Merge 6.6.67 into android15-6.6-lts

GKI (arm64) relevant 27 out of 110 changes, affecting 35 files +398/-138
  f9f85df3 bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors [1 file, +7/-0]
  bc6d8cc2 splice: do not checksum AF_UNIX sockets [1 file, +1/-0]
  7ac2535d tcp: check space before adding MPTCP SYN options [1 file, +4/-2]
  5baa2856 blk-cgroup: Fix UAF in blkcg_unpin_online() [1 file, +5/-1]
  e6c33847 ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5 [1 file, +2/-0]
  3184e07e scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe [1 file, +1/-0]
  8ca07a3d usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer [1 file, +6/-3]
  c7e1962a bpf: Check size for BTF-based ctx access of pointer members [3 files, +10/-4]
  68d23ee1 bpf: Fix theoretical prog_array UAF in __uprobe_perf_func() [2 files, +10/-9]
  c2b6b476 bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog [1 file, +4/-0]
  b015f19f bpf, sockmap: Fix race between element replace and close() [1 file, +2/-3]
  dbec5b42 bpf, sockmap: Fix update element with same [1 file, +1/-0]
  89ecda49 tipc: fix NULL deref in cleanup_bearer() [1 file, +6/-1]
  b7a79e51 net: defer final 'struct net' free in netns dismantle [2 files, +20/-1]
  8c2c8445 netfilter: IDLETIMER: Fix for possible ABBA deadlock [1 file, +28/-24]
  27f05742 netfilter: nf_tables: do not defer rule destruction via call_rcu [2 files, +15/-21]
  3824c5fa net/sched: netem: account for backlog updates from child qdisc [1 file, +16/-6]
  11dc486e Bluetooth: ISO: Reassociate a socket with an active BIS [3 files, +131/-4]
  0108132d Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating [1 file, +11/-22]
  263b390a Bluetooth: iso: Fix recursive locking warning [1 file, +6/-2]
  3bf09c68 Bluetooth: SCO: Add support for 16 bits transparent voice setting [2 files, +16/-14]
  4a542118 blk-iocost: Avoid using clamp() on inuse in __propagate_weights() [1 file, +8/-1]
  4e76efda KVM: arm64: Disable MPAM visibility by default and ignore VMM writes [1 file, +50/-2]
  bfe9446e bpf: sync_linked_regs() must preserve subreg_def [1 file, +4/-1]
  3a7d88f9 tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe() [1 file, +1/-1]
  44a7b041 ALSA: usb-audio: Fix a DMA to stack memory bug [1 file, +27/-15]
  e68cbbef x86/static-call: fix 32-bit build [1 file, +6/-1]

Changes in 6.6.67
	bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
	perf/x86/intel/ds: Unconditionally drain PEBS DS when changing PEBS_DATA_CFG
	ksmbd: fix racy issue from session lookup and expire
	splice: do not checksum AF_UNIX sockets
	tcp: check space before adding MPTCP SYN options
	riscv: Fix wrong usage of __pa() on a fixmap address
	blk-cgroup: Fix UAF in blkcg_unpin_online()
	ALSA: usb-audio: Add implicit feedback quirk for Yamaha THR5
	riscv: Fix IPIs usage in kfence_protect_page()
	usb: host: max3421-hcd: Correctly abort a USB request.
	ata: sata_highbank: fix OF node reference leak in highbank_initialize_phys()
	usb: dwc2: Fix HCD resume
	usb: dwc2: hcd: Fix GetPortStatus & SetPortFeature
	usb: dwc2: Fix HCD port connection race
	scsi: ufs: core: Update compl_time_stamp_local_clock after completing a cqe
	usb: gadget: midi2: Fix interpretation of is_midi1 bits
	usb: ehci-hcd: fix call balance of clocks handling routines
	usb: typec: anx7411: fix fwnode_handle reference leak
	usb: typec: anx7411: fix OF node reference leaks in anx7411_typec_switch_probe()
	usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
	usb: dwc3: xilinx: make sure pipe clock is deselected in usb2 only mode
	drm/i915: Fix memory leak by correcting cache object name in error handler
	drm/i915: Fix NULL pointer dereference in capture_engine
	xfs: update btree keys correctly when _insrec splits an inode root block
	xfs: don't drop errno values when we fail to ficlone the entire range
	xfs: return from xfs_symlink_verify early on V4 filesystems
	xfs: fix scrub tracepoints when inode-rooted btrees are involved
	xfs: only run precommits once per transaction object
	bpf: Check size for BTF-based ctx access of pointer members
	bpf: Fix theoretical prog_array UAF in __uprobe_perf_func()
	bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
	bpf, sockmap: Fix race between element replace and close()
	bpf, sockmap: Fix update element with same
	rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
	wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
	wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon
	wifi: mac80211: clean up 'ret' in sta_link_apply_parameters()
	wifi: mac80211: fix station NSS capability initialization order
	acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
	amdgpu/uvd: get ring reference from rq scheduler
	batman-adv: Do not send uninitialized TT changes
	batman-adv: Remove uninitialized data in full table TT response
	batman-adv: Do not let TT changes list grows indefinitely
	tipc: fix NULL deref in cleanup_bearer()
	net/mlx5: DR, prevent potential error pointer dereference
	wifi: cfg80211: sme: init n_channels before channels[] access
	selftests: mlxsw: sharedbuffer: Remove h1 ingress test case
	selftests: mlxsw: sharedbuffer: Remove duplicate test cases
	selftests: mlxsw: sharedbuffer: Ensure no extra packets are counted
	ptp: kvm: x86: Return EOPNOTSUPP instead of ENODEV from kvm_arch_ptp_init()
	net: lapb: increase LAPB_HEADER_LEN
	net: defer final 'struct net' free in netns dismantle
	net: mscc: ocelot: fix memory leak on ocelot_port_add_txtstamp_skb()
	net: mscc: ocelot: improve handling of TX timestamp for unknown skb
	net: mscc: ocelot: ocelot->ts_id_lock and ocelot_port->tx_skbs.lock are IRQ-safe
	net: mscc: ocelot: be resilient to loss of PTP packets during transmission
	net: mscc: ocelot: perform error cleanup in ocelot_hwstamp_set()
	spi: aspeed: Fix an error handling path in aspeed_spi_[read|write]_user()
	net: sparx5: fix FDMA performance issue
	net: sparx5: fix the maximum frame length register
	ACPI: resource: Fix memory resource type union access
	cxgb4: use port number to set mac addr
	qca_spi: Fix clock speed for multiple QCA7000
	qca_spi: Make driver probing reliable
	ALSA: control: Avoid WARN() for symlink errors
	ASoC: amd: yc: Fix the wrong return value
	Documentation: PM: Clarify pm_runtime_resume_and_get() return value
	net: rswitch: Drop unused argument/return value
	net: rswitch: Use unsigned int for desc related array index
	net: rswitch: Use build_skb() for RX
	net: rswitch: Add unmap_addrs instead of dma address in each desc
	net: rswitch: Add a setting ext descriptor function
	net: rswitch: Add jumbo frames handling for TX
	net: renesas: rswitch: fix race window between tx start and complete
	net: renesas: rswitch: fix leaked pointer on error path
	net: renesas: rswitch: avoid use-after-put for a device tree node
	net: renesas: rswitch: handle stop vs interrupt race
	netfilter: IDLETIMER: Fix for possible ABBA deadlock
	netfilter: nf_tables: do not defer rule destruction via call_rcu
	net: dsa: felix: fix stuck CPU-injected packets with short taprio windows
	net/sched: netem: account for backlog updates from child qdisc
	bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
	team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL
	ACPICA: events/evxfregn: don't release the ContextMutex that was never acquired
	Bluetooth: ISO: Reassociate a socket with an active BIS
	Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
	Bluetooth: iso: Fix recursive locking warning
	Bluetooth: SCO: Add support for 16 bits transparent voice setting
	Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
	net: renesas: rswitch: fix initial MPIC register setting
	net: dsa: microchip: KSZ9896 register regmap alignment to 32 bit boundaries
	blk-iocost: Avoid using clamp() on inuse in __propagate_weights()
	kselftest/arm64: abi: fix SVCR detection
	KVM: arm64: Disable MPAM visibility by default and ignore VMM writes
	bpf: sync_linked_regs() must preserve subreg_def
	tracing/kprobes: Skip symbol counting logic for module symbols in create_local_trace_kprobe()
	selftests/bpf: Add netlink helper library
	selftests/bpf: remove use of __xlated()
	net: rswitch: Avoid use-after-free in rswitch_poll()
	xen/netfront: fix crash when removing device
	x86: make get_cpu_vendor() accessible from Xen code
	objtool/x86: allow syscall instruction
	x86/static-call: provide a way to do very early static-call updates
	x86/xen: don't do PV iret hypercall through hypercall page
	x86/xen: add central hypercall functions
	x86/xen: use new hypercall functions instead of hypercall page
	x86/xen: remove hypercall page
	ALSA: usb-audio: Fix a DMA to stack memory bug
	x86/static-call: fix 32-bit build
	Linux 6.6.67

Change-Id: I267ea7726eb25f84114e567ede890fb2217c80f0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>