Merge tag 'android14-6.1.128_r00' into android14-6.1

This merges the android14-6.1.128_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 8ae119f6 ANDROID: hrtimers: revert mismerged commit in 6.1.127 LTS merge
*   e6d1ba54 Merge 6.1.128 into android14-6.1-lts
|\
| * 0cbb5f65 Linux 6.1.128
| * a9401cd5 drm/v3d: Assign job pointer to NULL before signaling the fence
| * 7d06d97e ASoC: samsung: midas_wm1811: Fix 'Headphone Switch' control creation
| * 44c49581 smb: client: fix NULL ptr deref in crypto_aead_setkey()
| * 4982cc83 Input: xpad - add support for wooting two he (arm)
| * b336f583 Input: xpad - add unofficial Xbox 360 wireless receiver clone
| * dd000518 Input: atkbd - map F23 key to support default copilot shortcut
| * 4631653d ALSA: usb-audio: Add delay quirk for USB Audio Device
| * 33233b06 Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null"
| * 4b9b41fa USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
| * bce96653 smb: client: fix UAF in async decryption
| * 49a27ee4 wifi: iwlwifi: add a few rate index validity checks
| * 182a4b7c scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
| * ce114240 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
| * 13ea9547 ext4: fix access to uninitialised lock in fc replay path
| * 6bcb8a5b vfio/platform: check the bounds of read/write syscalls
| * 1a1b2b8c Revert "HID: multitouch: Add support for lenovo Y9000P Touchpad"
| * 8476f842 block: fix integer overflow in BLKSECDISCARD
| * 1332c6ed net: sched: fix ets qdisc OOB Indexing
| * 74a37ce6 io_uring: fix waiters missing wake ups
| * 2a40a140 gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
| * 754df8c9 xfs: respect the stable writes flag on the RT device
| * bc4ad699 xfs: clean up FS_XFLAG_REALTIME handling in xfs_ioctl_setattr_xflags
| * 7880b1f0 xfs: dquot recovery does not validate the recovered dquot
| * df716416 xfs: clean up dqblk extraction
| * 318cac2b xfs: inode recovery does not validate the recovered inode
| * 6e782627 xfs: fix internal error from AGFL exhaustion
| * 323a7079 xfs: up(ic_sema) if flushing data device fails
| * 67c362b8 xfs: only remap the written blocks in xfs_reflink_end_cow_extent
| * b655ee7d xfs: abort intent items when recovery intents fail
| * 16cf312b xfs: factor out xfs_defer_pending_abort
| * 6685b885 xfs: allow read IO and FICLONE to run concurrently
| * 4eb3b579 xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space
| * feb30fe4 xfs: introduce protection for drop nlink
| * 4d607041 xfs: make sure maxlen is still congruent with prod when rounding down
| * 34167d02 xfs: fix units conversion error in xfs_bmap_del_extent_delay
| * 91536449 xfs: rt stubs should return negative errnos when rt disabled
| * 9670abd1 xfs: prevent rt growfs when quota is enabled
| * 8ee604ac xfs: hoist freeing of rt data fork extent mappings
| * 79bdab54 xfs: bump max fsgeom struct version
| * f1bc5706 softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel
| * d0ec61c9 ipv6: Fix soft lockups in fib6_select_path under high next hop churn
| * 9fdec478 regmap: detach regmap from dev on regmap_exit
| * 87d69690 ASoC: samsung: Add missing depends on I2C
| * 656100f6 ASoC: samsung: midas_wm1811: Map missing jack kcontrols
| * d2b4b39b irqchip/sunxi-nmi: Add missing SKIP_WAKE flag
| * b7d24618 drm/amd/display: Use HW lock mgr for PSR1
| * 2104ad71 scsi: iscsi: Fix redundant response for ISCSI_UEVENT_GET_HOST_STATS request
| * 18cb5798 seccomp: Stub for !CONFIG_SECCOMP
| * b873c88b ASoC: samsung: Add missing selects for MFD_WM8994
| * 8cf587aa ASoC: wm8994: Add depends on MFD core
* | 979fb1d6 Revert "fs: fix missing declaration of init_files"
* | 42cbb802 Revert "net: add exit_batch_rtnl() method"
* | 5b18fc7e Revert "gtp: use exit_batch_rtnl() method"
* | da69d668 Revert "gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp()."
* | f3dfa826 Revert "gtp: Destroy device along with udp socket's netns dismantle."
* | 79f1b689 Merge 6.1.127 into android14-6.1-lts
|\|
| * 75cefdf1 Linux 6.1.127
| * be7c61ea net: fix data-races around sk->sk_forward_alloc
| * 060de371 x86/xen: fix SLS mitigation in xen_hypercall_iret()
| * 400fb0e9 nfsd: add list_head nf_gc to struct nfsd_file
| * 75a0a6dd erofs: handle NONHEAD !delta[1] lclusters gracefully
| * 6326a3dc erofs: tidy up EROFS on-disk naming
| * 6e5dbd1c wifi: ath10k: avoid NULL pointer error during sdio remove
| * cd862903 Revert "regmap: detach regmap from dev on regmap_exit"
| * 275b8347 scsi: sg: Fix slab-use-after-free read in sg_release()
| * 9e95518e RDMA/rxe: Fix the qp flush warnings in req
| * e7736037 Revert "drm/amdgpu: rework resume handling for display (v2)"
| * 1921fe7d block: fix uaf for flush rq while iterating tags
| * 05b1b339 drm/amdgpu: fix usage slab after free
| * 5bd410c2 drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
| * 64b79afd iio: adc: rockchip_saradc: fix information leak in triggered buffer
| * d3e25180 iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on
| * f2e4823b iio: imu: inv_icm42600: fix spi burst write not supported
| * 479a42ee Revert "PCI: Use preserve_config in place of pci_flags"
| * 6603aca9 drm/i915/fb: Relax clear color alignment to 64 bytes
| * 3d41dbf8 hrtimers: Handle CPU state correctly on hotplug
| * d7b0e896 irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity()
| * e64612f8 irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly
| * e1994d0f irqchip: Plug a OF node reference leak in platform_irqchip_probe()
| * 699cc10c pmdomain: imx8mp-blk-ctrl: add missing loop break condition
| * d38c49f7 gpiolib: cdev: Fix use after free in lineinfo_changed_notify
| * 65c367bd fs/proc: fix softlockup in __read_vmcore (part 2)
| * 80fc836f filemap: avoid truncating 64-bit offset to 32 bits
| * b52e50dd vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
| * cc586af3 vsock: reset socket state when de-assigning the transport
| * a3c9390f vsock/virtio: cancel close work in the destructor
| * 88244163 vsock/virtio: discard packets if the transport changes
| * 435349d4 net: ethernet: xgbe: re-add aneg to supported features in PHY quirks
| * 9e1f5094 selftests: mptcp: avoid spurious errors on disconnect
| * 73411e09 mptcp: be sure to send ack when mptcp-level window re-opens
| * fe3de867 zram: fix potential UAF of zram table
| * f9830994 ALSA: hda/realtek: Add support for Ayaneo System using CS35L41 HDA
| * 0b30238c x86/asm: Make serialize() always_inline
| * 3375bdf8 poll_wait: add mb() to fix theoretical race between waitqueue_active() and .poll()
| * 7ca4bd6b iomap: avoid avoid truncating 64-bit offset to 32 bits
| * a5045ca6 ACPI: resource: acpi_dev_irq_override(): Check DMI match last
| * bea2a4cf selftests: tc-testing: reduce rshift value
| * 435df80d scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers
| * f937130b cachefiles: Parse the "secctx" immediately
| * d8680dad kheaders: Ignore silly-rename files
| * bb00b119 fs: fix missing declaration of init_files
| * 19021857 hfs: Sanity check the root record
| * 41e4ca8a mac802154: check local interfaces before deleting sdata list
| * cce9254a nvmet: propagate npwg topology
| * 75505de0 i2c: rcar: fix NACK handling when being a target
| * 53336f33 i2c: mux: demux-pinctrl: check initial mux selection, too
| * 4c833c36 Revert "mtd: spi-nor: core: replace dummy buswidth from addr to data"
| * 79fe53ed hwmon: (tmp513) Fix division of negative numbers
| * 2a1c88f7 drm/v3d: Ensure job pointer is set to NULL after job completion
| * efc92a26 net/mlx5: Clear port select structure when fail to create
| * edb43b46 net/mlx5: Fix RDMA TX steering prio
| * 207c81e2 net: xilinx: axienet: Fix IRQ coalescing packet count overflow
| * c385389a nfp: bpf: prevent integer overflow in nfp_bpf_event_output()
| * efec287c gtp: Destroy device along with udp socket's netns dismantle.
| * c91e6946 gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().
| * a3fdd5f3 gtp: use exit_batch_rtnl() method
| * 760f415e net: add exit_batch_rtnl() method
| * e5d24a70 pktgen: Avoid out-of-bounds access in get_imix_entries
| * ea9e9903 openvswitch: fix lockup on tx to unregistering netdev with carrier
| * d0a3b3d1 bpf: Fix bpf_sk_select_reuseport() memory leak
| * 07524817 net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()
* | 766d61c1 Merge branch 'android14-6.1' into android14-6.1-lts
* | 12fe4482 Merge 6.1.126 into android14-6.1-lts
|\|
| * f4f67728 Linux 6.1.126
| * f6247d3e Partial revert of xhci: use pm_ptr() instead #ifdef for CONFIG_PM conditionals
* | 3ad3cca3 Merge 6.1.125 into android14-6.1-lts
|\|
| * 60ceadf9 Linux 6.1.125
| * 9734fd7a xhci: use pm_ptr() instead of #ifdef for CONFIG_PM conditionals
| * d2085719 drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
| * 90d4d271 drm: bridge: adv7511: use dev_err_probe in probe function
| * 2d431192 ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
| * 18a1cd92 ocfs2: correct return value of ocfs2_local_free_info()
| * ad9ec26a of: address: Preserve the flags portion on 1:1 dma-ranges mapping
| * 007662f7 of: address: Store number of bus flag cells rather than bool
| * 7eb954ec of: address: Remove duplicated functions
| * 30eb1123 of: address: Fix address translation when address-size is greater than 2
| * 46dfdb0f of/address: Add support for 3 address cell bus
| * 57e3220c of: unittest: Add bus address range parsing tests
| * 40153aae arm64: dts: rockchip: add hevc power domain clock to rk3328
| * 2550149f block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
| * 64b0aebe ARM: dts: imxrt1050: Fix clocks for mmc
| * 6b63308c io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
| * 3e871c1d iio: adc: ad7124: Disable all channels at probe time
| * 6c92d6f2 iio: inkern: call iio_device_put() only on mapped devices
| * 25ef52f1 iio: adc: at91: call input_free_device() on allocated iio_dev
| * 26016d08 iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()
| * 7bc7e9d6 iio: gyro: fxas21002c: Fix missing data update in trigger handler
| * ebe2672b iio: adc: ti-ads8688: fix information leak in triggered buffer
| * 6985ba44 iio: imu: kmx61: fix information leak in triggered buffer
| * 47d245be iio: light: vcnl4035: fix information leak in triggered buffer
| * b0642d9c iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
| * b7849f62 iio: pressure: zpa2326: fix information leak in triggered buffer
| * 82f60f36 usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
| * 9981c33a usb: gadget: f_uac2: Fix incorrect setting of bNumEndpoints
| * dc51b66e usb: fix reference leak in usb_new_device()
| * c6f763b5 USB: core: Disable LPM only for non-suspended ports
| * 39219c26 USB: usblp: return error when setting unsupported protocol
| * 92a185bf usb: dwc3-am62: Disable autosuspend during remove
| * 3d730e87 usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null
| * d26b9f0b misc: microchip: pci1xxxx: Resolve return code mismatch during GPIO set config
| * 79aef618 misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
| * ca47e933 topology: Keep the cpumask unchanged when printing cpumap
| * 20a57256 usb: dwc3: gadget: fix writing NYET threshold
| * 32af3bcc USB: serial: cp210x: add Phoenix Contact UPS Device
| * 65cb57b9 usb-storage: Add max sectors quirk for Nokia 208
| * 78e8abbd staging: iio: ad9832: Correct phase range check
| * 331e6e9f staging: iio: ad9834: Correct phase range check
| * c712fa61 USB: serial: option: add Neoway N723-EA support
| * fb946212 USB: serial: option: add MeiG Smart SRM815
* | afc952d5 Merge 43f4df33 ("bpf: Fix overloading of MEM_UNINIT's meaning") into android14-6.1-lts
|\|
| * 43f4df33 bpf: Fix overloading of MEM_UNINIT's meaning
* | 22d4625e Merge 2a72b2ce ("bpf: Add MEM_WRITE attribute") into android14-6.1-lts
|\|
| * 2a72b2ce bpf: Add MEM_WRITE attribute
* | b3b3e04d Merge 6bc6ee31 ("dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)") into android14-6.1-lts
|\|
| * 6bc6ee31 dm-verity FEC: Fix RS FEC repair for roots unaligned to block size (take 2)
| * e3ce913a drm/amd/display: increase MAX_SURFACES to the value supported by hw
| * abe587a4 ACPI: resource: Add Asus Vivobook X1504VAP to irq1_level_low_skip_override[]
| * 88b9cf8f ACPI: resource: Add TongFang GM5HG0A to irq1_edge_low_force_override[]
| * c21df31f riscv: Fix sleeping in invalid context in die()
| * d0645e11 thermal: of: fix OF node leak in of_thermal_zone_find()
| * f3d1e406 drm/amd/display: Add check for granularity in dml ceil/floor helpers
| * 44ee8635 sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
| * e919197f sctp: sysctl: udp_port: avoid using current->nsproxy
| * 1b67030d sctp: sysctl: auth_enable: avoid using current->nsproxy
| * 4059507e sctp: sysctl: rto_min/max: avoid using current->nsproxy
| * 3cd0659d sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
* | c0e24516 Merge c0dde4a5 ("dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY") into android14-6.1-lts
|/
* c0dde4a5 dm-ebs: don't set the flag DM_TARGET_PASSES_INTEGRITY
* 12771050 dm thin: make get_first_thin use rcu-safe list first function
* bb87b494 cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu
* 13e41c58 ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
* aabe47cf afs: Fix the maximum cell name length
* ee7e40f7 ksmbd: fix a missing return value check bug
* f05f5ab5 drm/mediatek: Add return value check when reading DPCD
* 4e674923 drm/mediatek: Fix mode valid issue for dp
* e0ad4b01 drm/mediatek: Fix YCbCr422 color format issue for DP
* 21c501e6 drm/mediatek: stop selecting foreign drivers
* f0a28087 net/mlx5: Fix variable not being completed when function returns
* a777e06d sched: sch_cake: add bounds checks to host bulk flow fairness counts
* 5552b4fd netfilter: conntrack: clamp maximum hashtable size to INT_MAX
* d470b925 netfilter: nf_tables: imbalance in flowtable binding
* 636d7b95 tcp: Annotate data-race around sk->sk_mark in tcp_v4_send_reset
* faa8a33e Bluetooth: hci_sync: Fix not setting Random Address when required
* ecb1356a tls: Fix tls_sw_sendmsg error handling
* 657a87c2 ice: fix incorrect PHY settings for 100 GB/s
* 8a7b73f1 cxgb4: Avoid removal of uninserted tid
* b9582838 bnxt_en: Fix possible memory leak when hwrm_req_replace fails
* 2011749c net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
* 2d230410 tcp/dccp: allow a connection when sk_max_ack_backlog is zero
* c0b0d9ae tcp/dccp: complete lockless accesses to sk->sk_max_ack_backlog
* 0a5026be net: 802: LLC+SNAP OID:PID lookup on start of skb data
* 4589abf8 ieee802154: ca8210: Add missing check for kfifo_alloc() in ca8210_probe()
* f6dce4dc ASoC: mediatek: disable buffer pre-allocation
* 939d239f scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
* d23f2621 exfat: fix the infinite loop in __exfat_free_cluster()
* 31beabd0 exfat: fix the infinite loop in exfat_readdir()
* 43c38c3b dm array: fix cursor index when skipping across block boundaries
* 956a74b2 dm array: fix unreleased btree blocks on closing a faulty array cursor
* e477021d dm array: fix releasing a faulty array block twice in dm_array_cursor_end
* 5af095cb jbd2: flush filesystem device before updating tail sequence
* 62834f5b jbd2: increase IO priority for writing revoke records
* 397383db sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers
* b79a0d1e bpf, sockmap: Fix race between element replace and close()
* e4b168c6 ceph: give up on paths longer than PATH_MAX

Change-Id: Ia18514bdd4d67e9850b55a4637d0fbe4a138658f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>