Merge tag 'android15-6.6.102_r00' into android15-6.6

This merges the android15-6.6.102_r00 tag into the android15-6.6 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* 7ca2e5ea Revert "loop: Avoid updating block size under exclusive owner"
*   473c6cd2 Merge cfa9b873 ("ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed") into android15-6.6-lts
|\
| * cfa9b873 ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed
| * 7423fc4d EDAC/synopsys: Clear the ECC counters on init
| * f53e16dd PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store()
| * d7d6d076 ARM: rockchip: fix kernel hang during smp initialization
| * 6a8b0c7e cpufreq: Exit governor when failed to start old governor
| * 20bbe54f gpio: wcd934x: check the return value of regmap_update_bits()
| * 6b8a8eac remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU
| * 082735fb ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered
| * 84518ec7 soc: qcom: rpmh-rsc: Add RSC version 4 support
| * 16a50886 usb: xhci: Avoid showing errors during surprise removal
| * dabf502e usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command
| * 4a62f49f usb: xhci: Avoid showing warnings for dying controller
| * 6cd81d4f usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default
| * b2ba2ad0 selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t
| * 146262a4 cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag
| * f5611a58 platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list
| * 2d32f522 usb: xhci: print xhci->xhc_state when queue_command failed
| * 839312bf tracefs: Add d_delete to remove negative dentries
| * d7e28036 securityfs: don't pin dentries twice, once is enough...
| * 270ea0b6 fix locking in efi_secret_unlink()
| * 327276cb ext2: Handle fiemap on empty files to prevent EINVAL
| * 6c7fadac fs/ntfs3: correctly create symlink for relative path
| * 3572737a fs/ntfs3: Add sanity check for file name
| * 934065fd ata: libata-sata: Disallow changing LPM state if not supported
| * 847a204d better lockdep annotations for simple_recursive_removal()
| * cb7b5956 hfs: fix not erasing deleted b-tree node issue
| * 9f53b243 drbd: add missing kref_get in handle_write_conflicts
| * 5a1e1ab8 udf: Verify partition map count
| * ce8da5d1 loop: Avoid updating block size under exclusive owner
* | 07671fe1 Merge 3d2c05cb ("gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops") into android15-6.6-lts
|\|
| * 3d2c05cb gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops
* | 88746a16 Merge 524ce0f9 ("nvme-pci: try function level reset on init failure") into android15-6.6-lts
|\|
| * 524ce0f9 nvme-pci: try function level reset on init failure
* | 66c22c1b Merge 1e858a7a ("smb/server: avoid deadlock when linking with ReplaceIfExists") into android15-6.6-lts
|\|
| * 1e858a7a smb/server: avoid deadlock when linking with ReplaceIfExists
* | c052fdfb Merge 61ad2949 ("arm64: Handle KCOV __init vs inline mismatches") into android15-6.6-lts
|\|
| * 61ad2949 arm64: Handle KCOV __init vs inline mismatches
* | 89352fc4 Merge b3359392 ("hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()") into android15-6.6-lts
|\|
| * b3359392 hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
* | 0295caa9 Merge 291bb5d9 ("hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()") into android15-6.6-lts
|\|
| * 291bb5d9 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
* | 7c807790 Merge 8583d067 ("hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()") into android15-6.6-lts
|\|
| * 8583d067 hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
* | 4f590e9b Merge 384a66b8 ("hfs: fix slab-out-of-bounds in hfs_bnode_read()") into android15-6.6-lts
|\|
| * 384a66b8 hfs: fix slab-out-of-bounds in hfs_bnode_read()
* | fd391984 Merge 4f032979 ("hfs: fix general protection fault in hfs_find_init()") into android15-6.6-lts
|\|
| * 4f032979 hfs: fix general protection fault in hfs_find_init()
* | 6ed3b43e Merge f1fe9991 ("tls: handle data disappearing from under the TLS ULP") into android15-6.6-lts
|\|
| * f1fe9991 tls: handle data disappearing from under the TLS ULP
* | 255965bd Merge acfb4da4 ("ptp: prevent possible ABBA deadlock in ptp_clock_freerun()") into android15-6.6-lts
|\|
| * acfb4da4 ptp: prevent possible ABBA deadlock in ptp_clock_freerun()
* | 9f63e121 Merge 7337a635 ("cpuidle: governors: menu: Avoid using invalid recent intervals data") into android15-6.6-lts
|\|
| * 7337a635 cpuidle: governors: menu: Avoid using invalid recent intervals data
* | 9ea909a2 Merge c11f3802 ("intel_idle: Allow loading ACPI tables for any family") into android15-6.6-lts
|\|
| * c11f3802 intel_idle: Allow loading ACPI tables for any family
* | 6e1800dc Merge ea094f38 ("sctp: linearize cloned gso packets in sctp_rcv") into android15-6.6-lts
|\|
| * ea094f38 sctp: linearize cloned gso packets in sctp_rcv
* | 816246c2 Merge 7f94af48 ("net: ti: icss-iep: Fix incorrect type for return value in extts_enable()") into android15-6.6-lts
|\|
| * 7f94af48 net: ti: icss-iep: Fix incorrect type for return value in extts_enable()
* | bd9081f3 Merge 30cf8110 ("netfilter: ctnetlink: fix refcount leak on table dump") into android15-6.6-lts
|\|
| * 30cf8110 netfilter: ctnetlink: fix refcount leak on table dump
* | 09685dcf Revert "io_uring: don't use int for ABI"
* | a9ac2c11 Merge 19e01bc8 ("udp: also consider secpath when evaluating ipsec use for checksumming") into android15-6.6-lts
|\|
| * 19e01bc8 udp: also consider secpath when evaluating ipsec use for checksumming
| * e65ad9a1 KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
| * 91fa23d5 KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
| * 8867d91e KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
| * d1e28ef7 KVM: VMX: Extract checking of guest's DEBUGCTL into helper
| * 48ebed8b KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
| * ec70c3f2 KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
| * 0d87da9d KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap
| * d5aa9bb5 KVM: x86: Fully defer to vendor code to decide how to force immediate exit
| * 62f586df KVM: VMX: Handle KVM-induced preemption timer exits in fastpath for L2
| * ca3cc405 KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers
| * 1c1158ac KVM: VMX: Handle forced exit due to preemption timer in fastpath
| * 1fc288e7 KVM: VMX: Re-enter guest in fastpath for "spurious" preemption timer exits
| * baf9c96e KVM: x86: Plumb "force_immediate_exit" into kvm_entry() tracepoint
| * a1d4091f KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
| * 76025761 KVM: x86: Snapshot the host's DEBUGCTL in common x86
| * cf04778a KVM: nVMX: Defer SVI update to vmcs01 on EOI when L2 is active w/o VID
| * ebc281bf KVM: x86: Plumb in the vCPU to kvm_x86_ops.hwapic_isr_update()
| * abe3d6a5 KVM: SVM: Set RFLAGS.IF=1 in C code, to get VMRUN out of the STI shadow
| * d5784ea4 KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush
| * edc45003 smb: client: don't wait for info->send_pending == 0 on error
| * 429112e9 smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()
| * 19849010 ACPI: processor: perflib: Move problematic pr->performance check
| * cb2e6e27 ACPI: processor: perflib: Fix initial _PPC limit application
| * 8c09ad85 Documentation: ACPI: Fix parent device references
| * 2a0c0c97 eventpoll: Fix semi-unbounded recursion
| * 237e416e fs: Prevent file descriptor table allocations exceeding INT_MAX
| * a5ff67c6 sunvdc: Balance device refcount in vdc_port_mpgroup_check
| * 17c010fe LoongArch: BPF: Fix jump offset calculation in tailcall
| * d89d47ab PCI: Extend isolated function probing to LoongArch
| * 987c2042 NFS: Fix the setting of capabilities when automounting a new filesystem
| * f0b89916 NFSD: detect mismatch of file handle and delegation stateid in OPEN op
| * d71abd1a nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
| * 3b53dc1c io_uring/net: commit partial buffers on retry
| * ccef5ee4 net: usb: asix_devices: add phy_mask for ax88772 mdio bus
| * eb2d7933 net: dpaa: fix device leak when querying time stamp info
| * fd5c51a1 net: ti: icss-iep: fix device and OF node leaks at probe
| * 5daff127 net: mtk_eth_soc: fix device leak at probe
| * 9adaf9a0 net: enetc: fix device and OF node leak at probe
| * dc395c83 net: gianfar: fix device leak when querying time stamp info
| * 8dae82f8 net: phy: micrel: fix KSZ8081/KSZ8091 cable test
| * 346c820e netlink: avoid infinite retry looping in netlink_unicast()
| * c66caf21 Revert "leds: trigger: netdev: Configure LED blink interval for HW offload"
| * 16a46f2e gpio: mlxbf3: use platform_get_irq_optional()
| * c1aa0743 Revert "gpio: mlxbf3: only get IRQ for device instance 0"
| * a1574785 gpio: mlxbf2: use platform_get_irq_optional()
| * 50ae9f2d gpio: virtio: Fix config space reading.
| * 217e1801 smb: client: remove redundant lstrp update in negotiate protocol
| * a0620e15 smb3: fix for slab out of bounds on mount to ksmbd
| * d63e929b ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
| * fb5000cf ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
| * 1034719f ALSA: usb-audio: Validate UAC3 cluster segment descriptors
| * 07c8d78d ALSA: usb-audio: Validate UAC3 power domain descriptors, too
| * 17a66aef io_uring: don't use int for ABI
* | e941e660 Merge android15-6.6 into android15-6.6-lts
* | 88363fee Revert "sched/psi: Optimize psi_group_change() cpu_clock() usage"
* | e8583e9f Revert "sched/psi: Fix psi_seq initialization"
* | 12700301 Revert "audit,module: restore audit logging in load failure case"
* | 5cee9a54 Revert "pps: fix poll support"
* | 52ee8d87 Merge 6.6.102 into android15-6.6-lts
|\|
| * bb9c90ab Linux 6.6.102
| * aada327a usb: gadget : fix use-after-free in composite_dev_cleanup()
| * e1ee74b9 mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery
| * d98b34c4 MIPS: mm: tlb-r4k: Uniquify TLB entries on init
| * ab85071a x86/fpu: Delay instruction pointer fixup until after warning
| * 575b7162 ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx()
| * 48a8a2df ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe()
| * 1fb87397 x86/sev: Evict cache lines during SNP memory validation
| * fdf6959b net: usbnet: Fix the wrong netif_carrier_on() call
| * 3c623658 net: usbnet: Avoid potential RCU stall on LINK_CHANGE event
| * 2b98a153 Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano
| * ae591cf2 sched,freezer: Remove unnecessary warning in __thaw_task
| * 036bdae8 freezer,sched: Clean saved_state when restoring it during thaw
| * 2e629851 freezer,sched: Do not restore saved_state of a thawed task
| * e241ca2f freezer,sched: Use saved_state to reduce some spurious wakeups
| * 8afa818c sched/core: Remove ifdeffery for saved_state
| * 2c9a096e i2c: stm32f7: unmap DMA mapped buffer
| * bab0986d i2c: stm32f7: simplify status messages in case of errors
| * d786b659 i2c: stm32f7: perform most of irq job in threaded handler
| * 9bfaaa96 i2c: stm32f7: use dev_err_probe upon calls of devm_request_irq
| * de7c7cae i2c: stm32f7: Use devm_clk_get_enabled()
| * 66bf2435 USB: serial: option: add Foxconn T99W709
| * 2f4d88f5 smb: server: Fix extension string in ksmbd_extract_shortname()
| * fa1c47af ksmbd: limit repeated connections from clients with the same IP
| * 62d136d3 ksmbd: fix corrupted mtime and ctime in smb2_open
| * b69fd870 ksmbd: fix Preauh_HashValue race condition
| * d79c8beb ksmbd: fix null pointer dereference error in generate_encryptionkey
| * 44bd006d vsock: Do not allow binding to VMADDR_PORT_ANY
| * 88caf46d net/packet: fix a race in packet_set_ring() and packet_notifier()
| * 29d417b1 selftests/perf_events: Add a mmap() correctness test
| * 6757a31a perf/core: Prevent VMA split of buffer mappings
| * f41e9eba perf/core: Exit early on perf_mmap() fail
| * f07ab7a4 perf/core: Don't leak AUX buffer refcount on allocation failure
| * b1df3946 sunrpc: fix handling of server side tls alerts
| * d2622f38 smb: client: return an error if rdma_connect does not return within 5 seconds
| * bd7f84df pptp: fix pptp_xmit() error path
| * 4e5cf39e smb: client: let recv_done() cleanup before notifying the callers.
| * 83d2a418 smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
| * f069f7c1 smb: client: make use of common smbdirect_socket
| * 947569b9 smb: smbdirect: add smbdirect_socket.h
| * 61f0a684 smb: client: Correct typos in multiple comments across various files
| * 91d7e6cb smb: client: Use min() macro
| * c29dbc44 smb: server: let recv_done() avoid touching data_transfer after cleanup/move
| * 66110b35 smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection
| * e67aff50 smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already
| * 28db0cb8 smb: server: remove separate empty_recvmsg_queue
| * 2e4463f4 ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out()
| * cd2a7f95 irqchip: Build IMX_MU_MSI only on ARM
| * 39491e85 net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing
| * c377ba2b benet: fix BUG when creating VFs
| * a55b3d15 sunrpc: fix client side handling of tls alerts
| * a7176675 net/sched: taprio: enforce minimum value for picos_per_byte
| * 0d459540 net: drop UFO packets in udp_rcv_segment()
| * ef05007b ipv6: reject malicious packets in ipv6_gso_segment()
| * 194cd28c net/mlx5: Correctly set gso_segs when LRO is used
| * 97ed92a2 netlink: specs: ethtool: fix module EEPROM input/output arguments
| * 5005d243 pptp: ensure minimal skb length in pptp_xmit()
| * 5fde6e01 net: ipa: add IPA v5.1 and v5.5 to ipa_version_string()
| * b80353a7 phy: mscc: Fix parsing of unicast frames
| * b0cf318f netpoll: prevent hanging NAPI when netcons gets enabled
| * 227154eb md/md-cluster: handle REMOVE message earlier
| * 75ed1f6e NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY
| * 1116e661 NFSv4.2: another fix for listxattr
| * 12ad3def NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()
| * 30a73993 NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate()
| * 14721603 sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up()
| * 3bdb29df pNFS/flexfiles: don't attempt pnfs on fatal DS errors
| * 6e7b24c7 PCI: pnv_php: Fix surprise plug detection and recovery
| * a426e8a6 powerpc/eeh: Make EEH driver device hotplug safe
| * 3f49abdf powerpc/eeh: Export eeh_unfreeze_pe()
| * 17dabd7e PCI: pnv_php: Work around switches with broken presence detection
| * 32173edf PCI: pnv_php: Clean up allocated IRQs on unplug
| * 9184a2bb sched/psi: Fix psi_seq initialization
| * 9ea1cc8b kconfig: qconf: fix ConfigList::updateListAllforAll()
| * 05b450da scsi: sd: Make sd shutdown issue START STOP UNIT appropriately
| * 450b2a5c scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume
| * 4933567e scsi: Revert "scsi: iscsi: Fix HW conn removal use after free"
| * 087a8a7c scsi: mpt3sas: Fix a fw_event memory leak
| * 349436bf vfio/pci: Separate SR-IOV VF dev_set
| * 7dbfae90 vfio/pds: Fix missing detach_ioas op
| * 9546b26d vfio: Prevent open_count decrement to negative
| * a6c5e258 vfio: Fix unbalanced vfio_df_close call in no-iommu mode
| * f289690f f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode
| * 70461368 f2fs: fix to calculate dirty data during has_not_enough_free_secs()
| * e33c22f2 f2fs: fix to update upper_p in __get_secs_required() correctly
| * 1023836d f2fs: vm_unmap_ram() may be called from an invalid context
| * 345fc8d1 f2fs: fix to avoid out-of-boundary access in devs.path
| * 880ef748 f2fs: fix to avoid panic in f2fs_evict_inode
| * 3d37cada f2fs: fix to avoid UAF in f2fs_sync_inode_meta()
| * a96f2bf4 f2fs: doc: fix wrong quota mount option description
| * dabfa395 f2fs: fix KMSAN uninit-value in extent_info usage
| * c1c818b6 rtc: rv3028: fix incorrect maximum clock rate handling
| * f5790cc2 rtc: pcf8563: fix incorrect maximum clock rate handling
| * e337c72b rtc: pcf85063: fix incorrect maximum clock rate handling
| * 8456b3e2 rtc: nct3018y: fix incorrect maximum clock rate handling
| * 17827903 rtc: hym8563: fix incorrect maximum clock rate handling
| * bb94a963 rtc: ds1307: fix incorrect maximum clock rate handling
| * 15da2369 ucount: fix atomic_long_inc_below() argument type
| * f9bd6925 module: Restore the moduleparam prefix length check
| * 7500ba65 apparmor: fix loop detection used in conflicting attachment resolution
| * fad01f7e apparmor: ensure WB_HISTORY_SIZE value is a power of 2
| * 4795bcaf bpf: Check netfilter ctx accesses are aligned
| * f56f6054 bpf: Check flow_dissector ctx accesses are aligned
| * d3bf3088 vhost-scsi: Fix log flooding with target does not exist errors
| * ebc6e1d0 mtd: rawnand: atmel: set pmecc data setup time
| * a01bc424 mtd: rawnand: rockchip: Add missing check after DMA map
| * 7d0b53a6 mtd: rawnand: atmel: Fix dma_mapping_error() address
| * 505f4111 jfs: fix metapage reference count leak in dbAllocCtl
| * 4b5d36cc fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref
| * 0aa273db crypto: qat - fix seq_file position update in adf_ring_next()
| * 1c178ccb crypto: qat - fix DMA direction for compression on GEN2 devices
| * 9ff4de5b perf tools: Remove libtraceevent in .gitignore
| * 106891c7 sh: Do not use hyphen in exported variable name
| * f658f367 ASoC: fsl_xcvr: get channel status data when PHY is not exists
| * 3187ffe0 dmaengine: nbpfaxi: Add missing check after DMA map
| * 06ddbb28 dmaengine: mv_xor: Fix missing check after DMA map and missing unmap
| * 25d15b0d fs/orangefs: Allow 2 more characters in do_c_string()
| * b93d0649 PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute
| * bdbaa104 soundwire: stream: restore params when prepare ports fail
| * ac961f6c crypto: img-hash - Fix dma_unmap_sg() nents value
| * 06bc14f9 crypto: keembay - Fix dma_unmap_sg() nents value
| * 5d481d4b hwrng: mtk - handle devm_pm_runtime_enable errors
| * 9c590ae7 watchdog: ziirave_wdt: check record length in ziirave_firm_verify()
| * a23fa17e scsi: isci: Fix dma_unmap_sg() nents value
| * 401fcb7e scsi: mvsas: Fix dma_unmap_sg() nents value
| * cf9c5b15 scsi: elx: efct: Fix dma_unmap_sg() nents value
| * 214f94ee scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value
| * 5b63d6de clk: sunxi-ng: v3s: Fix de clock definition
| * c07e017a perf tests bp_account: Fix leaked file descriptor
| * 9b2a3e71 pinmux: fix race causing mux_owner NULL with active mux_usecount
| * 33c778ea proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al
| * adf2da0b kernel: trace: preemptirq_delay_test: use offstack cpu mask
| * 5449e60e RDMA/hns: Fix -Wframe-larger-than issue
| * db111468 crypto: ccp - Fix crash when rebind ccp device for ccp.ko
| * a762bbe1 crypto: inside-secure - Fix `dma_unmap_sg()` nents value
| * b86fd2e6 perf sched: Fix memory leaks in 'perf sched latency'
| * 282d4b34 perf sched: Fix memory leaks for evsel->priv in timehist
| * 16ce5ce1 perf sched: Free thread->priv using priv_destructor
| * e5de9ea7 perf dso: Add missed dso__put to dso__load_kcore
| * 9fe9f945 perf tools: Fix use-after-free in help_unknown_cmd()
| * a99cae46 Fix dma_unmap_sg() nents value
| * 8724a228 clk: clk-axi-clkgen: fix fpfd_max frequency for zynq
| * 45338af0 fanotify: sanitize handle_type values when reporting fid
| * e8b4c9e6 pinctrl: sunxi: Fix memory leak on krealloc failure
| * 85a7746a PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails
| * 3f5186fd crypto: arm/aes-neonbs - work around gcc-15 warning
| * f693be15 power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
| * 8e9bdb56 power: supply: cpcap-charger: Fix null check for power_supply_get_by_name
| * 51990eec clk: xilinx: vcu: unregister pll_post only if registered correctly
| * a2b437a8 media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check
| * 1d92608a clk: davinci: Add NULL check in davinci_lpsc_clk_register()
| * 530d4db6 mtd: fix possible integer overflow in erase_xfer()
| * aff3e6ea crypto: marvell/cesa - Fix engine load inaccuracy
| * be1e1593 crypto: qat - use unmanaged allocation for dc_data
| * 25c161a8 crypto: sun8i-ce - fix nents passed to dma_unmap_sg()
| * 0c93cd98 PCI: rockchip-host: Fix "Unexpected Completion" log message
| * e1c3d14c bpf/preload: Don't select USERMODE_DRIVER
| * 3bb72c2e ipv6: annotate data-races around rt->fib6_nsiblings
| * 9cb6de8e ipv6: fix possible infinite loop in fib6_info_uses_dev()
| * e1b7932a ipv6: prevent infinite loop in rt6_nlmsg_size()
| * f2376641 vrf: Drop existing dst reference in vrf_ip6_input_dst
| * dddfc5a9 selftests: rtnetlink.sh: remove esp4_offload after test
| * 314f568b net/mlx5e: Remove skb secpath if xfrm state is not found
| * 4d81205d net/mlx5e: Clear Read-Only port buffer size in PBMC before update
| * 58004aa2 netfilter: xt_nfacct: don't assume acct name is null-terminated
| * 9705b8b9 can: kvaser_usb: Assign netdev.dev_port based on device channel index
| * 56a17d28 can: kvaser_pciefd: Store device channel index
| * 2ac7efc5 can: peak_usb: fix USB FD devices potential malfunction
| * c9be5abd tools/rv: Do not skip idle in trace
| * ee250248 bpf: Disable migration in nf_hook_run_bpf().
| * 9d5aecb5 Bluetooth: hci_event: Mask data status from LE ext adv reports
| * cdb509f5 kcsan: test: Initialize dummy variable
| * bf88b7c1 wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon()
| * 50e98be4 wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE
| * 21e31748 wifi: ath12k: fix endianness handling while accessing wmi service bit
| * dde15204 Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
| * 9c8e9da1 wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key()
| * f74d4525 wifi: mac80211: Don't call fq_flow_idx() for management frames
| * bc6f3596 wifi: mac80211: Do not schedule stopped TXQs
| * 28747170 wifi: plfxlc: Fix error handling in usb driver probe
| * 378ae9cc wifi: mac80211: reject TDLS operations when station is not associated
| * df51cc1e iommu/amd: Fix geometry.aperture_end for V2 tables
| * 03df7348 mwl8k: Add missing check after DMA map
| * 5cb4349d wifi: rtl8xxxu: Fix RX skb size for aggregation disabled
| * 20a1e653 tcp: call tcp_measure_rcv_mss() for ooo packets
| * 9a20c9da xen/gntdev: remove struct gntdev_copy_batch from stack
| * c9eeae96 net_sched: act_ctinfo: use atomic64_t for three counters
| * 103c4e27 net/sched: Restrict conditions for adding duplicating netems to qdisc tree
| * 0967ee88 um: rtc: Avoid shadowing err in uml_rtc_start()
| * 98f1a97d arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX
| * 9ac58afb netfilter: nf_tables: adjust lockdep assertions handling
| * b488bee5 netfilter: nf_tables: Drop dead code from fill_*_info routines
| * f56a8633 fbcon: Fix outdated registered_fb reference in comment
| * b1c6b13f sched/psi: Optimize psi_group_change() cpu_clock() usage
| * dabe5fc2 drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value
| * 6e2f7903 m68k: Don't unregister boot console needlessly
| * 7f0377ca drm/msm/dpu: Fill in min_prefill_lines for SC8180X
| * 6d029d85 kselftest/arm64: Fix check for setting new VLs in sve-ptrace
| * f73c0bc2 net: dst: annotate data-races around dst->output
| * e0b8b668 net: dst: annotate data-races around dst->input
| * 62d7cf45 net/mlx5: Check device memory pointer before usage
| * c45a3390 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range
| * 5bf201c5 wifi: ath11k: clear initialized flag for deinit-ed srng lists
| * ca980f19 iwlwifi: Add missing check for alloc_ordered_workqueue
| * d5491ff7 wifi: iwlwifi: Fix memory leak in iwl_mvm_init()
| * 14ca6952 wifi: rtl818x: Kill URBs before clearing tx status queue
| * 892b29ea wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band
| * 655e3f51 caif: reduce stack size, again
| * 0abd1f48 bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure
| * 0f18414f drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel
| * cc7af1b8 net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain
| * 3ca8e73c selftests/bpf: fix signedness bug in redir_partial()
| * 0e853c14 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
| * c69d0649 bpf, sockmap: Fix psock incorrectly pointing to sk
| * c4a298ae drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed
| * 8b0285fb selftests/tracing: Fix false failure of subsystem event test
| * faa45887 staging: nvec: Fix incorrect null termination of battery manufacturer
| * cc03984d interconnect: qcom: sc8180x: specify num_nodes
| * 37dfd6d6 interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg
| * 2fffa722 soc: qcom: pmic_glink: fix OF node leak
| * 272cd1f2 samples: mei: Fix building on musl libc
| * f7e5ae0d cpufreq: Init policy->rwsem before it may be possibly used
| * 39a0d418 cpufreq: Initialize cpufreq-based frequency-invariance later
| * 1bc35f9a cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode
| * 81f50619 PM / devfreq: Check governor before using governor->name
| * 759b918c arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed
| * 1661ee5c arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed
| * d7b49f4f ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface
| * 4f886798 soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS
| * 632c1513 arm: dts: ti: omap: Fixup pinheader typo
| * 40ff7460 usb: early: xhci-dbc: Fix early_ioremap leak
| * c6ec2709 powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()
| * 91a177aa Revert "vmci: Prevent the dispatching of uninitialized payloads"
| * 7ed42b79 pps: fix poll support
| * 6696a46f vmci: Prevent the dispatching of uninitialized payloads
| * b31cf6f7 staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()
| * 6031a54f spi: stm32: Check for cfg availability in stm32_spi_probe
| * 49087720 usb: misc: apple-mfi-fastcharge: Make power supply names unique
| * f24e5b44 usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe()
| * 44880090 ARM: dts: vfxxx: Correctly use two tuples for timer address
| * 964db872 arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely
| * e1b4ca59 arm64: dts: qcom: sc7180: Expand IMEM region
| * 2f4bad6b arm64: dts: qcom: sdm845: Expand IMEM region
| * 603df700 soc: qcom: QMI encoding/decoding for big endian
| * 41917d9c selftests: Fix errno checking in syscall_user_dispatch test
| * aa771d29 ASoC: mediatek: use reserved memory or enable buffer pre-allocation
| * 4c39fc79 ASoC: ops: dynamically allocate struct snd_ctl_elem_value
| * ee1c30d7 ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask()
| * 1a91ba12 gfs2: No more self recovery
| * a936be9b Revert "fs/ntfs3: Replace inode_trylock with inode_lock"
| * 08493396 hfsplus: remove mutex_lock check in hfsplus_free_extents
| * 0926e13a hfs: make splice write available again
| * 1de5895f hfsplus: make splice write available again
| * d89f71ae ublk: use vmalloc for ublk_device's __queues
| * b35a50d6 fs/ntfs3: cancle set bad inode after removing name fails
| * 8d1bfdd3 fs_context: fix parameter name in infofc() macro
| * 15da7321 audit,module: restore audit logging in load failure case
| * 5974c913 ASoC: amd: yc: add DMI quirk for ASUS M6501RM
| * 61e5aeff ASoC: Intel: fix SND_SOC_SOF dependencies
| * 7e98b006 ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
| * 18196a40 ethernet: intel: fix building with large NR_CPUS
| * 5f577d47 ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
* | cfe84353 Merge 6.6.101 into android-6.6-lts
|\|
| * 3a8ababb Linux 6.6.101
| * 41d3c751 Revert "selftests/bpf: Add a cgroup prog bpf_get_ns_current_pid_tgid() test"
| * 1af6d169 spi: cadence-quadspi: fix cleanup of rx_chan on failure paths
| * aed4053c drm/sched: Remove optimization that causes hang when killing dependent jobs
| * 79c8d935 ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS
| * 3277cf43 mptcp: reset fallback status gracefully at disconnect() time
| * 7c96d519 mptcp: plug races between subflow fail and subflow creation
| * 75a4c9ab mptcp: make fallback action and fallback decision atomic
| * 23a5773a arm64/cpufeatures/kvm: Add ARMv8.9 FEAT_ECBHB bits in ID_AA64MMFR1 register
| * 52f5a52d ksmbd: add free_transport ops in ksmbd connection
| * 034adb78 wifi: mt76: mt7921: prevent decap offload config before STA initialization
| * 79e2dd57 perf/x86/intel: Fix crash in icl_update_topdown_event()
| * 9ef6abbb mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
| * 1da8bd9a ksmbd: fix use-after-free in __smb2_lease_break_noti()
| * 5ea224ea iio: hid-sensor-prox: Restore lost scale assignments
| * a56b79a4 iio: hid-sensor-prox: Fix incorrect OFFSET calculation
| * 796c96cf crypto: qat - add shutdown handler to qat_dh895xcc
| * 4b5e0770 crypto: powerpc/poly1305 - add depends on BROKEN for now
| * da3e9f0f erofs: address D-cache aliasing
| * 1d117f79 mm: khugepaged: fix call hpage_collapse_scan_file() for anonymous vma
| * 37c7f0f2 drm/i915/dp: Fix 2.7 Gbps DP_LINK_BW value on g4x
| * c383033b ALSA: hda: Add missing NVIDIA HDA codec IDs
| * 0a776c27 ALSA: hda/tegra: Add Tegra264 support
| * 4e954080 comedi: comedi_test: Fix possible deletion of uninitialized timers
| * 45fd8421 jfs: reject on-disk inodes of an unsupported type
| * 98be604d x86/bugs: Fix use of possibly uninit value in amd_check_tsa_microcode()
| * f9377bdf usb: typec: tcpm: apply vbus before data bringup in tcpm_src_attach
| * 457d02e7 usb: typec: tcpm: allow switching to mode accessory to mux properly
| * 8f65f456 usb: typec: tcpm: allow to use sink in accessory mode
| * 145a56bd drm/amdkfd: Don't call mmput from MMU notifier callback
| * cc690930 mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n
| * 32532592 selftests: mptcp: connect: also cover checksum
| * 5cdfb402 selftests: mptcp: connect: also cover alt modes
| * a2cd4dcb resource: fix false warning in __request_region()
| * bf585ee1 nilfs2: reject invalid file types when reading inodes
| * 57104237 kasan: use vmalloc_dump_obj() for vmalloc error reports
| * 3028f2a4 ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
| * eaf242ea gve: Fix stuck TX queue for DQ queue format
| * c2291924 e1000e: ignore uninitialized checksum word on tgp
| * 1624f9de e1000e: disregard NVM checksum on tgp when valid checksum bit is not set
| * 04d098fb dpaa2-switch: Fix device reference count leak in MAC endpoint handling
| * 1c135ff9 dpaa2-eth: Fix device reference count leak in MAC endpoint handling
| * 9433a5f4 arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
| * 140ca2ca ALSA: hda/realtek - Add mute LED support for HP Pavilion 15-eg0xxx
| * e5354899 sprintf.h requires stdarg.h
| * 72584a91 bus: fsl-mc: Fix potential double device reference in fsl_mc_get_endpoint()
| * 6e7836c8 i2c: virtio: Avoid hang by using interruptible completion wait
| * 68ceeb06 i2c: tegra: Fix reset error handling with ACPI
| * 0d33913f i2c: qup: jump out of the loop in case of timeout
| * 60962eed platform/x86: ideapad-laptop: Fix kbd backlight not remembered among boots
| * 989b2c53 net: hns3: default enable tx bounce buffer when smmu enabled
| * adbf6f47 net: hns3: fixed vf get max channels bug
| * f377792c net: hns3: disable interrupt when ptp init failed
| * 3cc42004 net: hns3: fix concurrent setting vlan filter issue
| * faf44487 s390/ism: fix concurrency management in ism_cmd()
| * 42e42d64 drm/bridge: ti-sn65dsi86: Remove extra semicolon in ti_sn_bridge_probe()
| * cf81a60a can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode
| * 359492c2 can: dev: can_restart(): move debug message and stats after successful restart
| * 71a2dc44 can: dev: can_restart(): reverse logic to remove need for goto
| * 0ede6ce4 net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class
| * e4f1564c net: appletalk: Fix use-after-free in AARP proxy probe
| * d989748e i40e: When removing VF MAC filters, only check PF-set MAC
| * 0c399fd6 i40e: report VF tx_dropped with tx_errors instead of tx_discards
| * a05b3883 i40e: Add rx_missed_errors for buffer exhaustion
| * e4ca597d net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch
| * c3d8a80d net/mlx5: Fix memory leak in cmd_exec()
| * bfebdb85 xfrm: interface: fix use-after-free after changing collect_md xfrm interface
| * 2e18442d staging: vchiq_arm: Make vchiq_shutdown never fail
| * 6758f73f platform/x86: Fix initialization order for firmware_attributes_class
| * d72c97b6 x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
| * 0915f185 regmap: fix potential memory leak of regmap_bus
| * 881f3066 iio: adc: ad7949: use spi_is_bpw_supported()
| * 6a85c96e interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node
| * fb93e41e RDMA/core: Rate limit GID cache warning messages
| * 233d3c54 regulator: core: fix NULL dereference on unbind due to stale coupling data
| * 0e8c6593 virtio_ring: Fix error reporting in virtqueue_resize
| * fa53beab Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT
* e6bb027f Merge android15-6.6 into android15-6.6-lts

Change-Id: I5b702a747c074d733064aa1cd14c80652bffda9d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>