Merge 5.10.247 into android13-5.10-lts

Changes in 5.10.247
	net/sched: sch_qfq: Fix null-deref in agg_dequeue
	x86/bugs: Fix reporting of LFENCE retpoline
	btrfs: always drop log root tree reference in btrfs_replay_log()
	btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
	NFSD: Fix crash in nfsd4_read_release()
	net: usb: asix_devices: Check return value of usbnet_get_endpoints
	fbdev: atyfb: Check if pll_ops->init_pll failed
	ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
	fbdev: bitblit: bound-check glyph index in bit_putcs*
	wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
	fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
	fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
	ASoC: qdsp6: q6asm: do not sleep while atomic
	wifi: ath10k: Fix memory leak on unsupported WMI command
	drm/msm/a6xx: Fix GMU firmware parser
	ALSA: usb-audio: fix control pipe direction
	bpf: Sync pending IRQ work before freeing ring buffer
	usbnet: Prevents free active kevent
	drm/etnaviv: fix flush sequence logic
	drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
	drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
	drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
	block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
	regmap: slimbus: fix bus_context pointer in regmap init calls
	net: phy: dp83867: Disable EEE support as not implemented
	net: ravb: Enforce descriptor type ordering
	xfs: always warn about deprecated mount options
	devcoredump: Fix circular locking dependency with devcd->mutex.
	can: gs_usb: increase max interface to U8_MAX
	serial: 8250_dw: Use devm_add_action_or_reset()
	serial: 8250_dw: handle reset control deassert error
	x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
	x86/boot: Compile boot code with -std=gnu11 too
	arch: back to -std=gnu89 in < v5.18
	tracing: fix declaration-after-statement warning
	usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
	block: make REQ_OP_ZONE_OPEN a write operation
	soc: qcom: smem: Fix endian-unaware access of num_entries
	spi: loopback-test: Don't use %pK through printk
	soc: ti: pruss: don't use %pK through printk
	bpf: Don't use %pK through printk
	pinctrl: single: fix bias pull up/down handling in pin_config_set
	mmc: host: renesas_sdhi: Fix the actual clock
	memstick: Add timeout to prevent indefinite waiting
	ACPI: video: force native for Lenovo 82K8
	selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
	cpufreq/longhaul: handle NULL policy in longhaul_exit
	arc: Fix __fls() const-foldability via __builtin_clzl()
	irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
	mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
	ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
	tee: allow a driver to allocate a tee_device without a pool
	nvme-fc: use lock accessing port_state and rport state
	video: backlight: lp855x_bl: Set correct EPROM start for LP8556
	cpuidle: Fail cpuidle device registration if there is one already
	clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
	uprobe: Do not emulate/sstep original instruction when ip is changed
	hwmon: (dell-smm) Add support for Dell OptiPlex 7040
	tools/cpupower: Fix incorrect size in cpuidle_state_disable()
	tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
	tools/power x86_energy_perf_policy: Enhance HWP enable
	tools/power x86_energy_perf_policy: Prefer driver HWP limits
	mfd: stmpe: Remove IRQ domain upon removal
	mfd: stmpe-i2c: Add missing MODULE_LICENSE
	mfd: madera: Work around false-positive -Wininitialized warning
	mfd: da9063: Split chip variant reading in two bus transactions
	drm/amd/pm: Use cached metrics data on arcturus
	drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
	drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
	PCI: Disable MSI on RDC PCI to PCIe bridges
	selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
	selftests/net: Ensure assert() triggers in psock_tpacket.c
	drm/amdkfd: return -ENOTTY for unsupported IOCTLs
	media: pci: ivtv: Don't create fake v4l2_fh
	drm/tidss: Use the crtc_* timings when programming the HW
	x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
	net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
	powerpc/eeh: Use result of error_detected() in uevent
	bridge: Redirect to backup port when port is administratively down
	net: ipv6: fix field-spanning memcpy warning in AH output
	media: imon: make send_packet() more robust
	drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
	iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
	usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
	char: misc: Does not request module for miscdevice with dynamic minor
	net: When removing nexthops, don't call synchronize_net if it is not necessary
	net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
	PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
	ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
	rds: Fix endianness annotation for RDS_MPATH_HASH
	scsi: pm80xx: Fix race condition caused by static variables
	extcon: adc-jack: Fix wakeup source leaks on device unbind
	drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
	media: fix uninitialized symbol warnings
	mips: lantiq: danube: add missing properties to cpu node
	mips: lantiq: danube: add missing device_type in pci node
	mips: lantiq: xway: sysctrl: rename stp clock
	scsi: pm8001: Use int instead of u32 to store error codes
	dmaengine: sh: setup_xref error handling
	dmaengine: mv_xor: match alloc_wc and free_wc
	dmaengine: dw-edma: Set status for callback_result
	ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
	net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
	ALSA: usb-audio: apply quirk for MOONDROP Quark2
	net: call cond_resched() less often in __release_sock()
	iommu/amd: Skip enabling command/event buffers for kdump
	usb: gadget: f_hid: Fix zero length packet transfer
	net: phy: marvell: Fix 88e1510 downshift counter errata
	phy: cadence: cdns-dphy: Enable lower resolutions in dphy
	net: sh_eth: Disable WoL if system can not suspend
	media: redrat3: use int type to store negative error codes
	selftests: traceroute: Use require_command()
	x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
	selftests: Disable dad for ipv6 in fcnal-test.sh
	eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
	selftests: Replace sleep with slowwait
	udp_tunnel: use netdev_warn() instead of netdev_WARN()
	net/cls_cgroup: Fix task_get_classid() during qdisc run
	selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
	scsi: lpfc: Define size of debugfs entry for xri rebalancing
	allow finish_no_open(file, ERR_PTR(-E...))
	usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
	usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
	ipv6: np->rxpmtu race annotation
	jfs: Verify inode mode when loading from disk
	jfs: fix uninitialized waitqueue in transaction manager
	wifi: ath10k: Fix connection after GTK rekeying
	net: intel: fm10k: Fix parameter idx set but not used
	r8169: set EEE speed down ratio to 1
	PCI: cadence: Check for the existence of cdns_pcie::ops before using it
	sparc/module: Add R_SPARC_UA64 relocation handling
	remoteproc: qcom: q6v5: Avoid handling handover twice
	NFSv4: handle ERR_GRACE on delegation recalls
	NFSv4.1: fix mount hang after CREATE_SESSION failure
	nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
	fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
	net: macb: avoid dealing with endianness in macb_set_hwaddr()
	Bluetooth: SCO: Fix UAF on sco_conn_free
	Bluetooth: bcsp: receive data only if registered
	ALSA: usb-audio: add mono main switch to Presonus S1824c
	exfat: limit log print for IO error
	page_pool: Clamp pool size to max 16K pages
	orangefs: fix xattr related buffer overflow...
	ACPICA: Update dsmethod.c to get rid of unused variable warning
	btrfs: mark dirty extent range for out of bound prealloc extents
	fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
	um: Fix help message for ssl-non-raw
	ARM: at91: pm: save and restore ACR during PLL disable/enable
	9p: fix /sys/fs/9p/caches overwriting itself
	9p: sysfs_init: don't hardcode error to ENOMEM
	ACPI: property: Return present device nodes only on fwnode interface
	fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
	ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
	ceph: add checking of wait_for_completion_killable() return value
	ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
	riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
	net: vlan: sync VLAN features with lower device
	net: dsa: b53: fix resetting speed and pause on forced link
	net: dsa: b53: fix enabling ip multicast
	net: dsa: b53: stop reading ARL entries if search is done
	sctp: Hold RCU read lock while iterating over address list
	sctp: Prevent TOCTOU out-of-bounds write
	net: sctp: Fix some typos
	net: Use nlmsg_unicast() instead of netlink_unicast()
	sctp: hold endpoint before calling cb in sctp_transport_lookup_process
	sctp: Hold sock lock while iterating over address list
	net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
	tracing: Fix memory leaks in create_field_var()
	lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
	extcon: adc-jack: Cleanup wakeup source only if it was enabled
	compiler_types: Move unused static inline functions warning to W=2
	RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
	NFS4: Fix state renewals missing after boot
	HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
	ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
	net: fec: correct rx_bytes statistic for the case SHIFT16 is set
	Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
	Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
	Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
	Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
	sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
	net/smc: fix mismatch between CLC header and proposal
	tipc: Fix use-after-free in tipc_mon_reinit_self().
	net: mdio: fix resource leak in mdiobus_register_device()
	wifi: mac80211: skip rate verification for not captured PSDUs
	net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
	net/mlx5e: Fix maxrate wraparound in threshold between units
	net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
	net_sched: limit try_bulk_dequeue_skb() batches
	hsr: Fix supervision frame sending on HSRv0
	Bluetooth: L2CAP: export l2cap_chan_hold for modules
	acpi,srat: Fix incorrect device handle check for Generic Initiator
	regulator: fixed: use dev_err_probe for register
	regulator: fixed: fix GPIO descriptor leak on register failure
	ASoC: cs4271: Fix regulator leak on probe failure
	drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
	ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
	fsdax: mark the iomap argument to dax_iomap_sector as const
	mm/ksm: fix flag-dropping behavior in ksm_madvise
	lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
	mtd: onenand: Pass correct pointer to IRQ handler
	netfilter: nf_tables: reject duplicate device on updates
	HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
	NFSD: free copynotify stateid in nfs4_free_ol_stateid()
	gcov: add support for GCC 15
	strparser: Fix signed/unsigned mismatch bug
	ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
	fs/proc: fix uaf in proc_readdir_de()
	spi: Try to get ACPI GPIO IRQ earlier
	EDAC/altera: Handle OCRAM ECC enable after warm reset
	EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
	isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
	HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
	mtd: rawnand: cadence: fix DMA device NULL pointer dereference
	exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
	be2net: pass wrb_params in case of OS2BMC
	Input: cros_ec_keyb - fix an invalid memory access
	Input: imx_sc_key - fix memory corruption on unload
	nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
	scsi: sg: Do not sleep in atomic context
	scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
	MIPS: Malta: Fix !EVA SOC-it PCI MMIO
	drm/tegra: dc: Fix reference leak in tegra_dc_couple()
	mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
	net: openvswitch: remove never-working support for setting nsh fields
	s390/ctcm: Fix double-kfree
	vsock: Ignore signal/timeout on connect() if already established
	scsi: core: Fix a regression triggered by scsi_host_busy()
	net: tls: Cancel RX async resync request on rcd_delta overflow
	kconfig/mconf: Initialize the default locale at startup
	kconfig/nconf: Initialize the default locale at startup
	mm/mm_init: fix hash table order logging in alloc_large_system_hash()
	ALSA: usb-audio: fix uac2 clock source at terminal parser
	net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
	uio_hv_generic: Set event for all channels on the device
	net: qede: Initialize qede_ll_ops with designated initializer
	Makefile.compiler: replace cc-ifversion with compiler-specific macros
	Revert "NFS: Don't set NFS_INO_REVAL_PAGECACHE in the inode cache validity"
	net: netpoll: fix incorrect refcount handling causing incorrect cleanup
	ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
	pmdomain: imx: Fix reference count leak in imx_gpc_remove
	pmdomain: arm: scmi: Fix genpd leak on provider registration failure
	ata: libata-scsi: Fix system suspend for a security locked drive
	mptcp: introduce mptcp_schedule_work
	mptcp: fix race condition in mptcp_schedule_work()
	dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
	mptcp: fix a race in mptcp_pm_del_add_timer()
	mptcp: do not fallback when OoO is present
	usb: deprecate the third argument of usb_maxpacket()
	Input: remove third argument of usb_maxpacket()
	Input: pegasus-notetaker - fix potential out-of-bounds access
	can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
	Bluetooth: SMP: Fix not generating mackey and ltk when repairing
	net: aquantia: Add missing descriptor cache invalidation on ATL2
	net/mlx5e: Fix validation logic in rate limiting
	net: sxgbe: fix potential NULL dereference in sxgbe_rx()
	net: atlantic: fix fragment overflow handling in RX path
	mailbox: mailbox-test: Fix debugfs_create_dir error checking
	spi: bcm63xx: fix premature CS deassertion on RX-only transactions
	Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
	iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
	iio:common:ssp_sensors: Fix an error handling path ssp_probe()
	MIPS: mm: Prevent a TLB shutdown on initial uniquification
	atm/fore200e: Fix possible data race in fore200e_open()
	can: sja1000: fix max irq loop handling
	can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
	dm-verity: fix unreliable memory allocation
	thunderbolt: Add support for Intel Wildcat Lake
	slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
	firmware: stratix10-svc: fix bug in saving controller data
	serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
	most: usb: fix double free on late probe failure
	usb: cdns3: Fix double resource release in cdns3_pci_probe
	usb: gadget: f_eem: Fix memory leak in eem_unwrap
	usb: storage: Fix memory leak in USB bulk transport
	USB: storage: Remove subclass and protocol overrides from Novatek quirk
	usb: storage: sddr55: Reject out-of-bound new_pba
	usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
	xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
	USB: serial: ftdi_sio: add support for u-blox EVK-M101
	USB: serial: option: add support for Rolling RW101R-GL
	drm: sti: fix device leaks at component probe
	drm/amd/display: Check NULL before accessing
	libceph: fix potential use-after-free in have_mon_and_osd_map()
	fs: writeback: fix use-after-free in __mark_inode_dirty()
	Bluetooth: Add more enc key size check
	netfilter: nf_set_pipapo: fix initial map fill
	scsi: pm80xx: Set phy->enable_completion only when we
	mptcp: Fix proto fallback detection with BPF
	smb: client: fix memory leak in cifs_construct_tcon()
	usb: typec: ucsi: psy: Set max current to zero when disconnected
	usb: renesas_usbhs: Fix synchronous external abort on unbind
	usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
	ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
	netfilter: nf_set_pipapo_avx2: fix initial map fill
	Linux 5.10.247

Change-Id: I4bf60d86a6316a81771b4d7979bea6ced16d0190
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>