Merge tag 'android14-6.1.147_r00' into android14-6.1

This merges the android14-6.1.147_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 1560c7b2 Revert "sched: Change nr_uninterruptible type to unsigned long"
* 15d4b041 Revert "net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime"
*   35bfed82 Merge 6.1.147 into android14-6.1-lts
|\
| * 3594f306 Linux 6.1.147
| * 3b02d7d8 nvmem: layouts: u-boot-env: remove crc32 endianness conversion
| * eb81b91f mm/vmalloc: leave lazy MMU mode on PTE mapping error
| * 0e8776b3 Bluetooth: HCI: Set extended advertising data synchronously
| * 15e07dd5 ASoC: fsl_sai: Force a software reset when starting in consumer mode
| * dacb58a9 usb: dwc3: qcom: Don't leave BCR asserted
| * af2d67ca usb: musb: fix gadget state on disconnect
| * a2c24582 usb: musb: Add and use inline functions musb_{get,set}_state
| * 63b7dc0b usb: hub: Don't try to recover devices lost during warm reset.
| * f093ff8f usb: hub: Fix flushing of delayed work used for post resume purposes
| * 60c929c8 usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
| * 43e53eb8 usb: hub: fix detection of high tier USB3 devices behind suspended hubs
| * d717325b clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
| * 0499d5d5 HID: mcp2221: Set driver data before I2C adapter add
| * 7c2a7b77 sched: Change nr_uninterruptible type to unsigned long
| * 85948131 Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
| * 890a5d42 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
| * ca0072c5 net: bridge: Do not offload IGMP/MLD messages
| * d43ef15b net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
| * 730fed2f tls: always refresh the queue when reading sock
| * 4a28b398 Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
| * a47ef874 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
| * 728db00a ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
| * be948f78 net/mlx5: Correctly set gso_size when LRO is used
| * 0cf885c3 Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
| * 4efc44f3 Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
| * 61a75a29 Bluetooth: SMP: If an unallowed command is received consider it a failure
| * 6a5b8918 Bluetooth: hci_sync: fix connectable extended advertising when using static random address
| * ac3a8147 Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
| * 5849980f usb: net: sierra: check for no status endpoint
| * 0db770e2 hwmon: (corsair-cpro) Validate the size of the received input buffer
| * b575b017 selftests: net: increase inter-packet timeout in udpgro.sh
| * da1a85e3 nvme: fix misaccounting of nvme-mpath inflight I/O
| * 0a4eec84 smb: client: fix use-after-free in cifs_oplock_break
| * e8101506 rpl: Fix use-after-free in rpl_do_srh_inline().
| * 466e1019 net/sched: sch_qfq: Fix race condition on qfq_aggregate
| * d24d34c4 net: emaclite: Fix missing pointer increment in aligned_read()
| * a735ae46 cachefiles: Fix the incorrect return value in __cachefiles_write()
| * 61d5fa45 bpf: Reject %p% format string in bprintf-like helpers
| * d3436638 comedi: Fix initialization of data for instructions that write to subdevice
| * 3050d197 comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
| * 281d1293 comedi: Fix some signed shift left operations
| * d4c73ce1 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
| * a18a42e7 comedi: das6402: Fix bit shift out of bounds
| * 65c03e6f comedi: das16m1: Fix bit shift out of bounds
| * ff30dd3f comedi: aio_iiro_16: Fix bit shift out of bounds
| * 5bfa301e comedi: pcl812: Fix bit shift out of bounds
| * 3eed5251 iio: adc: stm32-adc: Fix race in installing chained IRQ handler
| * 1c6284c7 iio: adc: max1363: Reorder mode_list[] entries
| * 65c314c4 iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
| * 6ecd61c2 iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
| * dc559848 soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
| * a7ba7eb9 soc: aspeed: lpc-snoop: Cleanup resources in stack-order
| * 9a1d3e8d smb: client: fix use-after-free in crypt_message when using async crypto
| * 7ac1c9f1 pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
| * 4a91b5bc mmc: sdhci_am654: Workaround for Errata i2312
| * 9a88afbb mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
| * f5a090a6 mmc: bcm2835: Fix dma_unmap_sg() nents value
| * cdbca872 memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
| * 636084f7 isofs: Verify inode mode when loading from disk
| * f366b36c dmaengine: nbpfaxi: Fix memory corruption in probe()
| * f80ace50 af_packet: fix soft lockup issue caused by tpacket_snd()
| * 1322a7a0 af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
| * ae689b74 arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
| * 82a19722 net/mlx5: Update the list of the PCI supported devices
| * 9b0d2df8 phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
| * 283bace0 io_uring/poll: fix POLLERR handling
| * 7803b28c tracing: Add down_write(trace_event_sem) when adding trace event
| * a62a895e HID: core: do not bypass hid_hw_raw_request
| * a95807db HID: core: ensure __hid_request reserves the report ID as the first byte
| * d3ed1d84 HID: core: ensure the allocated report buffer can contain the reserved report ID
| * 9e1deb75 pch_uart: Fix dma_sync_sg_for_device() nents value
| * 9946710a Input: xpad - set correct controller type for Acer NGR200
| * 8089f38f thunderbolt: Fix bit masking in tb_dp_port_set_hops()
| * 29e2f56b i2c: stm32: fix the device used for the DMA map
| * 2798111f usb: gadget: configfs: Fix OOB read on empty string write
| * 0ce0f280 USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
| * c50cf537 USB: serial: option: add Foxconn T99W640
| * 3eb65dbb USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
| * 1bb85b5c phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
* | 6113862d Merge android14-6.1 into android14-6.1-lts
* | cb4d4d9b Merge 6.1.146 into android14-6.1-lts
|\|
| * 3369c6df Linux 6.1.146
| * b2b05d0d rseq: Fix segfault on registration when rseq_cs is non-zero
| * e38ec88a ksmbd: fix potential use-after-free in oplock/lease break ack
| * 595f78d9 kasan: remove kasan_find_vm_area() to prevent possible deadlock
| * 8c90dbc9 x86: Fix X86_FEATURE_VERW_CLEAR definition
| * 1cf79d3d x86/mm: Disable hugetlb page table sharing on 32-bit
| * 59614c5a vhost-scsi: protect vq->log_used with vq->mutex
| * c9d87f46 Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
| * 2b0931ee HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
| * d05db2ec HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
| * dce9d76b vt: add missing notification when switching back to text mode
| * 7c77df23 btrfs: fix assertion when building free space tree
| * 6956f3cf HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
| * ae166099 net: usb: qmi_wwan: add SIMCom 8230C composition
| * 3da7bf7d ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
| * 2144955e ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
| * 46ec762e um: vector: Reduce stack usage in vector_eth_configure()
| * d104a842 atm: idt77252: Add missing `dma_map_error()`
| * f9eaf6d0 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
| * bbed1761 bnxt_en: Fix DCB ETS validation
| * b706db52 net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
| * 3808d284 can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
| * 9590fa4b net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
| * 4e11c4bc ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
| * d2e9f50f net: appletalk: Fix device refcount leak in atrtr_create()
| * eed8960b netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
* | 37eb587d Merge c61a5fe7 ("erofs: fix to add missing tracepoint in erofs_read_folio()") into android14-6.1-lts
|\|
| * c61a5fe7 erofs: fix to add missing tracepoint in erofs_read_folio()
* | 62232847 Merge 911e9c46 ("erofs: adapt folios for z_erofs_read_folio()") into android14-6.1-lts
|\|
| * 911e9c46 erofs: adapt folios for z_erofs_read_folio()
* | aa33b7c7 Merge 5220cfed ("erofs: avoid on-stack pagepool directly passed by arguments") into android14-6.1-lts
|\|
| * 5220cfed erofs: avoid on-stack pagepool directly passed by arguments
* | 9e88cf4c Merge cef58a39 ("erofs: allocate extra bvec pages directly instead of retrying") into android14-6.1-lts
|\|
| * cef58a39 erofs: allocate extra bvec pages directly instead of retrying
* | 79e7ea54 Merge 241d3c6f ("erofs: clean up z_erofs_pcluster_readmore()") into android14-6.1-lts
|\|
| * 241d3c6f erofs: clean up z_erofs_pcluster_readmore()
* | 1f6a1772 Merge c34a8b00 ("erofs: remove the member readahead from struct z_erofs_decompress_frontend") into android14-6.1-lts
|\|
| * c34a8b00 erofs: remove the member readahead from struct z_erofs_decompress_frontend
* | dd6ab964 Merge 91fa560c ("nbd: fix uaf in nbd_genl_connect() error path") into android14-6.1-lts
|\|
| * 91fa560c nbd: fix uaf in nbd_genl_connect() error path
| * 9af149ca raid10: cleanup memleak at raid10_make_request
| * 5f35e48b md/raid1: Fix stack memory use after return in raid1_reshape
| * 61b8d209 drm/tegra: nvdec: Fix dma_alloc_coherent error check
| * adf08c96 wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
* | 96e33e6f Merge 17f94b1a ("usb: dwc3: Abort suspend on soft disconnect failure") into android14-6.1-lts
|\|
| * 17f94b1a usb: dwc3: Abort suspend on soft disconnect failure
* | 9034e25e Merge 07acd398 ("usb: cdnsp: Fix issue with CV Bad Descriptor test") into android14-6.1-lts
|\|
| * 07acd398 usb: cdnsp: Fix issue with CV Bad Descriptor test
| * 9a8c9c81 usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
| * 7577654d usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
| * 075991f4 Input: xpad - support Acer NGR 200 Controller
| * 2ca2fe2c usb: xhci: quirk for data loss in ISOC transfers
| * 237e363d xhci: Allow RPM on the USB controller (1022:43f7) by default
| * 72be0d6b btrfs: propagate last_unlink_trans earlier when doing a rmdir
| * 66d29d75 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
| * ac6b093e netlink: make sure we allow at least one dump skb
| * 37bc6bae netlink: Fix rmem check in netlink_broadcast_deliver().
| * 456ff529 ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
| * 27fc2b31 smb: server: make use of rdma_destroy_qp()
| * 5cf70d19 pwm: mediatek: Ensure to disable clocks in error path
| * a1802098 maple_tree: fix mt_destroy_walk() on root leaf node
| * 7837fb8e kallsyms: fix build without execinfo
| * 8842fa50 Revert "ACPI: battery: negate current when discharging"
| * ee8d688e usb: gadget: u_serial: Fix race condition in TTY wakeup
| * 9bf4b696 drm/gem: Fix race in drm_gem_handle_create_tail()
| * 3aa799ed drm/ttm: fix error handling in ttm_buffer_object_transfer
| * f9a4f28a drm/sched: Increment job count before swapping tail spsc queue
| * e2c8a3c0 wifi: prevent A-MSDU attacks in mesh networks
| * cc145e02 pinctrl: qcom: msm: mark certain pins as invalid for interrupts
| * a23b16ba md/md-bitmap: fix GPF in bitmap_get_stats()
| * ee36dddf gre: Fix IPv6 multicast route creation.
| * e0d9a7cf KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
| * 223ecac5 KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
| * 82ffa3c4 x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
| * 94cd68a3 x86/mce: Don't remove sysfs if thresholding sysfs init fails
| * 0e0890ee x86/mce/amd: Fix threshold limit reset
| * cbc16702 ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
| * 2392494b x86/boot: Compile boot code with -std=gnu11 too
| * 0eef2938 rxrpc: Fix oops due to non-existence of prealloc backlog struct
* | 67e62b61 Merge d69cd64b ("maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()") into android14-6.1-lts
|\|
| * d69cd64b maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
* | 92a87015 Merge 23c165dd ("net/sched: Abort __tc_modify_qdisc if parent class does not exist") into android14-6.1-lts
|/
* 23c165dd net/sched: Abort __tc_modify_qdisc if parent class does not exist
* 27b5bb7e atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
* 1579a277 atm: clip: Fix infinite recursive call of clip_push().
* 0c17ff46 atm: clip: Fix memory leak of struct clip_vcc.
* ee4d9e4d atm: clip: Fix potential null-ptr-deref in to_atmarpd().
* d823d21d net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
* 126685f7 net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
* 10a96474 vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
* 9ce53e74 vsock: Fix transport_* TOCTOU
* 5752d8db vsock: Fix transport_{g2h,h2g} TOCTOU
* 1dbf7cd2 tipc: Fix use-after-free in tipc_conn_close().
* 76602d8e netlink: Fix wraparounds of sk->sk_rmem_alloc.
* 3baad7b9 fix proc_sys_compare() handling of in-lookup dentries
* 9b98741e Bluetooth: hci_sync: Fix not disabling advertising instance
* 8e8bf7bc perf: Revert to requiring CAP_SYS_ADMIN for uprobes
* 181aa46e ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
* 68c47ccc platform/x86: ideapad-laptop: use usleep_range() for EC polling
* a40a3516 drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling

Change-Id: I44e458e9ba56b6ca7356477a11bef7fb74c0871b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>