Merge 6.6.29 into android15-6.6

Changes in 6.6.29
	smb: client: remove extra @chan_count check in __cifs_put_smb_ses()
	smb: client: fix UAF in smb2_reconnect_server()
	smb3: show beginning time for per share stats
	smb: client: guarantee refcounted children from parent session
	smb: client: refresh referral without acquiring refpath_lock
	drm/i915: Fix FEC pipe A vs. DDI A mixup
	drm/i915/mst: Reject FEC+MST on ICL
	drm/i915/cdclk: Fix voltage_level programming edge case
	drm/i915: Change intel_pipe_update_{start,end}() calling convention
	drm/i915: Extract intel_crtc_vblank_evade_scanlines()
	drm/i915: Enable VRR later during fastsets
	drm/i915: Adjust seamless_m_n flag behaviour
	drm/i915: Disable live M/N updates when using bigjoiner
	selftests: timers: Convert posix_timers test to generate KTAP output
	selftests/timers/posix_timers: Reimplement check_timer_distribution()
	drm/amd/display: Do not recursively call manual trigger programming
	ceph: pass the mdsc to several helpers
	ceph: rename _to_client() to _to_fs_client()
	ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE
	selftests: timers: Fix posix_timers ksft_print_msg() warning
	drm/msm/dpu: populate SSPP scaler block version
	media: videobuf2: request more buffers for vb2_read
	io_uring: Fix io_cqring_wait() not restoring sigmask on get_timespec64() failure
	drm/i915/vma: Fix UAF on destroy against retire race
	SUNRPC: Fix rpcgss_context trace event acceptor field
	selftests/ftrace: Limit length in subsystem-enable tests
	random: handle creditable entropy from atomic process context
	scsi: core: Fix handling of SCMD_FAIL_IF_RECOVERING
	net: usb: ax88179_178a: avoid writing the mac address before first reading
	arm64/mm: Modify range-based tlbi to decrement scale
	arm64: tlb: Fix TLBI RANGE operand
	scsi: ufs: qcom: Add missing interconnect bandwidth values for Gear 5
	netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
	netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
	netfilter: br_netfilter: skip conntrack input hook for promisc packets
	netfilter: nft_set_pipapo: do not free live element
	netfilter: flowtable: validate pppoe header
	netfilter: flowtable: incorrect pppoe tuple
	af_unix: Call manage_oob() for every skb in unix_stream_read_generic().
	af_unix: Don't peek OOB data without MSG_OOB.
	net: sparx5: flower: fix fragment flags handling
	net/mlx5: Lag, restore buckets number to default after hash LAG deactivation
	net/mlx5e: Prevent deadlock while disabling aRFS
	net: change maximum number of UDP segments to 128
	octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation
	net: stmmac: Apply half-duplex-less constraint for DW QoS Eth only
	net: stmmac: Fix max-speed being ignored on queue re-init
	net: stmmac: Fix IP-cores specific MAC capabilities
	ice: tc: check src_vsi in case of traffic from VF
	ice: tc: allow zero flags in parsing tc flower
	ice: Fix checking for unsupported keys on non-tunnel device
	tun: limit printing rate when illegal packet received by tun dev
	net: dsa: mt7530: fix mirroring frames received on local port
	net: dsa: mt7530: fix port mirroring for MT7988 SoC switch
	s390/ism: Properly fix receive message buffer allocation
	gpiolib: swnode: Remove wrong header inclusion
	net: ethernet: mtk_eth_soc: fix WED + wifi reset
	net: ethernet: ti: am65-cpsw-nuss: cleanup DMA Channels before using them
	drm/i915/mst: Limit MST+DSC to TGL+
	RDMA/rxe: Fix the problem "mutex_destroy missing"
	RDMA/cm: Print the old state when cm_destroy_id gets timeout
	RDMA/mlx5: Fix port number for counter query in multi-port configuration
	perf lock contention: Add a missing NULL check
	s390/qdio: handle deferred cc1
	s390/cio: fix race condition during online processing
	drm: nv04: Fix out of bounds access
	drm/panel: visionox-rm69299: don't unregister DSI device
	drm/radeon: make -fstrict-flex-arrays=3 happy
	ALSA: scarlett2: Move USB IDs out from device_info struct
	ALSA: scarlett2: Add support for Clarett 8Pre USB
	ASoC: ti: Convert Pandora ASoC to GPIO descriptors
	thunderbolt: Introduce tb_port_reset()
	thunderbolt: Introduce tb_path_deactivate_hop()
	thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers
	thunderbolt: Reset topology created by the boot firmware
	ALSA: scarlett2: Default mixer driver to enabled
	ALSA: scarlett2: Add correct product series name to messages
	ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support
	ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support
	PCI/DPC: Use FIELD_GET()
	PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word()
	ALSA: scarlett2: Rename scarlett_gen2 to scarlett2
	drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go
	usb: xhci: Add timeout argument in address_device USB HCD callback
	usb: new quirk to reduce the SET_ADDRESS request timeout
	platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes
	interconnect: Don't access req_list while it's being manipulated
	clk: Remove prepare_lock hold assertion in __clk_release()
	clk: Initialize struct clk_core kref earlier
	clk: Get runtime PM before walking tree during disable_unused
	clk: Show active consumers of clocks in debugfs
	clk: Get runtime PM before walking tree for clk_summary
	clk: mediatek: Do a runtime PM get on controllers during probe
	x86/bugs: Fix BHI retpoline check
	x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
	net/mlx5: E-switch, store eswitch pointer before registering devlink_param
	ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages
	ALSA: hda/tas2781: correct the register for pow calibrated data
	ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1
	ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N
	ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC
	binder: check offset alignment in binder_get_object()
	thunderbolt: Avoid notify PM core about runtime PM resume
	thunderbolt: Fix wake configurations after device unplug
	comedi: vmk80xx: fix incomplete endpoint checking
	serial: mxs-auart: add spinlock around changing cts state
	serial/pmac_zilog: Remove flawed mitigation for rx irq flood
	serial: stm32: Return IRQ_NONE in the ISR if no handling happend
	serial: stm32: Reset .throttled state in .startup()
	serial: core: Clearing the circular buffer before NULLifying it
	serial: core: Fix missing shutdown and startup for serial base port
	USB: serial: option: add Fibocom FM135-GL variants
	USB: serial: option: add support for Fibocom FM650/FG650
	USB: serial: option: add Lonsung U8300/U9300 product
	USB: serial: option: support Quectel EM060K sub-models
	USB: serial: option: add Rolling RW101-GL and RW135-GL support
	USB: serial: option: add Telit FN920C04 rmnet compositions
	Revert "usb: cdc-wdm: close race between read and workqueue"
	usb: dwc2: host: Fix dereference issue in DDMA completion flow.
	usb: Disable USB3 LPM at shutdown
	usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
	mei: me: disable RPL-S on SPS and IGN firmwares
	speakup: Avoid crash on very long word
	fs: sysfs: Fix reference leak in sysfs_break_active_protection()
	sched: Add missing memory barrier in switch_mm_cid
	KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible
	KVM: x86/pmu: Disable support for adaptive PEBS
	KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms
	KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
	arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H
	arm64: hibernate: Fix level3 translation fault in swsusp_save()
	init/main.c: Fix potential static_command_line memory overflow
	mm/userfaultfd: allow hugetlb change protection upon poison entry
	mm,swapops: update check in is_pfn_swap_entry for hwpoison entries
	mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
	mm/shmem: inline shmem_is_huge() for disabled transparent hugepages
	fuse: fix leaked ENOSYS error on first statx call
	drm/amdgpu: validate the parameters of bo mapping operations more clearly
	drm/amdkfd: Fix memory leak in create_process failure
	drm/amdgpu: remove invalid resource->start check v2
	drm/vmwgfx: Fix prime import/export
	drm/vmwgfx: Sort primary plane formats by order of preference
	drm/vmwgfx: Fix crtc's atomic check conditional
	nouveau: fix instmem race condition around ptr stores
	bootconfig: use memblock_free_late to free xbc memory to buddy
	nilfs2: fix OOB in nilfs_set_de_type
	net: dsa: mt7530: fix improper frames on all 25MHz and 40MHz XTAL MT7530
	net: dsa: mt7530: fix enabling EEE on MT7531 switch on all boards
	virtio_net: Do not send RSS key if it is not supported
	powerpc/ftrace: Ignore ftrace locations in exit text sections
	ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
	ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
	ksmbd: clear RENAME_NOREPLACE before calling vfs_rename
	ksmbd: common: use struct_group_attr instead of struct_group for network_open_info
	PCI/ASPM: Fix deadlock when enabling ASPM
	thunderbolt: Reset only non-USB4 host routers in resume
	selftests: kselftest: Fix build failure with NOLIBC
	Linux 6.6.29

Change-Id: I3c588ee03a8d6a44ee48609b59cbddf8d006ee55
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>