d4b4 iio: adc: max1363: Reorder mode_list[] entries
| * edff26d0 iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
| * dda42f23 iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
| * 329a80ad soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
| * d93b20c8 soc: aspeed: lpc-snoop: Cleanup resources in stack-order
| * 15a0a5de smb: client: fix use-after-free in crypt_message when using async crypto
| * 0c7b20f7 s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
| * 600f55da pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
| * d510116c net: libwx: properly reset Rx ring descriptor
| * 02770118 net: libwx: fix the using of Rx buffer DMA
| * 3c91a567 net: libwx: remove duplicate page_pool_put_full_page()
| * e30c5fa7 mmc: sdhci_am654: Workaround for Errata i2312
| * 7ac120c0 mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
| * 5bfd0078 mmc: bcm2835: Fix dma_unmap_sg() nents value
| * 4206824a memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
| * 928f3a27 isofs: Verify inode mode when loading from disk
| * 4bb01643 dmaengine: nbpfaxi: Fix memory corruption in probe()
| * 2bae35ac af_packet: fix soft lockup issue caused by tpacket_snd()
| * 67ea5f37 af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
| * e51cf5d4 arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
| * 645af2f0 arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
| * bec18ebc arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
| * 33eba752 net/mlx5: Update the list of the PCI supported devices
| * 29db3339 phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
| * d48845af io_uring/poll: fix POLLERR handling
| * c855b9aa ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
| * 56f99fdb drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
| * 823d7989 tracing/osnoise: Fix crash in timerlat_dump_stack()
| * 6bc94f20 tracing: Add down_write(trace_event_sem) when adding trace event
| * 6ba89b38 tracing/probes: Avoid using params uninitialized in parse_btf_arg()
| * 0e5017d8 HID: core: do not bypass hid_hw_raw_request
| * a1c0b87b HID: core: ensure __hid_request reserves the report ID as the first byte
| * fcda39a9 HID: core: ensure the allocated report buffer can contain the reserved report ID
| * 469a39a3 dm-bufio: fix sched in atomic context
| * 82b29ee8 spi: Add check for 8-bit transfer with 8 IO mode support
| * 415d4966 pch_uart: Fix dma_sync_sg_for_device() nents value
| * db44a558 Input: xpad - set correct controller type for Acer NGR200
| * 0f6f30f5 nvmem: imx-ocotp: fix MAC address byte length
| * 0cd051cb thunderbolt: Fix bit masking in tb_dp_port_set_hops()
| * dc52aff5 thunderbolt: Fix wake on connect at runtime
| * e6a2ff56 i2c: stm32: fix the device used for the DMA map
| * 58bdd516 usb: gadget: configfs: Fix OOB read on empty string write
| * ec35a712 usb: musb: fix gadget state on disconnect
| * 311c434f USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
| * 909d8041 USB: serial: option: add Foxconn T99W640
| * 84c32006 USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
| * ad2437f4 phy: tegra: xusb: Disable periodic tracking on Tegra234
| * 491175c1 phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
| * 5367cdeb phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
* | 4dcf6090 Merge android15-6.6 into android15-6.6-lts
* | 5423646b Revert "drm/framebuffer: Acquire internal references on GEM handles"
* | 9cca897f Merge 6.6.99 into android15-6.6-lts
|/
* d96eb99e Linux 6.6.99
* eaf11206 rseq: Fix segfault on registration when rseq_cs is non-zero
* f02f0218 crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
* 97c35598 ksmbd: fix potential use-after-free in oplock/lease break ack
* 8377d774 kasan: remove kasan_find_vm_area() to prevent possible deadlock
* d3927e55 smb: client: fix potential race in cifs_put_tcon()
* a4bb7ced selftests/bpf: adapt one more case in test_lru_map to the new target_free
* f35c825a Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
* 3ce1d87d HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
* ae915b38 HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
* b71a7573 bpf: Adjust free target to avoid global starvation of LRU map
* cd5b424d vt: add missing notification when switching back to text mode
* f4428b2d btrfs: fix assertion when building free space tree
* 2cc5ef01 net: mana: Record doorbell physical address in PF mode
* 9f460b23 HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
* cd4df14f net: usb: qmi_wwan: add SIMCom 8230C composition
* e07c2feb ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
* ee287cf3 ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
* 50b1e01a io_uring: make fallocate be hashed work
* 825088c9 um: vector: Reduce stack usage in vector_eth_configure()
* 8cafaba2 atm: idt77252: Add missing `dma_map_error()`
* 0d8a9b6d ublk: sanity check add_dev input for underflow
* 5909679a bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
* e644935d bnxt_en: Fix DCB ETS validation
* 7d4d1993 net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
* 5aa8b3a1 can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
* 10946f83 net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
* 9fa29314 ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
* 4a17370d net: appletalk: Fix device refcount leak in atrtr_create()
* 9fbc4942 netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
* d46186eb nbd: fix uaf in nbd_genl_connect() error path
* 8fc3d7b2 raid10: cleanup memleak at raid10_make_request
* df589401 md/raid1: Fix stack memory use after return in raid1_reshape
* d1240029 drm/tegra: nvdec: Fix dma_alloc_coherent error check
* 5420de65 wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
* 73929646 cifs: all initializations for tcon should happen in tcon_info_alloc
* 03c3cd0c smb: client: fix DFS interlink failover
* d043b5da smb: client: avoid unnecessary reconnects when refreshing referrals
* 609a617a usb: dwc3: Abort suspend on soft disconnect failure
* e3f79e2c usb: cdnsp: Fix issue with CV Bad Descriptor test
* ae5b1911 usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
* 7227a822 usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
* fd79927c btrfs: fix inode lookup error handling during log replay
* 6aea26dc btrfs: return a btrfs_inode from btrfs_iget_logging()
* e6031107 btrfs: remove redundant root argument from fixup_inode_link_count()
* 28a36e75 btrfs: remove redundant root argument from btrfs_update_inode_fallback()
* ddead3c5 btrfs: remove noinline from btrfs_update_inode()
* c31ee169 netlink: make sure we allow at least one dump skb
* ce2ac2e4 netlink: Fix rmem check in netlink_broadcast_deliver().
* 5b1b8f06 erofs: fix to add missing tracepoint in erofs_read_folio()
* 4c4f9316 ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
* d903a0fe smb: server: make use of rdma_destroy_qp()
* 3c0994a3 x86/mm: Disable hugetlb page table sharing on 32-bit
* ee21fbcb x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
* ad9d4db5 pwm: mediatek: Ensure to disable clocks in error path
* 37e2911d mm/vmalloc: leave lazy MMU mode on PTE mapping error
* f64046ae scripts/gdb: fix interrupts.py after maple tree conversion
* ecf16604 scripts/gdb: de-reference per-CPU MCE interrupts
* e2e200c9 scripts/gdb: fix interrupts display after MCP on x86
* 56995226 mm: fix the inaccurate memory statistics issue for users
* 16713404 maple_tree: fix mt_destroy_walk() on root leaf node
* 688bf63e kallsyms: fix build without execinfo
* c23a4108 Revert "ACPI: battery: negate current when discharging"
* 2e2e9b3d drm/framebuffer: Acquire internal references on GEM handles
* dec7774d Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
* c6eb4a05 usb: gadget: u_serial: Fix race condition in TTY wakeup
* 8c290a9d drm/gem: Fix race in drm_gem_handle_create_tail()
* db7402d7 drm/ttm: fix error handling in ttm_buffer_object_transfer
* c64f5310 drm/sched: Increment job count before swapping tail spsc queue
* cb4c956a drm/gem: Acquire references on GEM handles for framebuffers
* ec639206 wifi: prevent A-MSDU attacks in mesh networks
* 1d57f713 pinctrl: qcom: msm: mark certain pins as invalid for interrupts
* 3d82a729 md/md-bitmap: fix GPF in bitmap_get_stats()
* 2ca1db26 gre: Fix IPv6 multicast route creation.
* 8c8e8d4d KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
* 20d1d9e7 KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
* a18776ab x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
* f536f3b0 x86/mce: Don't remove sysfs if thresholding sysfs init fails
* cc058adb x86/mce/amd: Fix threshold limit reset
* 8e5058a5 x86/mce/amd: Add default names for MCA banks and blocks
* e2d5c005 ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
* efc1b2b7 rxrpc: Fix oops due to non-existence of prealloc backlog struct
* ddc4fe07 Bluetooth: HCI: Set extended advertising data synchronously
* eb952372 perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
* e63032e6 maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
* 432c5363 rxrpc: Fix bug due to prealloc collision
* 4c691d1b net/sched: Abort __tc_modify_qdisc if parent class does not exist
* 07b585ae atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
* 3f61b997 atm: clip: Fix infinite recursive call of clip_push().
* 1fb9fb5a atm: clip: Fix memory leak of struct clip_vcc.
* 06935c50 atm: clip: Fix potential null-ptr-deref in to_atmarpd().
* 36cf9bcf net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
* 0a0d040f net: phy: smsc: Force predictable MDI-X state on LAN87xx
* 72c62b49 net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
* 791c8d6b net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
* d437e8e7 vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
* 9d24bb67 vsock: Fix transport_* TOCTOU
* 40123981 vsock: Fix transport_{g2h,h2g} TOCTOU
* 81373cd1 tcp: Correct signedness in skb remaining space calculation
* be4b8392 tipc: Fix use-after-free in tipc_conn_close().
* 42262bc4 vsock: fix `vsock_proto` declaration
* 55baecb9 netlink: Fix wraparounds of sk->sk_rmem_alloc.
* f9b3d28f fix proc_sys_compare() handling of in-lookup dentries
* 82c0f15c pinctrl: amd: Clear GPIO debounce for suspend
* a219fcea Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
* 51e08210 Bluetooth: hci_sync: Fix not disabling advertising instance
* c604dd2c ASoC: cs35l56: probe() should fail if the device ID is not recognized
* 183bdb89 perf: Revert to requiring CAP_SYS_ADMIN for uprobes
* 71eb118b perf/core: Fix the WARN_ON_ONCE is out of lock protected region
* 407f1073 ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
* 391e5ea5 drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
* 521e9ff0 eventpoll: don't decrement ep refcount while still holding the ep mutex

Change-Id: Idf33bf8f47e4989bfce676846abd27858a897562
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>