Merge tag 'android14-6.1.155_r00' into android14-6.1

This merges the android14-6.1.155_r00 tag into the android14-6.1 branch,
catching it up with the latest LTS releases.

It contains the following commits:

*   6f6441d9aa57 Merge 6.1.155 into android14-6.1-lts
|\
| * 882efbdd9d34 Linux 6.1.155
| * a333c5c524c4 drm/i915/backlight: Return immediately when scale() finds invalid parameters
| * b2f31ae2cc24 minmax: simplify and clarify min_t()/max_t() implementation
| * ab55a0c6a58e minmax: add a few more MIN_T/MAX_T users
| * 7d4fa074a220 minmax: make generic MIN() and MAX() macros available everywhere
| * e6684ed39edc kmsan: fix out-of-bounds access to shadow memory
| * d3b0d3f8d11f i40e: add validation for ring_len param
| * 27481c165a9e i40e: increase max descriptors for XL710
| * 8b9c7719b098 i40e: fix idx validation in config queues msg
| * 6c3981fd59ef i40e: fix validation of VF state in get resources
| * bfe3a42b6167 drm/ast: Use msleep instead of mdelay for edid read
| * 7800f13d93ec minmax: avoid overly complicated constant expressions in VM code
| * fff222c36914 minmax: fix indentation of __cmp_once() and __clamp_once()
| * bc9ff2176fcd minmax: deduplicate __unconst_integer_typeof()
| * 079b92c3b2f4 minmax: Introduce {min,max}_array()
| * f9a6f9a85a74 minmax: add in_range() macro
| * 20fb6fc51863 mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
| * 192fe94c0216 mm: migrate_device: use more folio in migrate_device_finalize()
| * d7dbe5f69179 s390/cpum_cf: Fix uninitialized warning after backport of ce971233242b
| * af3d855d0757 fbcon: Fix OOB access in font allocation
| * a6eb9f423b3d fbcon: fix integer overflow in fbcon_do_set_font
| * c1dc0524ab2c mm/hugetlb: fix folio is still mapped when deleted
| * 7b8381f3c405 afs: Fix potential null pointer dereference in afs_put_server
| * 07b1f63b5f86 tracing: dynevent: Add a missing lockdown check on dynevent
| * 54506c633569 crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
| * df42f84dc2a0 i40e: improve VF MAC filters accounting
| * cf524fdefa5d i40e: add mask to apply valid bits for itr_idx
| * 02aae5fcdd34 i40e: add max boundary check for VF filters
| * 461e0917eedc i40e: fix input validation logic for action_meta
| * 4d5e804a9e19 i40e: fix idx validation in i40e_validate_queue_map
| * cb5d19a61274 futex: Prevent use-after-free during requeue-PI
| * 02e4ff4941ef drm/gma500: Fix null dereference in hdmi teardown
| * 5723120423a7 octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
| * e6b0a62b3bb5 net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
| * 53ba22842681 net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
| * 4863e2ecfa87 net: dsa: lantiq_gswip: do also enable or disable cpu port
| * 205ff8e48eef selftests: fib_nexthops: Fix creation of non-FDB nexthops
| * ec428fff792b nexthop: Forbid FDB status change while nexthop is in a group
| * 6d422469a5e6 bnxt_en: correct offset handling for IPv6 destination address
| * 6243bda271a6 Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
| * fba6815ad178 Bluetooth: hci_sync: Fix hci_resume_advertising_sync
| * b254550ffc4a ethernet: rvu-af: Remove slash from the driver name
| * 176c81cbf9c4 can: peak_usb: fix shift-out-of-bounds issue
| * ca4e51359608 can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
| * a61ff7ac9327 can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
| * 57d332ce8c92 can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
| * c4e582e686c4 can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
| * 18c64b2a6da2 can: etas_es58x: sort the includes by alphabetic order
| * dd8b31eadb10 bpf: Reject bpf_timer for PREEMPT_RT
| * 9507cbebc186 can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
| * 72ded830e1dd smb: server: don't use delayed_work for post_recv_credits_work
| * 75d9fb6acd97 cpufreq: Initialize cpufreq-based invariance before subsys
| * 38c4a28ad1a6 arm64: dts: imx8mp: Correct thermal sensor index
| * 85fc33541cc5 mm: folio_may_be_lru_cached() unless folio_test_large()
| * 9557ba5fd368 mm/gup: local lru_add_drain() to avoid lru_add_drain_all()
| * 54c774c60893 mm/gup: check ref_count instead of lru before migration
| * 437b423715ef mm: add folio_expected_ref_count() for reference count calculation
| * c22fcd236c36 mm/gup: revert "mm: gup: fix infinite loop within __get_longterm_locked"
| * 8634e8eb1278 IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
| * 2879ca582358 ALSA: usb-audio: Add mute TLV for playback volumes on more devices
| * 0dbaae134d03 ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
| * d926dd23d18b ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
| * 5f7a5d62ec71 usb: core: Add 0x prefix to quirks debug output
| * 5b422452a29b ALSA: usb-audio: Fix build with CONFIG_INPUT=n
| * 9e4be9a6a084 ALSA: usb-audio: Convert comma to semicolon
| * c2d5b0a6c688 ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
| * 6aeadc24db68 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
| * 279c82964c08 ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
| * 7bdc56f5ca33 ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
| * 27bc2785912d ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
| * 377780195aff ALSA: usb-audio: Fix block comments in mixer_quirks
* | 2b0f2da2e0e4 Merge 6.1.154 into android14-6.1-lts
|\|
| * 7b34dc04e4ff Linux 6.1.154
| * 1f323a48e9b5 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
| * 2b8bbc64b5c2 crypto: af_alg: Convert af_alg_sendpage() to use MSG_SPLICE_PAGES
| * 01d1ba106c9e ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
| * f6e1138d76cc ASoC: q6apm-lpass-dai: close graph on prepare errors
| * 09ff1b1fadcd ASoC: qcom: q6apm-lpass-dai: close graphs before opening a new one
| * 47ade5f9d70b net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
| * 9ccec4f5c25e net: rfkill: gpio: add DT support
| * ff160500c499 selftests: mptcp: connect: catch IO errors on listen side
| * f18be2722424 mptcp: propagate shutdown to subflows when possible
| * 413c1b362d43 xhci: dbc: Fix full DbC transfer ring after several reconnects
| * 1bf3b02434ba xhci: dbc: decouple endpoint allocation from initialization
| * d6ef1c665ec5 phy: ti: omap-usb2: fix device leak at unbind
| * aea48dce64c4 phy: Use device_get_match_data()
| * e07821a2d14f phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning
| * 8564416e8154 selftests: mptcp: userspace pm: validate deny-join-id0 flag
| * f84281bb113b mptcp: pm: nl: announce deny-join-id0 flag
| * 3d7c075c878a smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
| * 6241b9e2809b crypto: af_alg - Set merge to zero early in af_alg_sendmsg
| * 56566873dadf crypto: af_alg: Indent the loop in af_alg_sendmsg()
| * d85f098950f3 drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
| * f9a089d0a6d5 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
| * 509e5c234832 ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
| * 7aa83b9e8cc4 ASoC: wm8974: Correct PLL rate rounding
| * 7ed74f233b8e ASoC: wm8940: Correct typo in control name
| * 07471dfeefed io_uring: include dying ring in task_work "should cancel" state
| * 9d3489ba4a8a io_uring: backport io_should_terminate_tw()
| * ab064e01278f ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx
| * 9cbe783771fe selftests: mptcp: avoid spurious errors on TCP disconnect
| * 35ff290c3a8b rds: ib: Increment i_fastreg_wrs before bailing out
| * 340c45bfb3e4 KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
| * e650c91e40ca mmc: mvsdio: Fix dma_unmap_sg() nents value
| * 9da9d29dc9fd ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S
| * f7e4e954adb2 ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface
| * 8f8a08c82b63 btrfs: tree-checker: fix the incorrect inode ref size check
| * ba0e586d1108 iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page()
| * 2605cf87853c LoongArch: Check the return value when creating kobj
| * e481c2fd3462 LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled
| * 83ca7939cc32 power: supply: bq27xxx: restrict no-battery detection to bq27000
| * 208c60d86c75 power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
| * 4c9b50788038 nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
| * 196a3a7676d7 ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
| * bdaab5c6538e ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
| * 2786879aebf3 octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
| * e1fcd4a9c09f cnic: Fix use-after-free bugs in cnic_delete_task
| * 1d484058272b net: liquidio: fix overflow in octeon_init_instr_queue()
| * e71dae112fee Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
| * b36462146d86 tls: make sure to abort the stream if headers are bogus
| * 17d699727577 tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
| * 71b57bfd04b2 bonding: don't set oif to bond dev when getting NS target destination
| * 931a7da7a256 i40e: remove redundant memory barrier when cleaning Tx descs
| * 8f3c4d010f0a net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
| * f87aa706aaa4 mptcp: set remote_deny_join_id0 on SYN recv
| * 814191086959 qed: Don't collect too many protection override GRC elements
| * f08d205e0991 dpaa2-switch: fix buffer pool seeding for control traffic
| * aaf900a83508 um: virtio_uml: Fix use-after-free after put_device in probe
| * dea5b4687010 btrfs: fix invalid extref key setup when replaying dentry
| * 993049c9b135 cgroup: split cgroup_destroy_wq into 3 workqueues
| * ea6838b52219 pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
| * 1f97f6cf81f7 wifi: mac80211: fix incorrect type for ret
| * 16c9244a6211 wifi: mac80211: increase scan_ies_len for S1G
| * 7d2897fa4827 ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
* | 080c8fab09d9 Merge 6.1.153 into android14-6.1-lts
|\|
| * 363a599da6d9 Linux 6.1.153
| * 2eaf0c0fb79b net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
| * fa725a427d07 soc: qcom: mdt_loader: Deal with zero e_shentsize
| * 9ef594d1eb92 soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
| * 23c00148fb6a drm/i915/power: fix size for for_each_set_bit() in abox iteration
| * 9c2e5bb8c1b2 drm/amdgpu: fix a memory leak in fence cleanup when unloading
| * 98244fc86ffc phy: ti-pipe3: fix device leak at unbind
| * e8e20021adae phy: tegra: xusb: fix device and OF node leak at probe
| * d9c8ad935d1f dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate
| * 555bd16351a3 dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
| * dfe634be3c8a USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
* | d3beb52b2a89 Revert "hrtimer: Remove unused function"
* | 4b6b0ee40313 Merge 4a19dac7ac77 ("hrtimers: Unconditionally update target CPU base after offline timer migration") into android14-6.1-lts
|\|
| * 4a19dac7ac77 hrtimers: Unconditionally update target CPU base after offline timer migration
| * 5acc7d843b34 hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
| * f76b38f60fe2 hrtimer: Remove unused function
* | a964fab05a38 Merge 34cac2d2983d ("regulator: sy7636a: fix lifecycle of power good gpio") into android14-6.1-lts
|\|
| * 34cac2d2983d regulator: sy7636a: fix lifecycle of power good gpio
| * 5e462fa0dfdb dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
| * 25e6146c2812 dmaengine: idxd: Fix double free in idxd_setup_wqs()
| * 1d9a62885688 hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
| * c9ac729ecfd5 hsr: use rtnl lock when iterating over ports
| * a2accc07bdcf net: hsr: Add VLAN CTAG filter support
| * 6c8b7d47bc18 net: hsr: Add support for MC filtering at the slave device
| * 33b3d3d11726 net: hsr: Disable promiscuous mode in offload mode
| * 1139321161a3 can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
| * 8a81aab8ce5c can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
| * 2d8836fab007 can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
| * b905b2acb3a0 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
| * b36bebb608bf igb: fix link test skipping when interface is admin down
| * 5530acecc532 docs: networking: can: change bcm_msg_head frames member to support flexible array
| * ab828b789dc0 tunnels: reset the GSO metadata before reusing the skb
| * 5f1bb554a131 net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
| * fa879c624ac8 USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
| * d1cf2a21cf68 USB: serial: option: add Telit Cinterion FN990A w/audio compositions
| * e8338f4ee44d dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
| * 9d4fa962fd19 serial: sc16is7xx: fix bug in flow control levels init
| * 535ba4549c76 tty: hvc_console: Call hvc_kick in hvc_write unconditionally
| * 02468e9795eb Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"
| * bfb9520e3ed0 Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
| * 2c79549bac44 Input: iqs7222 - avoid enabling unused interrupts
| * e4ec6def5643 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
| * 34d9cafd469c kernfs: Fix UAF in polling when open file is released
| * f1385ec8ce7e mm/khugepaged: fix the address passed to notifier on testing young
| * 429ed0a9ee36 mm/khugepaged: convert hpage_collapse_scan_pmd() to use folios
| * 2bae1bf3d9fb mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
| * 03582bfbff80 mtd: nand: raw: atmel: Fix comment in timings preparation
| * 74e391f7da7d mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters()
| * 64dc351e5827 mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters()
| * 3858c44341ad mm/damon/sysfs: fix use-after-free in state_show()
| * 591ea9c30737 libceph: fix invalid accesses to ceph_connection_v1_info
| * c079916d889b fuse: prevent overflow in copy_file_range return value
| * d7300080c0c4 fuse: check if copy_file_range() returns larger than requested size
| * e9874dc405eb mtd: rawnand: stm32_fmc2: fix ECC overwrite
| * 75686c49574d mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
| * 20f892821cbc net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups
| * 36054554772f ocfs2: fix recursive semaphore deadlock in fiemap call
| * 6f3b2d803424 mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
| * 17b41ca55cea compiler-clang.h: define __SANITIZE_*__ macros only when undefined
| * f54893222e60 Revert "SUNRPC: Don't allow waiting for exiting tasks"
| * 41886580fe97 EDAC/altera: Delete an inappropriate dma_free_coherent() call
| * 0b8f64204ead KVM: SVM: Set synthesized TSA CPUID flags
| * 0389b0697a35 KVM: SVM: Return TSA_SQ_NO and TSA_L1_NO bits in __do_cpuid_func()
| * 8d1e0db16431 KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code
| * 7ce12a106328 proc: fix type confusion in pde_set_flags()
| * 9c2a6456bdf9 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
| * 7583a73c53f1 tracing: Silence warning when chunk allocation fails in trace_pid_write
| * 9391ecf60154 NFSv4/flexfiles: Fix layout merge mirror check.
| * df1bbf7800d9 ftrace/samples: Fix function size computation
| * 0a14bd681f40 tracing: Fix tracing_marker may trigger page fault during preempt_disable
| * 65ae0730b00a NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
| * 330934d2177a NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
| * fc4a817da143 NFSv4: Don't clear capabilities that won't be reset
| * e630fa0dfb13 flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
| * bfb059417fa3 tracing: Do not add length to print format in synthetic events
| * a52be849575e ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs
| * feda73ad44a5 net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
| * cc4a6c517942 media: i2c: imx214: Fix link frequency validation
| * f508fc3788f9 media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
| * 69dd5bbdd79c media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization
| * 80fc7c7efc4c mm: introduce and use {pgd,p4d}_populate_kernel()
| * cee8913e13e1 kunit: kasan_test: disable fortify string checker on kasan_strings() test
* | 91023479a190 Merge android14-6.1 into android14-6.1-lts
* | 8c8937bc8454 ANDROID: GKI: Disable KABI macros for !CONFIG_64BIT
* | e9420a00c6c3 Merge 6.1.152 into android14-6.1-lts
|/
* 3db754f56897 Linux 6.1.152
* 0d8ca2b94730 x86/vmscape: Add old Intel CPUs to affected list
* 24f90b752b73 x86/vmscape: Warn when STIBP is disabled with SMT
* 96ab7383348d x86/bugs: Move cpu_bugs_smt_update() down
* 893387c18612 x86/vmscape: Enable the mitigation
* 15006289e5c3 x86/vmscape: Add conditional IBPB mitigation
* 304d1fb275af x86/vmscape: Enumerate VMSCAPE bug
* 55ad07f8a227 Documentation/hw-vuln: Add VMSCAPE documentation

Change-Id: Ie7056cc366fb46be9ec1431c443a214fb105daa7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>