merge-upstream/v6.6.153 from branch/tag: upstream/v6.6.153 into branch: main-R117-cos-6.6

Conflicts:
 net/ipv4/tcp.c

Changelog:
-------------------------------------------------------------

Ahmad Byagowi (1):
      ptp: ocp: Fix board ID over-read

Al Viro (1):
      mount: honour SB_NOUSER in the new mount API

Aldo Ariel Panzardo (1):
      net/sched: serialize qdisc_rtab_list against concurrent get/put

Aleksandr Nogikh (1):
      usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()

Alexander Usyskin (1):
      mei: pull kvfree out of spinlock

Alexey Velichayshiy (1):
      netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

Ali Ahmet Memis (1):
      openrisc: signal: do not restore privileged SR bits on sigreturn

Amir Goldstein (1):
      fs: don't block write during exec on pre-content watched files

Anandu Krishnan E (1):
      misc: fastrpc: fix channel ctx ref leak when session alloc fails

Andy Shevchenko (1):
      libceph: Amend checking to fix `make W=1` build breakage

Anna Schumaker (1):
      NFS: Pin the 'struct nfs_server' during a FREE_STATEID call

Asad Kamal (2):
      Revert "drm/amdgpu: fix aperture mapping leak"
      drm/amdgpu: fix aperture iounmap skipped on device removal

Asbjørn Sloth Tønnesen (3):
      net: sched: cls_api: add skip_sw counter
      net: sched: cls_api: add filter counter
      net: sched: make skip_sw actually skip software

Babanpreet Singh (1):
      counter: microchip-tcb-capture: Fix DT channel validation

Baul Lee (6):
      ALSA: usb-audio: fix OOB write on Type II inbound URBs
      net: bridge: mrp: fix uninitialised bytes on the wire
      ALSA: usx2y: bound the hwdep mmap fault offset
      vxlan: do not arm the ageing timer on a device that is down
      sctp: keep chunk->transport in step with the list it is queued on
      net/x25: fix use-after-free of the socket by its timers

Breno Leitao (1):
      vxlan: Do not alloc tstats manually

Bryam Vargas (6):
      thunderbolt: Bound the DROM dual link port number before indexing sw->ports
      selinux: require every boolean value to be defined
      selinux: reject a class permission count below its inherited common
      selinux: do not cancel a policy conversion that never started
      selinux: reject an unclaimed class value in security_get_classes()
      Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer

Candice Li (1):
      drm/amdgpu: validate GEM_CREATE domain combinations

Cen Zhang (Microsoft) (1):
      net/openvswitch: check Ethernet header length in key_extract()

Chancel Liu (1):
      ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP

Chao Shi (1):
      block: stop the timeout timer when releasing a never added disk

Chao Yu (1):
      f2fs: fix UAF issue in f2fs_merge_page_bio()

ChenXiaoSong (3):
      smb/server: rename include guard in smb_common.h
      smb/server: fix minimum SMB1 PDU size
      smb/server: fix minimum SMB2 PDU size

Chengfeng Ye (4):
      netfilter: ebt_nflog: pin the NFLOG backend
      ipv4: fix use-after-free in fib_nhc_update_mtu()
      bpf, sockmap: Fix sk_redir use-after-free in send verdict
      net: pktgen: fix proc entry use-after-free

Christian Brauner (4):
      ovl: don't warn when the mount is completed from another user namespace
      super: fix emergency thaw deadlock on frozen block devices
      binfmt_misc: restore write access when removing an entry
      binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

Christoph Hellwig (3):
      xfs: check v5 superblock features early
      dma-direct: add a CONFIG_ARCH_HAS_DMA_ALLOC symbol
      m68k: use the coherent DMA code for coldfire without data cache

Chuck Lever (1):
      net/tls: Fail tls_sw_splice_read() after a failed async decrypt

Chunyan Zhang (1):
      mm: userfaultfd: add pgtable_supports_uffd_wp()

Claudiu Beznea (1):
      pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP

Cunhao Lu (1):
      serial: 8250_dma: Clear stale RX state on shutdown

Daming Li (1):
      net: smc: fix splice entry lifetime imbalance in smc_rx_splice

Dan Carpenter (1):
      net/tcp_sigpool: Fix some off by one bugs

Daniel Borkmann (2):
      net, sched: Make tc-related drop reason more flexible
      net, sched: Add tcf_set_drop_reason for {__,}tcf_classify

Darrick J. Wong (1):
      xfs: only check mergeability of bnobt records

David Carlier (1):
      igc: remove napi_synchronize() in igc_down()

David Lechner (2):
      regulator: devres: add API for reference voltage supplies
      regulator: devres: fix devm_regulator_get_enable_read_voltage() return

David Rosca (6):
      drm/amdgpu: Reject UVD message with invalid number of h265 refs
      drm/amdgpu: Reject UVD message with dimensions above 4096
      drm/amdgpu: Implement insert_end for VCE 3
      drm/amdgpu: Fix UVD min buffer sizes
      drm/amdgpu: Fix UVD dpb min size calculation for H264
      drm/amdgpu: Fix UVD decode image min size calculation

David Sterba (1):
      btrfs: add debug build only WARN

Dawid Osuchowski (1):
      ice: fix VF interrupts cleanup

Dawid Wróbel (1):
      ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses

Dmitry Antipov (1):
      btrfs: fix memory leak in btrfs_do_encoded_write()

Dmitry Safonov (3):
      net/tcp: Prepare tcp_md5sig_pool for TCP-AO
      net/tcp: Add TCP-AO config and structures
      net/tcp_sigpool: Use kref_get_unless_zero()

Dmitry Torokhov (8):
      Input: evdev - sanitize event type index when fetching event masks
      Input: evdev - fix information leak in evdev_pass_values()
      Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
      Input: synaptics-rmi4 - zero report size on F54 work error
      Input: synaptics-rmi4 - block s_input when F54 queue is busy
      Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
      Input: sur40 - fix input device registration ordering
      Input: sur40 - fix V4L error path cleanup

Doruk Tan Ozturk (1):
      net/packet: reset the MAC header on the packet-socket transmit path

Eddie Lin (1):
      misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free

Ekansh Gupta (1):
      misc: fastrpc: Remove buffer from list prior to unmap operation

Eric Biggers (1):
      fscrypt: Replace mk_users keyring with simple list

Eric Dumazet (6):
      net: remove WARN_ON_ONCE() from sk_mc_loop()
      net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
      vxlan: use pskb_network_may_pull() for transmit path header pulls
      ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
      macvlan: inherit needed_headroom and needed_tailroom from lowerdev
      af_packet: Don't send zero-byte data in tpacket_snd().

Eric Farman (6):
      s390/vfio_ccw: Limit the number of channel program segments
      s390/vfio_ccw: Cancel existing workqueues
      s390/vfio_ccw: Ensure index for read/write regions are within range
      s390/vfio_ccw: Fix out of bounds check on CCW array
      s390/vfio_ccw: Move cp cleanup out of not operational
      s390/vfio_ccw: Selectively expand io_mutex

Erni Sri Satya Vennela (1):
      net: mana: Fix EQ leak in mana_remove on NULL port

Fan XinRan (1):
      net: thunderbolt: Tear down DMA paths before stopping the rings

Fan Ye (1):
      Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"

Farhan Ali (3):
      KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
      KVM: s390: pci: Fix missing error codes and memory unaccounting
      KVM: s390: pci: Fix resource leak on IRQ registration failure

Felix Fietkau (1):
      net: move skb_gro_receive_list from udp to core

Filipe Manana (1):
      btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()

Florian Westphal (2):
      netfilter: ipset: fix list type element drift bug
      netfilter: ipset: let destroy callbacks adjust ext mem size

Gang Yan (1):
      selftests: mptcp: join: mark tests with data corruption as failed

Gao Xiang (1):
      erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms

George Wilson (2):
      powerpc/pseries: pci - logic bug
      powerpc/pseries: lparcfg - fix kbuf[] underflow

Greg Kroah-Hartman (2):
      Linux 6.6.152
      Linux 6.6.153

Guanghui Yang (1):
      btrfs: zoned: fix missing chunk metadata reservation

Guangshuo Li (1):
      drm/radeon: fix autosuspend cleanup during teardown

Guenter Roeck (1):
      hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations

Guillaume Nault (2):
      vrf: Make pcpu_dstats update functions available to other modules.
      vxlan: Handle stats using NETDEV_PCPU_STAT_DSTATS.

Haibo Chen (1):
      mmc: sdhci: make tuning_err a signed int

Harald Freudenberger (1):
      s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()

Harshal Dev (1):
      dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk

Henry Martin (1):
      net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length

Herbert Xu (1):
      crypto: ccm - Set rfc4309 maxauthsize from child

Hidayath Khan (1):
      s390/qeth: validate user buffer length in SNMP and ARP query ioctls

Hongyan Xu (1):
      ata: pata_sl82c105: fix bridge revision use-after-free

Hui Su (1):
      ring-buffer: Fix crash passing ERR_PTR to kthread_stop()

Hyunjung Ko (2):
      net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
      net/sched: act_gact, act_police: range check the fallback control action

Ilpo Järvinen (2):
      tcp: Pass flags to __tcp_send_ack
      tcp: fast path functions later

Jamal Hadi Salim (5):
      net/sched: cls_route: fix fastmap use-after-free on filter
      net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
      net, sched: Fix SKB_NOT_DROPPED_YET splat under debug config
      net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
      net/sched: cls_bpf: reject dev-bound programs bound to a different device

Jeremy Kerr (1):
      net: core,vrf: Change pcpu_dstat fields to u64_stats_t

Jianbo Liu (1):
      net: sched: cls_api: fix slab-use-after-free in fl_dump_key

Jianing Li (1):
      Input: hynitron_cstxxx - validate touch count and finger IDs

Jiawen Liu (1):
      net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete

Jiayuan Chen (1):
      tcp: fix TFO max_qlen accounting across reuseport migration

Jon Hunter (1):
      arm64: tegra: Add EL2 virtual timer interrupt for Tegra194

Jonas Gorski (1):
      i2c: iproc: reset bus after timeout if START_BUSY is stuck

Jordan Rife (5):
      bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch
      bpf: tcp: Make sure iter->batch always contains a full bucket snapshot
      bpf: tcp: Get rid of st_bucket_done
      bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items
      bpf: tcp: Avoid socket skips and repeats during iteration

Jose Fernandez (Anthropic) (1):
      bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

Josh Poimboeuf (1):
      ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()

Joshua Rogers (2):
      vt: add permission check for KDSKBMETA ioctl
      vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

Jozsef Kadlecsik (1):
      netfilter: ipset: switch ext_size to atomic64_t

Julian Anastasov (4):
      ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
      ipvs: return the csum validation for forward hook
      ipvs: add totalconns for dest
      ipvs: properly update the overload flag on dest edit

Jun Yang (2):
      vhost: reset the vring metadata cache on vring reconfiguration
      tipc: read le->link under the node lock in tipc_node_link_down()

Junrui Luo (2):
      misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
      drm/amdgpu: disallow multiple FENCE chunks in one submit

Jérémy Jean (1):
      netfilter: flowtable: publish GC-visible tuple last

Keegan Freyhof (1):
      bnxt_en: Fix PTP PPS setting bug

Kefeng Wang (1):
      mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE

Kefu Chai (1):
      libceph: tolerate addrvecs with multiple entries of the same type

Keno Fischer (1):
      futex: Prevent robust futex exit race some more

Kyle Zeng (2):
      ipvs: clear IPv4 options after rebasing tunnel ICMP errors
      ipv6: prevent in6_dev_get() from resurrecting inet6_dev

Kyohei Kadota (1):
      Input: xpad - add support for ZENAIM LEVERLESS

Larisa Grigore (1):
      spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers

Leon Hwang (1):
      ftrace: Protect direct_functions in ftrace_find_rec_direct

Lincoln Wallace (1):
      ima: fix out-of-bounds read in xattr_verify()

Linmao Li (1):
      Input: psxpad-spi - set driver data before use

Long Li (2):
      xfs: fix ilock leak on error in xfs_dq_get_next_id
      xfs: don't swallow dquot recovery verification errors

Lorenzo Stoakes (1):
      mm/pagewalk: split walk_page_range_novma() into kernel/user parts

Lorenzo Stoakes (ARM) (3):
      mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
      mm/ptdump: always stabilise against page table freeing using init_mm
      mm/huge_memory: fix huge_zero_pfn race

Mahanta Jambigi (1):
      net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()

Mariano Baragiola (1):
      staging: rtl8723bs: validate monitor transmit frame lengths

Mark Brown (1):
      ASoC: tas2562: Validate values for volume writes

Martin Kaiser (1):
      selftests/ftrace: refactor eprobes test to fix argument checks

Masahiro Yamada (1):
      fortify: refactor test_fortify Makefile to fix some build problems

Matt Fleming (1):
      veth: convert frag_list skbs before running XDP

Matthew Rosato (1):
      KVM: s390: pci: Fix aisb calculation

Matthew Wilcox (Oracle) (3):
      ceph: Remove ceph_writepage()
      ceph: Use a folio in ceph_page_mkwrite()
      iomap: hold state_lock over call to ifs_set_range_uptodate()

Matthieu Baerts (NGI0) (2):
      mptcp: avoid combining some incoming suboptions
      mptcp: options: reset DSS fields in case of unexpected size

Max Kellermann (2):
      ceph: avoid fs reclaim while using current->journal_info
      ceph: fix hanging __ceph_get_caps() with stale mds_wanted

Maximilian Immanuel Brandtner (1):
      tls: don't abort the connection on signal-interrupted sends

Mehmet Fide (1):
      net: fec: do not release NULL pages when RX buffer allocation fails

Michael Chan (2):
      bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
      bnxt_en: Disable EOP for TPA on all chips to prevent data corruption

Michael Guralnik (1):
      net/mlx5: fw_tracer, return NULL on create error

Michael Wu (1):
      tracing: Fix race between update_event_fields and, event_define_fields

Michal Luczaj (2):
      selftests/bpf: Fail unbound UDP on sockmap update
      selftests/bpf: Adapt sockmap update error handling

Mike Rapoport (Microsoft) (2):
      userfaultfd: move vma_can_userfault out of line
      userfaultfd: prevent registration of special VMAs

Mingyu Wang (1):
      fbdev: core: Fix pointer desynchronization in fb_io_read()

Muhammad Bilal (2):
      staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
      staging: rtl8723bs: fix OOB read in WMM_param_handler()

Myeonghun Pak (1):
      mmc: sdhci: unmap the bounce buffer before device release

Namjae Jeon (4):
      ksmbd: rename smb2_get_msg to smb_get_msg
      ksmbd: validate minimum PDU size for transform requests
      ksmbd: conn lock to serialize smb2 negotiate
      ksmbd: reject repeated SMB2 NEGOTIATE requests

Naohiro Aota (1):
      btrfs: add space_info argument to btrfs_chunk_alloc()

Nathan Chancellor (1):
      fortify: Disable -Wstringop-overread in tests

Nathan Gao (1):
      tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()

Or Har-Toov (1):
      devlink: fix net namespace reference leak in reload

Palmer Dabbelt (1):
      RISC-V: Provide pgtable_l5_enabled on rv32

Panagiotis Petrakopoulos (1):
      staging: rtl8723bs: fix missing shared-key auth challenge length check

Paolo Abeni (1):
      net: harmonize tstats and dstats

Paolo Bonzini (1):
      KVM: SVM: Serialize accesses to the owner and mirror list with separate lock

Pavitra Jha (2):
      libceph: fix multiple unsafe decodes in decode_locker()
      libceph: fix two unsafe bare decodes in decode_lockers()

Pawel Laszczak (1):
      usb: cdnsp: fix incorrect endian conversions for APB timeout register

Pengpeng Hou (3):
      drm/bridge: ps8640: propagate AUX transfer register errors
      net: prestera: validate firmware header length
      Input: iforce - validate input packet lengths

Peter Seiderer (1):
      net: pktgen: fix code style (WARNING: Block comments)

Peter Ujfalusi (4):
      ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked()
      ASoC: cs4265: sort the register default table
      ASoC: cs35l45: sort the register default table
      ASoC: cs35l41: sort the register default table

Pierre-Eric Pelloux-Prayer (1):
      drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini

Qihang Tang (3):
      packet: use consistent hard_header_len in non-ring send paths
      packet: use consistent hard_header_len in TX_RING send path
      net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

Qing Luo (1):
      sctp: fix addip_serial increment on ASCONF_ACK allocation failure

Qing Ming (1):
      sctp: clear new_transport when removing a peer

Qingshuang Fu (2):
      hwmon: (nzxt-smart2) Check return value of init_device() in probe
      hwmon: (ads7828) Fix external VREF regulator handling

Rafael J. Wysocki (1):
      Revert "thermal/drivers/hwmon: Cleanup coding style a bit"

Raphael Zimmer (1):
      libceph: Avoid using invalid osd indices from primary_temp

Richard Davies (1):
      Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet

Rik van Riel (1):
      fbdev: bitblit: bound-check glyph index in bit_cursor()

Rob Herring (1):
      hwmon: (lm25066) Use i2c_get_match_data()

Rosen Penev (2):
      ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
      ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers

Sean Christopherson (1):
      KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page

Sergey V. Frolov (1):
      net: octeontx2-pf: Fix UB in shift operation

Shay Drory (1):
      net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock

Shiming Cheng (1):
      net: gro: fix double aggregation of flush-marked skbs

Shuangpeng Bai (2):
      smb: client: Fix use-after-free in cifs_try_adding_channels()
      eventfs: Fix use-after-free in eventfs_remove_rec()

Siddharth Vadapalli (1):
      net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG

Sidraya Jayagond (1):
      net/smc: fix TOCTOU race between smc_listen_out() and listener close

Sonali Pradhan (1):
      usb: gadget: f_ncm: Use unsigned int for ndp_index

Steven Rostedt (1):
      ring-buffer: Remove jump to out label in ring_buffer_swap_cpu()

Sun Jian (1):
      veth: fix skb length accounting after XDP frag adjustment

Takashi Iwai (1):
      ALSA: usb: Fix UAF at delayed release of MIDI2 EPs

Tejun Heo (1):
      sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

Tengda Wu (1):
      ring-buffer: Use current_context for safe per-CPU buffer swap

Thorsten Blum (1):
      crypto: qce - fix error path in devm_qce_register_algs

Toke Høiland-Jørgensen (1):
      net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

Tu Nguyen (1):
      can: rcar_canfd: change the initializing flow for clocks and resets

Uwe Kleine-König (1):
      m68k: Define NR_CPUS to 1

Victor Nogueira (2):
      net: sched: Move drop_reason to struct tc_skb_cb
      net: sched: Add initial TC error skb drop reasons

Wei Fang (1):
      net: packet: fix wrong transport_header when sending VLAN-tagged frame

Weiming Shi (2):
      vsock/virtio: read virtqueues under worker locks
      vsock/virtio: avoid refilling the RX queue after teardown

Wilken Gottwalt (1):
      hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination

Wolfram Sang (1):
      i2c: bcm-iproc: remove printout on handled timeouts

Wyatt Feng (1):
      mptcp: fastopen: only mark MPTFO subflows with SYN data

Xiang Mei (1):
      libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

Xiang Mei (Microsoft) (3):
      bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
      bpf: tcp: fix double sock release on batch realloc
      netfilter: ipset: fix refcount race between list:set GC and swap

Xin Long (2):
      net: sched: refine software bypass handling in tc_run
      sctp: clear control chunk transport if it is being removed

Xu Rao (2):
      thunderbolt: icm: Preserve USB4 proxy data-valid bit
      scsi: scsi_debug: Negate wrapped memcmp() result

Xuanqiang Luo (1):
      udp: fix potential use-after-free in tunnel segmentation

Yan Zhai (1):
      packet: add a generic drop reason for receive

Yang Wang (2):
      drm/amd/pm: fix torn gpu metrics reads
      drm/amd/pm: fix pptable use-after-free

Yangyu Chen (2):
      net: atlantic: free stranded TX buffers on ring deinit
      net: atlantic: free RX pages of consumed but not refilled buffers

Yi Cong (1):
      net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()

Yiming Zhu (1):
      ceph: fix MDS random selection readiness predicate

Yiyang Chen (1):
      bpf: Preserve pointer state for commuted arithmetic

Yizhou Zhao (1):
      ipvs: separate destination availability state

Yousef Alhouseen (1):
      vhost/vdpa: reject overflowing PA map page counts on 32-bit

Yuejie Shi (1):
      ipv6: fix Route Information option length validation

Yuho Choi (1):
      ARM: npcm: Fix OF node refcount leaks in SMP setup

Yuxiang Yang (2):
      sctp: fix use-after-free of cached ASCONF chunk
      tcp: challenge ACK for non-exact RST in SYN-RECEIVED

Zhan Xusheng (2):
      fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
      mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit

Zhang Changzhong (1):
      net/sched: cls_u32: skip hash tables in u32_bind_class()

Zhang Yi (1):
      iomap: fix out-of-bounds bitmap_set() with zero-length range

ZhangGuoDong (2):
      smb: move smb_version_values to common/smbglob.h
      smb: move get_rfc1002_len() to common/smbglob.h

Zhefu Zhang (1):
      Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard

Zhiling Zou (5):
      ipvs: stop estimator after disabled calc phase
      net: openvswitch: reallocate update replies for mismatched IDs
      netfilter: bridge: release template ct on non-IP path
      xdp: reject clones that overrun skb_shared_info tailroom
      ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

Zihan Xi (4):
      packet: synchronize pressure clearing with ring reconfiguration
      mac802154: fix netdev use-after-free in beacon worker
      ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
      netfilter: nf_conntrack: defer invalid log until after unlock

Zijie Huang (1):
      net/sched: reject overly deep qdisc hierarchies

chanyoung (1):
      tls: don't leave a full plaintext sk_msg ring unpushed

BUG=b/551777376
TEST=tryjob, validation and K8s e2e
RELEASE_NOTE=Updated the Linux kernel to v6.6.153.

Change-Id: I2b108ccc75428278b88dece4d8165feb64eb448a
Signed-off-by: Derek <ddtaylor@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/189946
Reviewed-by: Kevin Berry <kpberry@google.com>
Tested-by: Kevin Berry <kpberry@google.com>
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>