Merge tag 'android13-5.15.149_r00' into branch android13-5.15

This catches the android13-5.15 branch up to the 5.15.149 LTS release.
Included in here are the following commits:

* 5d969395 Revert "hrtimer: Report offline hrtimer enqueue"
* 709a71f9 Revert "mm/sparsemem: fix race in accessing memory_section->usage"
* c936f4b6 Revert "drm/mipi-dsi: Fix detach call without attach"
* 42adf566 Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()"
* 5b4517f7 Revert "serial: 8250_exar: Fill in rs485_supported"
* e9ab1fe6 Revert "serial: 8250_exar: Set missing rs485_supported flag"
* 8ddf523a Revert "ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()"
*   fcfe0289 Merge 5.15.149 into android13-5.15-lts
|\
| * 458ce51d Linux 5.15.149
| * d72da187 usb: dwc3: gadget: Ignore End Transfer delay on teardown
| * acff71e5 media: Revert "media: rkisp1: Drop IRQF_SHARED"
| * 9ae312f7 usb: dwc3: gadget: Execute gadget stop after halting the controller
| * 921acacb usb: dwc3: gadget: Don't delay End Transfer on delayed_status
| * 4178bfa3 staging: fbtft: core: set smem_len before fb_deferred_io_init call
| * 9e25a005 smb3: Replace smb2pdu 1-element arrays with flex-arrays
| * 0b49eac3 fs/ntfs3: Add null pointer checks
| * 4c73597f net: bcmgenet: Fix EEE implementation
| * 62900d35 Revert "selftests/bpf: Test tail call counting with bpf2bpf and data on stack"
| * 75ac8dc0 drm/msm/dsi: Enable runtime PM
| * c7a0fa3a PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend()
| * 1974b3c1 arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata
| * 888a0a46 dm: limit the number of targets and parameter size area
| * cf4da91e nilfs2: replace WARN_ONs for invalid DAT metadata block requests
| * 8fa90634 nilfs2: fix potential bug in end_buffer_async_write
| * 50fb4e17 sched/membarrier: reduce the ability to hammer on sys_membarrier
| * b9aafef7 netfilter: ipset: Missing gc cancellations fixed
| * 6c53e854 net: prevent mss overflow in skb_segment()
| * 95c0babe hrtimer: Ignore slack time for RT tasks in schedule_hrtimeout_range()
| * c2dc077d netfilter: ipset: fix performance regression in swap operation
| * 3b3e4d35 scripts/decode_stacktrace.sh: optionally use LLVM utilities
| * 473791d2 scripts: decode_stacktrace: demangle Rust symbols
| * 1ce4ac55 scripts/decode_stacktrace.sh: support old bash version
| * 2655757a fbdev: flush deferred IO before closing
| * 15492bab fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
| * 87b9802c fbdev: Fix invalid page access after closing deferred I/O devices
| * 9a95fc04 fbdev: Rename pagelist to pagereflist for deferred I/O
| * 186b8965 fbdev: Track deferred-I/O pages in pageref struct
| * e79b2b2a fbdev: defio: fix the pagelist corruption
| * 0616b00a fbdev: Don't sort deferred-I/O pages by default
| * 5d3aff76 fbdev/defio: Early-out if page is already enlisted
| * 48a09969 serial: 8250_exar: Set missing rs485_supported flag
| * 9ef7419b serial: 8250_exar: Fill in rs485_supported
| * aded03ed usb: dwc3: gadget: Queue PM runtime idle on disconnect event
| * 21f0bff2 usb: dwc3: gadget: Handle EP0 request dequeuing properly
| * 89353c88 usb: dwc3: gadget: Refactor EP0 forced stall/restart into a separate API
| * 91561925 usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
| * 352b38d1 usb: dwc3: gadget: Submit endxfer command if delayed during disconnect
| * 9cccdcc9 usb: dwc3: gadget: Force sending delayed status during soft disconnect
| * 1ea8a2a5 usb: dwc3: Fix ep0 handling when getting reset while doing control transfer
| * 12c0a080 usb: dwc3: gadget: Delay issuing End Transfer
| * 48734185 usb: dwc3: gadget: Only End Transfer for ep0 data phase
| * 9273bd26 usb: dwc3: ep0: Don't prepare beyond Setup stage
| * 92f7a10a usb: dwc3: gadget: Wait for ep0 xfers to complete during dequeue
| * 2bb86817 crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
| * 44a8a2c9 bus: moxtet: Add spi device table
| * 4e82b9c1 dma-buf: add dma_fence_timestamp helper
| * 36f7371d af_unix: Fix task hung while purging oob_skb in GC.
| * ff2f35f5 tracing: Inform kmemleak of saved_cmdlines allocation
| * 579cb4ff pmdomain: core: Move the unused cleanup to a _sync initcall
| * 41ccb5bc can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
| * 03358aba can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
| * 6315697f of: property: fix typo in io-channels
| * 310c7d98 mm: hugetlb pages should not be reserved by shmat() if SHM_NORESERVE
| * 70e329b4 ceph: prevent use-after-free in encode_cap_msg()
| * 99fa6d45 net: ethernet: ti: cpsw_new: enable mac_managed_pm to fix mdio
| * ff42d99e s390/qeth: Fix potential loss of L3-IP@ in case of network issues
| * ddb4be0e net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio
| * 86244ae7 irqchip/gic-v3-its: Fix GICv4.1 VPE affinity update
| * 27a2af91 irqchip/irq-brcmstb-l2: Add write memory barrier before exit
| * b10c8883 wifi: mac80211: reload info pointer in ieee80211_tx_dequeue()
| * ef5b1041 nfp: flower: prevent re-adding mac index for bonded port
| * e58efe0f nfp: use correct macro for LengthSelect in BAR config
| * 7535ec35 crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
| * 7e9b622b nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
| * 120f7fa2 nilfs2: fix data corruption in dsync block recovery for small block sizes
| * ee28bbb6 ALSA: hda/conexant: Add quirk for SWS JS201D
| * 776f0c69 mmc: slot-gpio: Allow non-sleeping GPIO ro
| * 62fa8230 x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
| * 1fb17e9b x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6
| * 0fc0bcba powerpc/64: Set task pt_regs->link to the LR value on scv entry
| * 72bf8760 serial: max310x: fail probe if clock crystal is unstable
| * b67b421a serial: max310x: improve crystal stable clock detection
| * 2e8b2b91 serial: max310x: set default value when reading clock ready bit
| * f8777d33 ring-buffer: Clean ring_buffer_poll_wait() error return
| * 7656372a hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
| * 4cc90928 drm/prime: Support page array >= 4GB
| * d9821010 media: rc: bpf attach/detach requires write permission
| * a4b4ba77 iio: accel: bma400: Fix a compilation problem
| * 1c6d19c8 iio: core: fix memleak in iio_device_register_sysfs
| * 8d5838a4 iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
| * 7b9cabd4 staging: iio: ad5933: fix type mismatch regression
| * 047aa3dc tracing: Fix wasted memory in saved_cmdlines logic
| * afba9d11 ext4: fix double-free of blocks due to wrong extents moved_len
| * b7902e34 misc: fastrpc: Mark all sessions as invalid in cb_remove
| * 82722b45 binder: signal epoll threads of self-work
| * 4052b180 ALSA: hda/cs8409: Suppress vmaster control for Dolphin models
| * cc3cb482 ASoC: codecs: wcd938x: handle deferred probe
| * 08c84d16 ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL
| * 8b2f2199 xen-netback: properly sync TX responses
| * de769423 net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
| * 471c9ede nfc: nci: free rx_data_reassembly skb on NCI device cleanup
| * ac0f160a kbuild: Fix changing ELF file type for output of gen_btf for big endian
| * 4bcfab73 firewire: core: correct documentation of fw_csr_string() kernel API
| * d260a5b7 lsm: fix the logic in security_inode_getsecctx()
| * 65158edb Revert "drm/amd: flush any delayed gfxoff on suspend entry"
| * 5b8f473c scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
| * 6f95120f mptcp: fix data re-injection from stale subflow
| * b7449c9f modpost: trim leading spaces when processing source files list
| * 1f8d0691 i2c: i801: Fix block process call transactions
| * 23a8b74f i2c: i801: Remove i801_set_block_buffer_mode
| * 2738e0aa powerpc/kasan: Fix addr error caused by page alignment
| * 207557e3 media: ir_toy: fix a memleak in irtoy_tx
| * 88936cea usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
| * 6f54aa9a usb: f_mass_storage: forbid async queue when shutdown happen
| * 44c7567c USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT
| * 3aa71c77 usb: ucsi_acpi: Fix command completion handling
| * 712afb6b iio: hid-sensor-als: Return 0 for HID_USAGE_SENSOR_TIME_TIMESTAMP
| * 85330792 HID: wacom: Do not register input devices until after hid_hw_start
| * 20902b76 HID: wacom: generic: Avoid reporting a serial of '0' to userspace
| * 62f5d219 HID: i2c-hid-of: fix NULL-deref on failed power up
| * 20d8a8fe ALSA: hda/realtek: Enable Mute LED on HP Laptop 14-fq0xxx
| * 16dc2756 ALSA: hda/realtek: Fix the external mic not being recognised for Acer Swift 1 SF114-32
| * 595865eb scsi: storvsc: Fix ring buffer size calculation
| * 5099871b mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
| * b5085b5a tracing/trigger: Fix to return error if failed to alloc snapshot
| * cd459bee scs: add CONFIG_MMU dependency for vfree_atomic()
| * 29b36810 i40e: Fix waiting for queues of all VSIs to be disabled
| * 8e89ac88 MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler
| * 9bc718f6 net: sysfs: Fix /sys/class/net/<iface> path for statistics
| * d14b8e20 ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
| * 2ed13fda spi: ppc4xx: Drop write-only variable
| * c45f2fa9 net: openvswitch: limit the number of recursions from action sets
| * ca8c08db wifi: iwlwifi: Fix some error codes
| * 1ab2a02b of: unittest: Fix compile in the non-dynamic case
| * f0dc9c00 btrfs: send: return EOPNOTSUPP on unknown flags
| * 980e2bee btrfs: forbid deleting live subvol qgroup
| * e31546b0 btrfs: do not ASSERT() if the newly created subvolume already got read
| * 08bead02 btrfs: forbid creating subvol qgroups
| * 2bab493a netfilter: nft_set_rbtree: skip end interval element from gc
| * 658020d7 net: stmmac: xgmac: fix a typo of register name in DPP safety handling
| * 3f2e5581 net: stmmac: xgmac: use #define for string constants
| * 1027d6d6 clocksource: Skip watchdog check for large watchdog intervals
| * be38f291 vhost: use kzalloc() instead of kmalloc() followed by memset()
| * 132305ee Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID
| * 76889580 Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU
| * 15524057 hrtimer: Report offline hrtimer enqueue
| * e2aaab6f usb: host: xhci-plat: Add support for XHCI_SG_TRB_CACHE_SIZE_QUIRK
| * 5c654c58 usb: dwc3: host: Set XHCI_SG_TRB_CACHE_SIZE_QUIRK
| * efe1bfe0 USB: serial: cp210x: add ID for IMST iM871A-USB
| * 3799bb64 USB: serial: option: add Fibocom FM101-GL variant
| * 2998a7dd USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e
| * c1be84b8 ALSA: usb-audio: Add a quirk for Yamaha YIT-W12TX transmitter
| * 8b0386bc drivers: lkdtm: fix clang -Wformat warning
| * 1e4d3f8b blk-iocost: Fix an UBSAN shift-out-of-bounds warning
| * 0d3dab88 scsi: core: Move scsi_host_busy() out of host lock if it is for per-command
| * ae4acad4 fs/ntfs3: Fix an NULL dereference bug
| * 4f0b6f2c netfilter: nft_set_pipapo: remove scratch_aligned pointer
| * ed965103 netfilter: nft_set_pipapo: add helper to release pcpu scratch area
| * 24547e88 netfilter: nft_set_pipapo: store index in scratch maps
| * 44725dc0 netfilter: nft_ct: reject direction for ct id
| * 42442f74 drm/amd/display: Implement bounds check for stream encoder creation in DCN301
| * bc6f288c drm/amd/display: Fix multiple memory leaks reported by coverity
| * fb49e60d netfilter: nft_compat: restrict match/target protocol to u16
| * 5f1c4efc netfilter: nft_compat: reject unused compat flag
| * 58fbe665 ppp_async: limit MRU to 64K
| * 4fe505c6 af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
| * c1701ea8 tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
| * 69682953 rxrpc: Fix response to PING RESPONSE ACKs to a dead call
| * 3266e638 inet: read sk->sk_family once in inet_recv_error()
| * 7df911d4 hwmon: (coretemp) Fix bogus core_id to attr name mapping
| * a16afec8 hwmon: (coretemp) Fix out-of-bounds memory access
| * 0d5ceb4c hwmon: (aspeed-pwm-tacho) mutex for tach reading
| * c08a3943 octeontx2-pf: Fix a memleak otx2_sq_init
| * 15393c8f atm: idt77252: fix a memleak in open_card_ubr0
| * d964dd1b tunnels: fix out of bounds access when building IPv6 PMTU error
| * 5c45e6d0 selftests: net: avoid just another constant wait
| * ea51f12e selftests: net: cut more slack for gro fwd tests.
| * 6609e98e net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
| * 513dd309 drm/msm/dp: return correct Colorimetry for DP_TEST_DYNAMIC_RANGE_CEA case
| * 8cc889b9 phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
| * 5db6dd83 dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
| * 850b64fd phy: renesas: rcar-gen3-usb2: Fix returning wrong error code
| * 15eb996d dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA
| * c71d4578 dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA
| * 71fe7fd3 dmaengine: ti: k3-udma: Report short packet errors
| * c75460bf dmaengine: fsl-dpaa2-qdma: Fix the size of dma pools
| * 725a9ac7 ASoC: codecs: lpass-wsa-macro: fix compander volume hack
| * 48471f7a bonding: remove print in bond_verify_device_path
| * 85d64b0c HID: apple: Add 2021 magic keyboard FN key mapping
| * 97799743 HID: apple: Add support for the 2021 Magic Keyboard
| * c5b70b8f gve: Fix use-after-free vulnerability
| * ce3c5039 arm64: irq: set the correct node for shadow call stack
| * 8cdf9b6c net: sysfs: Fix /sys/class/net/<iface> path
| * f3ce3e00 selftests: net: fix available tunnels detection
| * c8f6b3b8 af_unix: fix lockdep positive in sk_diag_dump_icons()
| * 5823acd7 net: ipv4: fix a memleak in ip_setup_cork
| * b775ced0 netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
| * 5d7a4559 netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger
| * 4cdab716 netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV
| * beb73281 bridge: mcast: fix disabled snooping after long uptime
| * dbc1b899 llc: call sock_orphan() at release time
| * a9ef5dc9 ipv6: Ensure natural alignment of const ipv6 loopback and router addresses
| * a2e5f021 ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550()
| * c7f47912 ixgbe: Refactor overtemp event handling
| * 52ec65d4 ixgbe: Refactor returning internal error codes
| * 7683f41c ixgbe: Remove non-inclusive language
| * 718f446e tcp: add sanity checks to rx zerocopy
| * af6b5c50 ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
| * 6d564501 ip6_tunnel: use dev_sw_netstats_rx_add()
| * 157e1cb2 selftests: net: give more time for GRO aggregation
| * d37c1c81 scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
| * 022e2310 scsi: isci: Fix an error code problem in isci_io_request_build()
| * bc009cb1 drm: using mul_u32_u32() requires linux/math64.h
| * cfe83903 wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update
| * 8a070a58 perf: Fix the nr_addr_filters fix
| * b203bc5e drm/amdkfd: Fix 'node' NULL check in 'svm_range_get_range_boundaries()'
| * 362754ec drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()'
| * 2f7f8e10 drm/amd/powerplay: Fix kzalloc parameter 'ATOM_Tonga_PPM_Table' in 'get_platform_power_management_table()'
| * a9c15d6e ceph: fix deadlock or deadcode of misusing dget()
| * 89e0e666 blk-mq: fix IO hang from sbitmap wakeup race
| * 105874a4 virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
| * 7a70663b drm/amdkfd: Fix lock dependency warning
| * 93ecc129 libsubcmd: Fix memory leak in uniq()
| * 82006e24 PCI/AER: Decode Requester ID when no error info found
| * 7289a6e6 PCI: Fix 64GT/s effective data rate calculation
| * f4dce08b fs/kernfs/dir: obey S_ISGID
| * ef86cdc6 tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE
| * 8451aa66 selftests/sgx: Fix linker script asserts
| * 56073287 usb: hub: Replace hardcoded quirk value with BIT() macro
| * a7af1be5 perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present
| * ff1c7e2f PCI: switchtec: Fix stdev_release() crash after surprise hot remove
| * 52d42ac6 PCI: Only override AMD USB controller if required
| * 1a4f4085 mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt
| * 28497271 mfd: ti_am335x_tscadc: Fix TI SoC dependencies
| * f7752e5f xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import
| * 9b7d253b i3c: master: cdns: Update maximum prescaler value for i2c clock
| * 0c7478a2 um: time-travel: fix time corruption
| * 1e3d449b um: net: Fix return type of uml_net_start_xmit()
| * b7b44ee0 um: Don't use vfprintf() for os_info()
| * 4c4b366a um: Fix naming clash between UML and scheduler
| * f5010e28 leds: trigger: panic: Don't register panic notifier if creating the trigger failed
| * f13b8cb5 ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140
| * bd086bd1 drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()'
| * 702b7591 drm/amdgpu: Let KFD sync with VM fences
| * 8998723d clk: imx: clk-imx8qxp: fix LVDS bypass, pixel and phy clocks
| * 9709da9d clk: imx: scu: Fix memory leak in __imx_clk_gpr_scu()
| * 91828d93 watchdog: it87_wdt: Keep WDTCTRL bit 3 unmodified for IT8784/IT8786
| * 54a84bad clk: mmp: pxa168: Fix memory leak in pxa168_clk_init()
| * fcc477e6 clk: hi3620: Fix memory leak in hi3620_mmc_clk_init()
| * 77bcd4ab drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap
| * 2b5a22f0 drm/msm/dpu: Ratelimit framedone timeout msgs
| * a889d901 media: i2c: imx335: Fix hblank min/max values
| * d1e0fdba media: ddbridge: fix an error code problem in ddb_probe
| * ed790bd0 IB/ipoib: Fix mcast list locking
| * 5fcd8a81 drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time
| * 7ea0f29d f2fs: fix to tag gcing flag on page during block migration
| * 8ab28b2d media: rkisp1: Drop IRQF_SHARED
| * 9d23b21a ALSA: hda: intel-dspcfg: add filters for ARL-S and ARL
| * b1a53c92 ALSA: hda: Intel: add HDA_ARL PCI ID support
| * 684cb957 PCI: add INTEL_HDA_ARL to pci_ids.h
| * d08e032f media: rockchip: rga: fix swizzling for RGB formats
| * fdf14a7c media: stk1160: Fixed high volume of stk1160_dbg messages
| * 3cdc6444 drm/mipi-dsi: Fix detach call without attach
| * 711b5cc5 drm/framebuffer: Fix use of uninitialized variable
| * df31f3cb drm/drm_file: fix use of uninitialized variable
| * 6941fe8d f2fs: fix write pointers on zoned device after roll forward
| * 2ed3db89 drm/amd/display: Fix tiled display misalignment
| * f217be12 RDMA/IPoIB: Fix error code return in ipoib_mcast_join
| * 8eb8fca1 fast_dput(): handle underflows gracefully
| * 7fa0c4ef ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument
| * 82ccd840 ALSA: hda: Refer to correct stream index at loops
| * b4fb0807 f2fs: fix to check return value of f2fs_reserve_new_block()
| * 315d966d octeontx2-af: Fix max NPC MCAM entry check while validating ref_entry
| * 28764fab i40e: Fix VF disable behavior to block all traffic
| * 2cf9158f bridge: cfm: fix enum typo in br_cc_ccm_tx_parse
| * 1fbcb194 Bluetooth: L2CAP: Fix possible multiple reject send
| * 84e3f673 Bluetooth: qca: Set both WIDEBAND_SPEECH and LE_STATES quirks for QCA2066
| * 2fde2254 wifi: cfg80211: free beacon_ies when overridden from hidden BSS
| * f589258f wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift()
| * 49ec369f ALSA: usb-audio: Add delay quirk for MOTU M Series 2nd revision
| * 90dbf453 libbpf: Fix NULL pointer dereference in bpf_object__collect_prog_relos
| * 9e1cae31 wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices
| * 40a71f7e arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property
| * 2f747a4f arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property
| * 2aee6c45 md: Whenassemble the array, consult the superblock of the freshest device
| * 6ab391ea block: prevent an integer overflow in bvec_try_merge_hw_page
| * a9d12fdc net: dsa: mv88e6xxx: Fix mv88e6352_serdes_get_stats error path
| * fed14636 ARM: dts: imx23/28: Fix the DMA controller node name
| * e9b72466 ARM: dts: imx23-sansa: Use preferred i2c-gpios properties
| * 3995aa52 ARM: dts: imx27-apf27dev: Fix LED name
| * 7a01ad0f ARM: dts: imx25/27: Pass timing0
| * b60d572d ARM: dts: imx25: Fix the iim compatible string
| * f6abd5e1 block/rnbd-srv: Check for unlikely string overflow
| * 963b9c54 ionic: pass opcode to devcmd_wait
| * 13817075 ARM: dts: imx1: Fix sram node
| * ad54a5b0 ARM: dts: imx27: Fix sram node
| * b4130668 ARM: dts: imx: Use flash@0,0 pattern
| * 3693ecc0 ARM: dts: imx25/27-eukrea: Fix RTC node name
| * cf5f3489 ARM: dts: rockchip: fix rk3036 hdmi ports node
| * fdb812be bpf: Set uattr->batch.count as zero before batched update or deletion
| * 813ebba2 scsi: libfc: Fix up timeout error in fc_fcp_rec_error()
| * 43ba03c3 scsi: libfc: Don't schedule abort twice
| * 5ef63c87 bpf: Add map and need_defer parameters to .map_fd_put_ptr()
| * 9003fa9a wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
| * 8c965c9c ARM: dts: imx7s: Fix nand-controller #size-cells
| * 3eeefee8 ARM: dts: imx7s: Fix lcdif compatible
| * f9ec664f ARM: dts: imx7d: Fix coresight funnel ports
| * 7733800d scsi: arcmsr: Support new PCI device IDs 1883 and 1886
| * 34acf522 bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk
| * 2abaf726 PCI: Add no PM reset quirk for NVIDIA Spectrum devices
| * 6b9abf50 scsi: lpfc: Fix possible file string name overflow when updating firmware
| * 79aadf64 selftests/bpf: Fix issues in setup_classid_environment()
| * 6aad0814 selftests/bpf: Fix pyperf180 compilation failure with clang18
| * efe701e9 selftests/bpf: satisfy compiler by having explicit return in btf test
| * 4cc19858 wifi: rt2x00: restart beacon queue when hardware reset
| * d76c8d7f ext4: avoid online resizing failures due to oversized flex bg
| * 0cabe04c ext4: remove unnecessary check from alloc_flex_gd()
| * 474f5b00 ext4: unify the type of flexbg_size to unsigned int
| * 5d209059 ext4: fix inconsistent between segment fstrim and full fstrim
| * 9f2e4078 ecryptfs: Reject casefold directory inodes
| * f8cf4dab SUNRPC: Fix a suspicious RCU usage warning
| * 732a3bea KVM: s390: fix setting of fpc register
| * 28a1f492 s390/ptrace: handle setting of fpc register correctly
| * df81cbcd arch: consolidate arch_irq_work_raise prototypes
| * 6aa30020 jfs: fix array-index-out-of-bounds in diNewExt
| * 40e21a9e rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock()
| * 44b86400 afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*()
| * 78b6ff52 afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu()
| * 556be726 crypto: stm32/crc32 - fix parsing list of devices
| * 70a3b161 crypto: octeontx2 - Fix cptvf driver cleanup
| * 2a37905d pstore/ram: Fix crash when setting number of cpus to an odd number
| * 8e44dc3f jfs: fix uaf in jfs_evict_inode
| * 8393c80c jfs: fix array-index-out-of-bounds in dbAdjTree
| * 6c6a96c3 jfs: fix slab-out-of-bounds Read in dtSearch
| * e4ce01c2 UBSAN: array-index-out-of-bounds in dtSplitRoot
| * 6fe8b702 FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
| * 7cb41031 ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events
| * 099f6a9e PM / devfreq: Synchronize devfreq_monitor_[start/stop]
| * 5457b0cb ACPI: extlog: fix NULL pointer dereference check
| * b17cb541 PNP: ACPI: fix fortify warning
| * 4d169334 ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop
| * 53ab2323 audit: Send netlink ACK before setting connection in auditd_set
| * 0f10c84e regulator: core: Only increment use_count when enable_count changes
| * a5d70e22 debugobjects: Stop accessing objects after releasing hash bucket lock
| * c128e64a perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file
| * 330cb5e7 x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel
| * de4f5ed6 powerpc/lib: Validate size for vector operations
| * 027e61b8 powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE
| * 33595c0c x86/boot: Ignore NMIs during very early boot
| * b3bc07ae powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping()
| * 88a28bec powerpc/mm: Fix build failures due to arch_reserved_kernel_pages()
| * b00f2757 powerpc: Fix build error due to is_valid_bugaddr()
| * b246a9a3 drivers/perf: pmuv3: don't expose SW_INCR event in sysfs
| * 17093c32 arm64: irq: set the correct node for VMAP stack
| * ac3ed969 powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
| * fb6c8127 x86/entry/ia32: Ensure s32 is sign extended to s64
| * 59b24e62 tick/sched: Preserve number of idle sleeps across CPU hotplug events
| * f3bc406e mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan
| * ccb03ec4 spi: bcm-qspi: fix SFDP BFPT read by usig mspi read
| * 3bc801ce block: Move checking GENHD_FL_NO_PART to bdev_add_partition()
| * f2d3ae8c gpio: eic-sprd: Clear interrupt after set the interrupt type
| * fcf44c78 drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume
| * 22937c97 drm/exynos: fix accidental on-stack copy of exynos_drm_plane
| * 76d1ffa9 drm: panel-simple: add missing bus flags for Tianma tm070jvhg[30/33]
| * 7ae05322 cpufreq: intel_pstate: Refine computation of P-state for given frequency
| * 34c02fec cpufreq: intel_pstate: Drop redundant intel_pstate_get_hwp_cap() call
| * aaa1f1a2 ksmbd: fix global oob in ksmbd_nl_policy
| * 4056ece6 btrfs: add definition for EXTENT_TREE_V2
| * 796d3fad PM / devfreq: Fix buffer overflow in trans_stat_show
| * b448de24 mm/sparsemem: fix race in accessing memory_section->usage
| * 904fafac mm: use __pfn_to_section() instead of open coding it
| * 1b1036c6 media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
| * 4cebb1ed ARM: dts: qcom: sdx55: fix USB SS wakeup
| * 462d5a6f ARM: dts: qcom: sdx55: fix USB DP/DM HS PHY interrupts
| * a98b715c ARM: dts: qcom: sdx55: fix pdc '#interrupt-cells'
| * 57be4dd6 ARM: dts: samsung: exynos4210-i9100: Unconditionally enable LDO12
| * 28092c11 ARM: dts: qcom: sdx55: fix USB wakeup interrupt types
| * 3efbd114 pipe: wakeup wr_wait after setting max_usage
| * 26bfccac fs/pipe: move check to pipe_has_watch_queue()
| * 94991728 bus: mhi: host: Add alignment check for event ring read pointer
| * d73f63a6 bus: mhi: host: Rename "struct mhi_tre" to "struct mhi_ring_element"
| * a1d62c77 PM: sleep: Fix possible deadlocks in core system-wide PM code
| * d5f15888 PM: core: Remove unnecessary (void *) conversions
| * fd8d6b04 drm/bridge: nxp-ptn3460: simplify some error checking
| * 9d2a4629 drm/tidss: Fix atomic_flush check
| * bcf51e8f drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking
| * b4af63da drm: Don't unref the same fb many times by mistake due to deadlock handling
| * 4fc86c70 gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04
| * e44e240d xfs: read only mounts with fsopen mount API are busted
| * 614cc650 firmware: arm_scmi: Check mailbox/SMT channel for consistency
| * 960cf4f8 netfilter: nf_tables: reject QUEUE/DROP verdict parameters
| * 70f17b48 netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
| * 0ac9cbe0 hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes
| * 99a23462 wifi: iwlwifi: fix a memory corruption
| * 9a64c7fc exec: Fix error handling in begin_new_exec()
| * 04a0786a rbd: don't move requests to the running list on errors
| * 0877497d btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
| * 07beceb3 btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args
| * 5b5319e1 btrfs: don't warn if discard range is not aligned to sector
| * f054f328 btrfs: tree-checker: fix inline ref size in error messages
| * 5550250f btrfs: ref-verify: free ref cache before clearing mount opt
| * f76e961a btrfs: avoid copying BTRFS_ROOT_SUBVOL_DEAD flag to snapshot of subvolume being deleted
| * 415fb71a btrfs: fix race between reading a directory and adding entries to it
| * a6c2dfbf btrfs: refresh dir last index during a rewinddir(3) call
| * 0b04bbfd btrfs: set last dir index to the current last index when opening dir
| * 79cf35e1 btrfs: fix infinite directory reads
| * 4c24059d net: fec: fix the unhandled context fault from smmu
| * 5b0f2af3 fjes: fix memleaks in fjes_hw_setup
| * c0d29d30 selftests: netdevsim: fix the udp_tunnel_nic test
| * af47faa6 net: mvpp2: clear BM pool before initialization
| * 5305727b net: stmmac: Wait a bit for the reset to take effect
| * 022a8d0b netfilter: nf_tables: validate NFPROTO_* family
| * 064bccd4 netfilter: nf_tables: restrict anonymous set and map names to 16 bytes
| * 79d4efd7 netfilter: nft_limit: reject configurations that cause integer overflow
| * 53f2cd86 overflow: Allow mixed type arguments
| * 72a72986 net/mlx5e: fix a potential double-free in fs_any_create_groups
| * c57ca114 net/mlx5e: fix a double-free in arfs_create_groups
| * cf0a8a3a net/mlx5: DR, Can't go to uplink vport on RX rule
| * e5783345 net/mlx5: DR, Align mlx5dv_dr API vport action with FW behavior
| * 8e215c24 net/mlx5: DR, Replace local WIRE_PORT macro with the existing MLX5_VPORT_UPLINK
| * fda9109e net/mlx5: DR, Use the right GVMI number for drop action
| * 50bd41dc ipv6: init the accept_queue's spinlocks in inet6_create
| * 931366b9 netlink: fix potential sleeping issue in mqueue_flush_file
| * fc0f8e2c tcp: Add memory barrier to tcp_push()
| * 21a2115e afs: Hide silly-rename files from userspace
| * aef1cb00 tracing: Ensure visibility when inserting an element into tracing_map
| * 00d1ee8e net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
| * c0fe2fe7 llc: Drop support for ETH_P_TR_802_2.
| * c2204427 llc: make llc_ui_sendmsg() more robust against bonding changes
| * 79eeb85c vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING
| * 32430251 bnxt_en: Wait for FLR to complete during probe
| * d86cc6ab tcp: make sure init the accept_queue's spinlocks once
| * 68b888d5 net/smc: fix illegal rmb_desc access in SMC-D connection dump
| * bb27126a ksmbd: Add missing set_freezable() for freezable kthread
| * d7a62b3a ksmbd: send lease break notification on FILE_RENAME_INFORMATION
| * 6cc50823 ksmbd: don't increment epoch if current state and request state are same
| * 5349fd41 ksmbd: fix potential circular locking issue in smb2_set_ea()
| * 9ab89353 ksmbd: set v2 lease version on lease upgrade
| * dfda2a5e rename(): fix the locking of subdirectories
| * b2512424 ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path
| * 689c5f8d nouveau/vmm: don't set addr on the fail path to avoid warning
| * 2d07a63b rtc: Adjust failure return code for cmos_set_alarm()
| * 3ff34c00 mmc: mmc_spi: remove custom DMA mapped buffers
| * 50b8b7a2 mmc: core: Use mrq.sbc in close-ended ffu
| * f0bb5d18 scripts/get_abi: fix source path leak
| * 4590f207 lsm: new security_file_ioctl_compat() hook
| * cdcd8df5 arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts
| * 8ed011c4 arm64: dts: qcom: sm8150: fix USB wakeup interrupt types
| * aa38eb96 arm64: dts: qcom: sdm845: fix USB wakeup interrupt types
| * 121d89f0 arm64: dts: qcom: sc7180: fix USB wakeup interrupt types
| * 33f8bdf3 async: Introduce async_schedule_dev_nocall()
| * 86c8e162 async: Split async_schedule_node_domain()
| * 58031306 parisc/firmware: Fix F-extend for PDC addresses
| * 176ed172 bus: mhi: host: Add spinlock to protect WP access when queueing TREs
| * 6e4c8431 bus: mhi: host: Drop chan lock before queuing buffers
| * cdb15ac8 mips: Fix max_mapnr being uninitialized on early stages
| * 473f1ae4 media: ov9734: Enable runtime PM before registering async sub-device
| * 2d27a7b1 rpmsg: virtio: Free driver_override when rpmsg_remove()
| * 3c1b7951 media: imx355: Enable runtime PM before registering async sub-device
| * a7f580cd crypto: s390/aes - Fix buffer overread in CTR mode
| * 26cc6d70 hwrng: core - Fix page fault dead lock on mmap-ed hwrng
| * 4d4bf19c PM: hibernate: Enforce ordering during image compression/decompression
| * a6fec632 crypto: api - Disallow identical driver names
| * ad23246c btrfs: sysfs: validate scrub_speed_max value
| * cb904f5c ext4: allow for the last group to be marked as trimmed
| * a604d5f2 iio:adc:ad7091r: Move exports into IIO_AD7091R namespace.
| * 72a33955 scsi: ufs: core: Remove the ufshcd_hba_exit() call from ufshcd_async_scan()
| * 226554bd scsi: ufs: core: Simplify power management during async scan
| * 047fce47 dmaengine: fix NULL pointer in channel unregistration function
| * e44eb4cc iio: adc: ad7091r: Enable internal vref if external vref is not supplied
| * 49f322ce iio: adc: ad7091r: Allow users to configure device events
| * 6ef852a4 iio: adc: ad7091r: Set alert bit in config register
| * 81ea755b ksmbd: only v2 leases handle the directory
| * 999daf36 ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
| * dd1de926 ksmbd: validate mech token in session setup
| * 65cadfb3 ksmbd: don't allow O_TRUNC open on read-only share
| * c917b052 ksmbd: free ppace array on error in parse_dacl
* ad06eaf0 Merge branch 'android13-5.15' into branch 'android13-5.15-lts'

Change-Id: I47a4e6d3d7c86bf746e1afc3b0a8e151aab53050
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>