Merge 6.12.40 into android16-6.12-lts

GKI (arm64) relevant 42 out of 160 changes, affecting 49 files +313/-143
  951dd99a USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI [2 files, +5/-0]
  783ea37b usb: gadget: configfs: Fix OOB read on empty string write [1 file, +4/-0]
  9ecfed98 Input: xpad - set correct controller type for Acer NGR200 [1 file, +1/-1]
  0758f7ef spi: Add check for 8-bit transfer with 8 IO mode support [1 file, +10/-4]
  68860d1a dm-bufio: fix sched in atomic context [1 file, +5/-1]
  a262370f HID: core: ensure the allocated report buffer can contain the reserved report ID [1 file, +4/-1]
  953af3c0 HID: core: ensure __hid_request reserves the report ID as the first byte [1 file, +9/-2]
  d18f63e8 HID: core: do not bypass hid_hw_raw_request [1 file, +1/-2]
  692cfff2 tracing/probes: Avoid using params uninitialized in parse_btf_arg() [1 file, +1/-1]
  33e20747 tracing: Add down_write(trace_event_sem) when adding trace event [1 file, +5/-0]
  f28044a6 io_uring/poll: fix POLLERR handling [2 files, +8/-6]
  fa0796cd af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() [1 file, +2/-2]
  1ddedbd8 af_packet: fix soft lockup issue caused by tpacket_snd() [1 file, +11/-12]
  573f1e59 cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y [1 file, +12/-11]
  11c19d42 pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov [1 file, +16/-2]
  6952aeac bpf: Reject %p% format string in bprintf-like helpers [1 file, +8/-3]
  e8767b89 block: fix kobject leak in blk_unregister_queue [1 file, +1/-0]
  8184ee3c nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list() [1 file, +1/-1]
  124765c2 nvme: fix endianness of command word prints in nvme_log_err_passthru() [1 file, +6/-6]
  fd649353 net: phy: Don't register LEDs for genphy [1 file, +4/-2]
  f9a90478 nvme: fix misaccounting of nvme-mpath inflight I/O [1 file, +4/-0]
  d57dda20 wifi: cfg80211: remove scan request n_channels counted_by [1 file, +1/-1]
  efad4e2a loop: use kiocb helpers to fix lockdep warning [1 file, +2/-3]
  b97be7ee Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() [1 file, +3/-0]
  05ab8da3 Bluetooth: hci_sync: fix connectable extended advertising when using static random address [1 file, +2/-2]
  6c586fcb Bluetooth: SMP: If an unallowed command is received consider it a failure [2 files, +19/-1]
  db386fc5 Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout [1 file, +1/-1]
  f5a40e54 Bluetooth: hci_core: add missing braces when using macro parameters [1 file, +11/-11]
  7929d27c ipv6: mcast: Delay put pmc->idev in mld_del_delrec() [1 file, +1/-1]
  7c532f22 net: fix segmentation after TCP/UDP fraglist GRO [2 files, +2/-0]
  fc38c249 netfilter: nf_conntrack: fix crash due to removal of uninitialised entry [2 files, +33/-8]
  5db93cbd Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU [1 file, +21/-5]
  8984bcbd net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime [2 files, +34/-9]
  e5c480dc net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree [1 file, +3/-1]
  b04fb262 Revert "cgroup_freezer: cgroup_freezing: Check if not frozen" [1 file, +1/-7]
  e77078e5 clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns [1 file, +5/-0]
  aec11e5f usb: hub: fix detection of high tier USB3 devices behind suspended hubs [1 file, +32/-1]
  e1135964 usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm [1 file, +4/-2]
  bf71baa3 usb: hub: Fix flushing of delayed work used for post resume purposes [2 files, +9/-13]
  c45b48b4 usb: hub: Don't try to recover devices lost during warm reset. [1 file, +6/-2]
  75747e25 usb: dwc3: qcom: Don't leave BCR asserted [1 file, +2/-6]
  8fc25d30 sched,freezer: Remove unnecessary warning in __thaw_task [1 file, +3/-12]

Changes in 6.12.40
	phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
	phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode
	phy: tegra: xusb: Disable periodic tracking on Tegra234
	USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
	USB: serial: option: add Foxconn T99W640
	USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
	usb: musb: fix gadget state on disconnect
	usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
	usb: gadget: configfs: Fix OOB read on empty string write
	i2c: stm32: fix the device used for the DMA map
	i2c: stm32f7: unmap DMA mapped buffer
	thunderbolt: Fix wake on connect at runtime
	thunderbolt: Fix bit masking in tb_dp_port_set_hops()
	Revert "staging: vchiq_arm: Create keep-alive thread during probe"
	nvmem: imx-ocotp: fix MAC address byte length
	nvmem: layouts: u-boot-env: remove crc32 endianness conversion
	Input: xpad - set correct controller type for Acer NGR200
	pch_uart: Fix dma_sync_sg_for_device() nents value
	spi: Add check for 8-bit transfer with 8 IO mode support
	dm-bufio: fix sched in atomic context
	HID: core: ensure the allocated report buffer can contain the reserved report ID
	HID: core: ensure __hid_request reserves the report ID as the first byte
	HID: core: do not bypass hid_hw_raw_request
	tracing/probes: Avoid using params uninitialized in parse_btf_arg()
	tracing: Add down_write(trace_event_sem) when adding trace event
	tracing/osnoise: Fix crash in timerlat_dump_stack()
	objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0
	drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
	drm/amdgpu: Increase reset counter only on success
	drm/amd/display: Disable CRTC degamma LUT for DCN401
	drm/amd/display: Free memory allocation
	ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
	ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
	io_uring/poll: fix POLLERR handling
	mptcp: make fallback action and fallback decision atomic
	mptcp: plug races between subflow fail and subflow creation
	mptcp: reset fallback status gracefully at disconnect() time
	phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept()
	net/mlx5: Update the list of the PCI supported devices
	arm64: dts: imx8mp-venice-gw74xx: fix TPM SPI frequency
	arm64: dts: add big-endian property back into watchdog node
	arm64: dts: freescale: imx8mm-verdin: Keep LDO5 always on
	arm64: dts: imx8mp-venice-gw71xx: fix TPM SPI frequency
	arm64: dts: imx8mp-venice-gw72xx: fix TPM SPI frequency
	arm64: dts: imx8mp-venice-gw73xx: fix TPM SPI frequency
	arm64: dts: rockchip: use cs-gpios for spi1 on ringneck
	af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd()
	af_packet: fix soft lockup issue caused by tpacket_snd()
	Bluetooth: btintel: Check if controller is ISO capable on btintel_classify_pkt_type
	cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
	dmaengine: nbpfaxi: Fix memory corruption in probe()
	isofs: Verify inode mode when loading from disk
	memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
	mmc: bcm2835: Fix dma_unmap_sg() nents value
	mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models
	mmc: sdhci_am654: Workaround for Errata i2312
	net: stmmac: intel: populate entire system_counterval_t in get_time_fn() callback
	net: libwx: remove duplicate page_pool_put_full_page()
	net: libwx: fix the using of Rx buffer DMA
	net: libwx: properly reset Rx ring descriptor
	pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
	s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
	smb: client: fix use-after-free in crypt_message when using async crypto
	soc: aspeed: lpc-snoop: Cleanup resources in stack-order
	soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled
	iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
	iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps
	iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[]
	iio: adc: max1363: Reorder mode_list[] entries
	iio: adc: stm32-adc: Fix race in installing chained IRQ handler
	iio: backend: fix out-of-bound write
	iio: common: st_sensors: Fix use of uninitialize device structs
	comedi: pcl812: Fix bit shift out of bounds
	comedi: aio_iiro_16: Fix bit shift out of bounds
	comedi: das16m1: Fix bit shift out of bounds
	comedi: das6402: Fix bit shift out of bounds
	comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
	comedi: Fix some signed shift left operations
	comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
	comedi: Fix initialization of data for instructions that write to subdevice
	arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi CM5
	arm64: dts: rockchip: Add cd-gpios for sdcard detect on Cool Pi 4B
	soundwire: amd: fix for handling slave alerts after link is down
	soundwire: amd: fix for clearing command status register
	arm64: dts: imx95: Correct the DMA interrupter number of pcie0_ep
	bpf: Reject %p% format string in bprintf-like helpers
	selftests/sched_ext: Fix exit selftest hang on UP
	cachefiles: Fix the incorrect return value in __cachefiles_write()
	net: emaclite: Fix missing pointer increment in aligned_read()
	block: fix kobject leak in blk_unregister_queue
	net/sched: sch_qfq: Fix race condition on qfq_aggregate
	rpl: Fix use-after-free in rpl_do_srh_inline().
	smb: client: fix use-after-free in cifs_oplock_break
	fix a leak in fcntl_dirnotify()
	nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
	nvme: fix endianness of command word prints in nvme_log_err_passthru()
	smc: Fix various oops due to inet_sock type confusion.
	net: phy: Don't register LEDs for genphy
	nvme: fix misaccounting of nvme-mpath inflight I/O
	nvmet-tcp: fix callback lock for TLS handshake
	wifi: cfg80211: remove scan request n_channels counted_by
	can: tcan4x5x: add option for selecting nWKRQ voltage
	can: tcan4x5x: fix reset gpio usage during probe
	selftests: net: increase inter-packet timeout in udpgro.sh
	hwmon: (corsair-cpro) Validate the size of the received input buffer
	ice: add NULL check in eswitch lag check
	ice: check correct pointer in fwlog debugfs
	usb: net: sierra: check for no status endpoint
	loop: use kiocb helpers to fix lockdep warning
	riscv: Enable interrupt during exception handling
	riscv: traps_misaligned: properly sign extend value in misaligned load handler
	Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
	Bluetooth: hci_sync: fix connectable extended advertising when using static random address
	Bluetooth: SMP: If an unallowed command is received consider it a failure
	Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
	Bluetooth: hci_core: add missing braces when using macro parameters
	Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855 GF variant without board ID
	net/mlx5: Correctly set gso_size when LRO is used
	ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
	net: fix segmentation after TCP/UDP fraglist GRO
	netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
	drm/xe/pf: Sanitize VF scratch registers on FLR
	drm/xe/pf: Move VFs reprovisioning to worker
	drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
	Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
	hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf
	virtio-net: fix recursived rtnl_lock() during probe()
	tls: always refresh the queue when reading sock
	net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
	net: bridge: Do not offload IGMP/MLD messages
	net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
	rxrpc: Fix recv-recv race of completed call
	rxrpc: Fix transmission of an abort in response to an abort
	Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
	drm/mediatek: Add wait_event_timeout when disabling plane
	drm/mediatek: only announce AFBC if really supported
	libbpf: Fix handling of BPF arena relocations
	efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths
	sched: Change nr_uninterruptible type to unsigned long
	clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
	btrfs: fix block group refcount race in btrfs_create_pending_block_groups()
	usb: hub: fix detection of high tier USB3 devices behind suspended hubs
	usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
	usb: hub: Fix flushing of delayed work used for post resume purposes
	usb: hub: Don't try to recover devices lost during warm reset.
	usb: dwc3: qcom: Don't leave BCR asserted
	net: libwx: fix multicast packets received count
	rust: use `#[used(compiler)]` to fix build and `modpost` with Rust >= 1.89.0
	selftests/bpf: Set test path for token/obj_priv_implicit_token_envvar
	i2c: omap: Add support for setting mux
	i2c: omap: Fix an error handling path in omap_i2c_probe()
	i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()
	i2c: omap: fix deprecated of_property_read_bool() use
	sched,freezer: Remove unnecessary warning in __thaw_task
	drm/xe/mocs: Initialize MOCS index early
	drm/xe: Move page fault init after topology init
	smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data
	iommu/vt-d: Fix misplaced domain_attached assignment
	KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
	Linux 6.12.40

Change-Id: Ife576b43f4160f0c113f08800bb28dfd05e97d66
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>