Merge 6.6.99 into android15-6.6-lts

Changes in 6.6.99
	eventpoll: don't decrement ep refcount while still holding the ep mutex
	drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
	ASoC: fsl_asrc: use internal measured ratio for non-ideal ratio mode
	perf/core: Fix the WARN_ON_ONCE is out of lock protected region
	perf: Revert to requiring CAP_SYS_ADMIN for uprobes
	ASoC: cs35l56: probe() should fail if the device ID is not recognized
	Bluetooth: hci_sync: Fix not disabling advertising instance
	Bluetooth: hci_event: Fix not marking Broadcast Sink BIS as connected
	pinctrl: amd: Clear GPIO debounce for suspend
	fix proc_sys_compare() handling of in-lookup dentries
	netlink: Fix wraparounds of sk->sk_rmem_alloc.
	vsock: fix `vsock_proto` declaration
	tipc: Fix use-after-free in tipc_conn_close().
	tcp: Correct signedness in skb remaining space calculation
	vsock: Fix transport_{g2h,h2g} TOCTOU
	vsock: Fix transport_* TOCTOU
	vsock: Fix IOCTL_VM_SOCKETS_GET_LOCAL_CID to check also `transport_local`
	net: stmmac: Fix interrupt handling for level-triggered mode in DWC_XGMAC2
	net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap
	net: phy: smsc: Force predictable MDI-X state on LAN87xx
	net: phy: smsc: Fix link failure in forced mode with Auto-MDIX
	atm: clip: Fix potential null-ptr-deref in to_atmarpd().
	atm: clip: Fix memory leak of struct clip_vcc.
	atm: clip: Fix infinite recursive call of clip_push().
	atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
	net/sched: Abort __tc_modify_qdisc if parent class does not exist
	rxrpc: Fix bug due to prealloc collision
	maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
	perf: build: Setup PKG_CONFIG_LIBDIR for cross compilation
	Bluetooth: HCI: Set extended advertising data synchronously
	rxrpc: Fix oops due to non-existence of prealloc backlog struct
	ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
	x86/mce/amd: Add default names for MCA banks and blocks
	x86/mce/amd: Fix threshold limit reset
	x86/mce: Don't remove sysfs if thresholding sysfs init fails
	x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
	KVM: x86/xen: Allow 'out of range' event channel ports in IRQ routing table.
	KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight
	gre: Fix IPv6 multicast route creation.
	md/md-bitmap: fix GPF in bitmap_get_stats()
	pinctrl: qcom: msm: mark certain pins as invalid for interrupts
	wifi: prevent A-MSDU attacks in mesh networks
	drm/gem: Acquire references on GEM handles for framebuffers
	drm/sched: Increment job count before swapping tail spsc queue
	drm/ttm: fix error handling in ttm_buffer_object_transfer
	drm/gem: Fix race in drm_gem_handle_create_tail()
	usb: gadget: u_serial: Fix race condition in TTY wakeup
	Revert "usb: gadget: u_serial: Add null pointer check in gs_start_io"
	drm/framebuffer: Acquire internal references on GEM handles
	Revert "ACPI: battery: negate current when discharging"
	kallsyms: fix build without execinfo
	maple_tree: fix mt_destroy_walk() on root leaf node
	mm: fix the inaccurate memory statistics issue for users
	scripts/gdb: fix interrupts display after MCP on x86
	scripts/gdb: de-reference per-CPU MCE interrupts
	scripts/gdb: fix interrupts.py after maple tree conversion
	mm/vmalloc: leave lazy MMU mode on PTE mapping error
	pwm: mediatek: Ensure to disable clocks in error path
	x86/rdrand: Disable RDSEED on AMD Cyan Skillfish
	x86/mm: Disable hugetlb page table sharing on 32-bit
	smb: server: make use of rdma_destroy_qp()
	ksmbd: fix a mount write count leak in ksmbd_vfs_kern_path_locked()
	erofs: fix to add missing tracepoint in erofs_read_folio()
	netlink: Fix rmem check in netlink_broadcast_deliver().
	netlink: make sure we allow at least one dump skb
	btrfs: remove noinline from btrfs_update_inode()
	btrfs: remove redundant root argument from btrfs_update_inode_fallback()
	btrfs: remove redundant root argument from fixup_inode_link_count()
	btrfs: return a btrfs_inode from btrfs_iget_logging()
	btrfs: fix inode lookup error handling during log replay
	usb:cdnsp: remove TRB_FLUSH_ENDPOINT command
	usb: cdnsp: Replace snprintf() with the safer scnprintf() variant
	usb: cdnsp: Fix issue with CV Bad Descriptor test
	usb: dwc3: Abort suspend on soft disconnect failure
	smb: client: avoid unnecessary reconnects when refreshing referrals
	smb: client: fix DFS interlink failover
	cifs: all initializations for tcon should happen in tcon_info_alloc
	wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
	drm/tegra: nvdec: Fix dma_alloc_coherent error check
	md/raid1: Fix stack memory use after return in raid1_reshape
	raid10: cleanup memleak at raid10_make_request
	nbd: fix uaf in nbd_genl_connect() error path
	netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
	net: appletalk: Fix device refcount leak in atrtr_create()
	ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof
	net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
	can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
	net: ll_temac: Fix missing tx_pending check in ethtools_set_ringparam()
	bnxt_en: Fix DCB ETS validation
	bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
	ublk: sanity check add_dev input for underflow
	atm: idt77252: Add missing `dma_map_error()`
	um: vector: Reduce stack usage in vector_eth_configure()
	io_uring: make fallocate be hashed work
	ASoC: amd: yc: add quirk for Acer Nitro ANV15-41 internal mic
	ALSA: hda/realtek - Enable mute LED on HP Pavilion Laptop 15-eg100
	net: usb: qmi_wwan: add SIMCom 8230C composition
	HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2
	net: mana: Record doorbell physical address in PF mode
	btrfs: fix assertion when building free space tree
	vt: add missing notification when switching back to text mode
	bpf: Adjust free target to avoid global starvation of LRU map
	HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
	HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
	Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
	selftests/bpf: adapt one more case in test_lru_map to the new target_free
	smb: client: fix potential race in cifs_put_tcon()
	kasan: remove kasan_find_vm_area() to prevent possible deadlock
	ksmbd: fix potential use-after-free in oplock/lease break ack
	crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP()
	rseq: Fix segfault on registration when rseq_cs is non-zero
	Linux 6.6.99

Change-Id: If006db3205eee54f5e3f425a90608fddcf8d5801
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>