Merge tag 'android13-5.15.194_r00' into android13-5.15

This merges the android13-5.15.194_r00 tag into the android13-5.15 branch,
catching it up with the latest LTS releases.

It contains the following commits:

* bce84c40a40b ANDROID: GKI: fix crc issue with include/linux/can/dev.h
*   0049fcb905b5 Merge 5.15.194 into android13-5.15-lts
|\
| * 29e53a5b1c4f Linux 5.15.194
| * 1c532dd246bf drm/i915/backlight: Return immediately when scale() finds invalid parameters
| * 45a7527cd7da i40e: add validation for ring_len param
| * 8043ca4882e7 i40e: increase max descriptors for XL710
| * 1fa0aadade34 i40e: fix idx validation in config queues msg
| * 8e35c80f8570 i40e: fix validation of VF state in get resources
| * 3e851448078f mm/hugetlb: fix folio is still mapped when deleted
| * 4f52f7c50f5b mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
| * 523edfed4f68 af_unix: Don't leave consecutive consumed OOB skbs.
| * ecbfd9ef5cf3 fbcon: Fix OOB access in font allocation
| * b8a6e85328ae fbcon: fix integer overflow in fbcon_do_set_font
| * 0d41604d2d53 tracing: dynevent: Add a missing lockdown check on dynevent
| * 1b1c3bdb8ab3 i40e: add mask to apply valid bits for itr_idx
| * 77a35be582df i40e: add max boundary check for VF filters
| * f8c8e11825b2 i40e: fix input validation logic for action_meta
| * 34dfac0c9048 i40e: fix idx validation in i40e_validate_queue_map
| * d382d6daf018 crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
| * e4c1ec11132e crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
| * e15de80737d4 drm/gma500: Fix null dereference in hdmi teardown
| * 37821b843e4e net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
| * e8687ab9c8a1 net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
| * b9010dba5f36 net: dsa: lantiq_gswip: do also enable or disable cpu port
| * cf2d597fb6f0 selftests: fib_nexthops: Fix creation of non-FDB nexthops
| * 0e7bfe7a268c nexthop: Forbid FDB status change while nexthop is in a group
| * 5d4856a3717d bnxt_en: correct offset handling for IPv6 destination address
| * d646358255b6 ethernet: rvu-af: Remove slash from the driver name
| * 48822a59ecc4 can: peak_usb: fix shift-out-of-bounds issue
| * 6eec67bfb256 can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
| * 60463a1c1389 can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
| * 7ab85762274c can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
| * 72de0facc50a can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
| * 256b64f7a9ba can: etas_es58x: sort the includes by alphabetic order
| * f44124f407a3 can: etas_es58x: advertise timestamping capabilities and add ioctl support
| * 0a6e1bd2d250 can: dev: add generic function can_eth_ioctl_hwts()
| * b9a0e6f3b043 can: dev: add generic function can_ethtool_op_get_ts_info_hwts()
| * 533e3220bac2 can: bittiming: replace CAN units with the generic ones from linux/units.h
| * 33b83a90b65e can: bittiming: allow TDC{V,O} to be zero and add can_tdc_const::tdc{v,o,f}_min
| * d51c6b51981f bpf: Reject bpf_timer for PREEMPT_RT
| * 9ebf86218456 can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
| * b32c64db4370 cpufreq: Initialize cpufreq-based invariance before subsys
| * db28f975ed7f arm64: dts: imx8mp: Correct thermal sensor index
| * bb3eeb3a7c74 IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
| * 825c17c54cfb usb: core: Add 0x prefix to quirks debug output
| * 9ba349a33f50 ALSA: usb-audio: Fix build with CONFIG_INPUT=n
| * 1746e7a74ca0 ALSA: usb-audio: Convert comma to semicolon
| * b4b94f092f19 ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
| * 4f9294613bb3 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
| * 790b167e5857 ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
| * e4f6ae98ebd9 ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
| * a4bb77c1bab9 ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
| * 2f56442a417d ALSA: usb-audio: Fix block comments in mixer_quirks
| * ada228225924 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
| * 98c2894580f4 net: rfkill: gpio: add DT support
| * 2f58e6d3e7a7 mptcp: propagate shutdown to subflows when possible
| * 773fddf976d2 ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
| * dde28a51b8c3 mptcp: set remote_deny_join_id0 on SYN recv
| * ca9e4e6a8737 phy: ti: omap-usb2: fix device leak at unbind
| * f5648527d2e8 phy: Use device_get_match_data()
| * 0df0f4bcc7a2 phy: broadcom: ns-usb3: fix Wvoid-pointer-to-enum-cast warning
| * 662b75f7d1bf USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
| * 94fac8987bea usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
| * dbf216ae5aea xhci: dbc: Fix full DbC transfer ring after several reconnects
| * 503ba5026801 xhci: dbc: decouple endpoint allocation from initialization
| * 84870a62c48f serial: sc16is7xx: fix bug in flow control levels init
| * dfca6fa9d174 drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path
| * 51a501e990a3 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
| * 79a06d96e73e ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
| * e07847f44a0e ASoC: wm8974: Correct PLL rate rounding
| * 0235a5787e87 ASoC: wm8940: Correct typo in control name
| * 2e94bc6451cb rds: ib: Increment i_fastreg_wrs before bailing out
| * 969789076332 KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
| * 8a2972663397 mmc: mvsdio: Fix dma_unmap_sg() nents value
| * 4f935a129708 btrfs: tree-checker: fix the incorrect inode ref size check
| * 29d9125d6c07 power: supply: bq27xxx: restrict no-battery detection to bq27000
| * fe0f602a75cc power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
| * 40fb833c64ca nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
| * 040505593026 cnic: Fix use-after-free bugs in cnic_delete_task
| * 428c1dd78ef6 net: liquidio: fix overflow in octeon_init_instr_queue()
| * 3cae94808b2f Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
| * 33a4fdf0b4a2 tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
| * 17cb9b4017be i40e: remove redundant memory barrier when cleaning Tx descs
| * 95235d29cd8b net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
| * e0e24571a7b2 qed: Don't collect too many protection override GRC elements
| * e4343d400761 dpaa2-switch: fix buffer pool seeding for control traffic
| * 5e94e44c9cb3 um: virtio_uml: Fix use-after-free after put_device in probe
| * f2795d1b9250 cgroup: split cgroup_destroy_wq into 3 workqueues
| * f2ede1f9070c pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
| * 0f9cf94656d0 wifi: mac80211: fix incorrect type for ret
| * d2587970f088 ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
| * 5f2f50aa44de net: hsr: hsr_slave: Fix the promiscuous mode in offload mode
| * 99f7048957f5 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
| * a8b0032687c7 drm/i915/power: fix size for for_each_set_bit() in abox iteration
| * f1b349706538 drm/amdgpu: fix a memory leak in fence cleanup when unloading
| * 91b2c8ee6821 soc: qcom: mdt_loader: Deal with zero e_shentsize
| * e3d490ff8d12 phy: ti-pipe3: fix device leak at unbind
| * 4de4344ed416 phy: tegra: xusb: fix device and OF node leak at probe
| * 6ac1599d0e78 dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
* | cf4cf8289f56 Merge 24a65b46cd66 ("hrtimers: Unconditionally update target CPU base after offline timer migration") into android13-5.15-lts
|\|
| * 24a65b46cd66 hrtimers: Unconditionally update target CPU base after offline timer migration
| * e90b685c5f2a hrtimer: Rename __hrtimer_hres_active() to hrtimer_hres_active()
| * 95b76ebeb0f1 hrtimer: Remove unused function
* | d21b5b1ed6be Revert "genirq: Provide new interfaces for affinity hints"
* | 096fb0dd3353 Revert "i40e: Use irq_update_affinity_hint()"
* | f3106c24f8b4 Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path"
* | ae04d87694a8 Merge 5d5385feef35 ("regulator: sy7636a: fix lifecycle of power good gpio") into android13-5.4-lts
|\|
| * 5d5385feef35 regulator: sy7636a: fix lifecycle of power good gpio
| * 301a96cc4dc0 dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
| * 810167fa6f34 hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr
| * cedfcd09a338 hsr: use rtnl lock when iterating over ports
| * 1100242709d5 net: hsr: Add VLAN CTAG filter support
| * 7e0ef989aa6d net: hsr: Add support for MC filtering at the slave device
| * d981b9680be2 net: hsr: Disable promiscuous mode in offload mode
| * e202ffd9e545 can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
| * 5cf37a6fcb61 can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
| * 3245eb9c25e9 can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
| * b9721a023df3 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
| * 7d9bd1c2bf4a i40e: Use irq_update_affinity_hint()
| * e7ddb59a63cb genirq: Provide new interfaces for affinity hints
| * 582f5ce29adc igb: fix link test skipping when interface is admin down
| * f39a12660ea8 tunnels: reset the GSO metadata before reusing the skb
| * 93a699d6e92c net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
| * e818c35296a4 USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
| * 93e440499020 USB: serial: option: add Telit Cinterion FN990A w/audio compositions
| * 28d20ff4e388 dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks
| * d91604c39b74 tty: hvc_console: Call hvc_kick in hvc_write unconditionally
| * 9cf2429fe6cb Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table
| * e32a2ea52b51 mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
| * 6e2859c6aa46 mtd: rawnand: stm32_fmc2: Fix dma_map_sg error check
| * e0bca4dd48fc mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
| * c3f1ea856e14 mtd: nand: raw: atmel: Fix comment in timings preparation
| * 123e31a54d51 mm/khugepaged: fix the address passed to notifier on testing young
| * ea12ab684f8a libceph: fix invalid accesses to ceph_connection_v1_info
| * 1e1bcbc54877 fuse: prevent overflow in copy_file_range return value
| * 5d41589fa069 fuse: check if copy_file_range() returns larger than requested size
| * b8af2e74e49d mtd: rawnand: stm32_fmc2: fix ECC overwrite
| * ef30404980e4 ocfs2: fix recursive semaphore deadlock in fiemap call
| * 23092f6723bc mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN
| * 5d7267abcd65 compiler-clang.h: define __SANITIZE_*__ macros only when undefined
| * 8178ccf5671e EDAC/altera: Delete an inappropriate dma_free_coherent() call
| * 34b87ac4bb90 KVM: SVM: Set synthesized TSA CPUID flags
| * 54270c1b29f2 KVM: SVM: Return TSA_SQ_NO and TSA_L1_NO bits in __do_cpuid_func()
| * 2fab1e2af6c5 KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation code
| * 7429b8b9bfbc tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
| * 5f756d1866eb NFSv4/flexfiles: Fix layout merge mirror check.
| * 9a38cd92493c tracing: Fix tracing_marker may trigger page fault during preempt_disable
| * c10744fd7fec NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server
| * 89f40500c09a NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set
| * 91902607106c NFSv4: Don't clear capabilities that won't be reset
| * 929de8cc2f66 flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
| * 76b1a7c29ef3 mm/rmap: reject hugetlb folios in folio_make_device_exclusive()
| * 1cdb41d4f08a tracing: Do not add length to print format in synthetic events
| * d51e47e2ab6e net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
| * 85d1c5d416c6 media: i2c: imx214: Fix link frequency validation
| * 6e31585286b9 media: mtk-vcodec: venc: avoid -Wenum-compare-conditional warning
| * 10d8884e1869 mm: introduce and use {pgd,p4d}_populate_kernel()
| * adb2f26b875b kunit: kasan_test: disable fortify string checker on kasan_strings() test
| * 69944b3cd7ec xfs: short circuit xfs_growfs_data_private() if delta is zero
| * c0950ee2c3cc Revert "fbdev: Disable sysfb device registration when removing conflicting FBs"
* | 2bbc293701f8 Merge android13-5.15 into android13-5.15-lts
* | 8d934e0056f7 Merge 5.15.193 into android13-5.15-lts
|/
* 43bb85222e53 Linux 5.15.193
* 70de678302a8 x86/vmscape: Add old Intel CPUs to affected list
* 79ec330d124e x86/vmscape: Warn when STIBP is disabled with SMT
* 1cd71b057f05 x86/bugs: Move cpu_bugs_smt_update() down
* 2f4f2f8f860c x86/vmscape: Enable the mitigation
* d5490dfa3542 x86/vmscape: Add conditional IBPB mitigation
* f2ed886bb650 x86/vmscape: Enumerate VMSCAPE bug
* a4fff4e5c054 Documentation/hw-vuln: Add VMSCAPE documentation

Change-Id: Ifc2ca09e4d9b49f7c8f385f431ef9a464bbaa8fe
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>