merge-upstream/v6.12.77 from branch/tag: upstream/v6.12.77 into branch: cos-6.12

We drop the patch for 9fb6fef0fb4912 ("resource: Add resource set range
and size helpers") since it's included in the merge.

Changelog:
-------------------------------------------------------------

Akhilesh Patil (1):
      hwmon: (aht10) Add support for dht20

Al Viro (1):
      xattr: switch to CLASS(fd)

Alban Bedel (1):
      can: mcp251x: fix deadlock in error path of mcp251x_open

Alexandre Courbot (1):
      rust: kunit: fix warning when !CONFIG_PRINTK

Allison Henderson (1):
      net/rds: Fix circular locking dependency in rds_tcp_tune

Andrew Cooper (1):
      x86/fred: Correct speculative safety in fred_extint()

Andrii Nakryiko (1):
      uprobes: switch to RCU Tasks Trace flavor for better performance

Anup Patel (1):
      mailbox: Allow controller specific mapping using fwnode

Ariel Silver (1):
      wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

Baokun Li (8):
      ext4: add ext4_try_lock_group() to skip busy groups
      ext4: factor out __ext4_mb_scan_group()
      ext4: factor out ext4_mb_might_prefetch()
      ext4: factor out ext4_mb_scan_group()
      ext4: convert free groups order lists to xarrays
      ext4: refactor choose group to scan group
      ext4: implement linear-like traversal across order xarrays
      ext4: fix potential null deref in ext4_mb_init()

Bart Van Assche (5):
      drm/amdgpu: Unlock a mutex before destroying it
      drm/amdgpu: Fix locking bugs in error paths
      hwmon: (it87) Check the it87_lock() return value
      wifi: cw1200: Fix locking in error paths
      wifi: wlcore: Fix a locking bug

Bjorn Helgaas (1):
      PCI: Correct PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 value

Brad Spengler (1):
      drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release

Breno Leitao (2):
      ima: kexec: silence RCU list traversal warning
      uprobes: Fix incorrect lockdep condition in filter_chain()

Brian Howard (1):
      HID: multitouch: add quirks for Lenovo Yoga Book 9i

Brian Vazquez (1):
      idpf: change IRQ naming to match netdev and ethtool queue numbering

Charles Haithcock (1):
      i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock"

Chintan Vankar (1):
      net: ethernet: ti: am65-cpsw-nuss/cpsw-ale: Fix multicast entry handling in ALE table

Christian Brauner (1):
      namespace: fix proc mount iteration

Christoph Böhmwalder (1):
      drbd: fix null-pointer dereference on local read error

Damien Le Moal (13):
      PCI: endpoint: Introduce pci_epc_function_is_valid()
      PCI: endpoint: Introduce pci_epc_mem_map()/unmap()
      PCI: dwc: endpoint: Implement the pci_epc_ops::align_addr() operation
      ata: libata-scsi: Refactor ata_scsi_simulate()
      ata: libata-scsi: Refactor ata_scsiop_read_cap()
      ata: libata-scsi: Refactor ata_scsiop_maint_in()
      ata: libata-scsi: Document all VPD page inquiry actors
      ata: libata-scsi: Remove struct ata_scsi_args
      ata: libata: Remove ATA_DFLAG_ZAC device flag
      ata: libata: Introduce ata_port_eh_scheduled()
      ata: libata-scsi: avoid Non-NCQ command starvation
      ata: libata-core: fix cancellation of a port deferred qc work
      ata: libata-eh: correctly handle deferred qc timeouts

Daniil Dulov (1):
      wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()

David Sterba (1):
      btrfs: drop unused parameter fs_info from do_reclaim_sweep()

David Thomson (1):
      xen/acpi-processor: fix _CST detection using undersized evaluation buffer

Davide Caratti (1):
      net/sched: ets: fix divide by zero in the offload path

Eric Dumazet (2):
      indirect_call_wrapper: do not reevaluate function pointer
      net_sched: sch_fq: clear q->band_pkt_count[] in fq_reset()

Eric Naim (1):
      ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)

Ethan Nelson-Moore (1):
      net: arcnet: com20020-pci: fix support for 2.5Mbit cards

Felix Gu (2):
      drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()
      pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe()

Fernando Fernandez Mancera (2):
      net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
      net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled

Filipe Manana (2):
      btrfs: get used bytes while holding lock at btrfs_reclaim_bgs_work()
      btrfs: fix reclaimed bytes accounting after automatic block group reclaim

Florian Eckert (2):
      pinctrl: equilibrium: rename irq_chip function callbacks
      pinctrl: equilibrium: fix warning trace on load

Florian Westphal (1):
      netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

Francesco Lavra (1):
      drm/solomon: Fix page start when updating rectangle in page addressing mode

Fuad Tabba (2):
      KVM: arm64: Hide S1POE from guests when not supported by the host
      bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing

Geoffrey D. Bennett (3):
      ALSA: scarlett2: Fix redeclaration of loop variable
      ALSA: scarlett2: Fix DSP filter control array handling
      ALSA: usb-audio: Remove VALIDATE_RATES quirk for Focusrite devices

Greg Kroah-Hartman (12):
      nfc: pn533: properly drop the usb interface reference on disconnect
      net: usb: kaweth: validate USB endpoints
      net: usb: kalmia: validate USB endpoints
      net: usb: pegasus: validate USB endpoints
      can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
      can: usb: f81604: correctly anchor the urb in the read bulk callback
      can: ucan: Fix infinite loop from zero-length messages
      can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
      can: usb: f81604: handle short interrupt urb messages properly
      can: usb: f81604: handle bulk write errors properly
      HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them
      Linux 6.12.77

Guenter Roeck (3):
      dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler
      tracing: Add NULL pointer check to trigger_data_free()
      ata: libata-eh: Fix detection of deferred qc timeouts

Gui-Dong Han (1):
      hwmon: (max16065) Use READ/WRITE_ONCE to avoid compiler optimization induced race

Hao Yu (1):
      hwmon: (aht10) Fix initialization commands for AHT20

Harshit Mogalapalli (2):
      ima: verify the previous kernel's IMA buffer lies in addressable RAM
      of/kexec: refactor ima_get_kexec_buffer() to use ima_validate_range()

Heiko Carstens (2):
      s390/idle: Fix cpu idle exit cpu time accounting
      s390/vtime: Fix virtual timer forwarding

Henrique Carvalho (1):
      smb: client: fix cifs_pick_channel when channels are equally loaded

Hongyu Xie (1):
      usb: cdns3: remove redundant if branch

Huacai Chen (1):
      net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz

Ian Forbes (1):
      drm/vmwgfx: Return the correct value in vmw_translate_ptr functions

Ian Ray (2):
      HID: multitouch: new class MT_CLS_EGALAX_P80H84
      net: nfc: nci: Fix zero-length proprietary notifications

Ilpo Järvinen (2):
      resource: Add resource set range and size helpers
      PCI: Use resource_set_range() that correctly sets ->end

Jakub Kicinski (4):
      ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
      nfc: nci: free skb on nci_transceive early error paths
      nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
      nfc: rawsock: cancel tx_work before socket teardown

Jamal Hadi Salim (1):
      net/sched: act_ife: Fix metalist update behavior

Jan Kara (1):
      ext4: always allocate blocks only from groups inode can use

Jann Horn (1):
      eventpoll: Fix integer overflow in ep_loop_check_proc()

Jason Gunthorpe (2):
      IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
      RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()

Jens Axboe (1):
      media: dvb-core: fix wrong reinitialization of ringbuffer on reopen

Jeongjun Park (2):
      drm/exynos: vidi: fix to avoid directly dereferencing user pointer
      drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free

Jiayuan Chen (3):
      atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
      bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
      net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop

Jinhui Guo (1):
      iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode

Johan Hovold (4):
      memory: mtk-smi: fix device leaks on common probe
      memory: mtk-smi: fix device leak on larb probe
      drm/tegra: dsi: fix device leak on probe
      clk: tegra: tegra124-emc: fix device leak on set_rate()

Johannes Berg (1):
      wifi: radiotap: reject radiotap with unknown bits

Johannes Thumshirn (1):
      btrfs: zoned: fix alloc_offset calculation for partly conventional block groups

John Johansen (6):
      apparmor: fix: limit the number of levels of policy namespaces
      apparmor: Fix double free of ns_name in aa_replace_profiles()
      apparmor: fix unprivileged local user can do privileged policy management
      apparmor: fix differential encoding verification
      apparmor: fix race on rawdata dereference
      apparmor: fix race between freeing data and fs accessing it

Jonathan Teh (1):
      platform/x86: thinkpad_acpi: Fix errors reading battery thresholds

Joonwon Kang (1):
      mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()

Jun Seo (1):
      ALSA: usb-audio: Use correct version for UAC3 header validation

Junxiao Bi (1):
      scsi: core: Fix refcount leak for tagset_refcnt

Kohei Enju (2):
      bpf: Fix stack-out-of-bounds write in devmap
      iavf: fix netdev->max_mtu to respect actual hardware limit

Koichiro Den (1):
      net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs

Krishna chaitanya chundru (1):
      PCI: qcom: Don't wait for link if we can detect Link Up

Kuninori Morimoto (1):
      ALSA: pci: hda: use snd_kcontrol_chip()

Kuniyuki Iwashima (1):
      nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().

Kurt Borja (1):
      platform/x86: dell-wmi: Add audio/mic mute key codes

Lang Xu (1):
      bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

Lars Ellenberg (1):
      drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()

Larysa Zaremba (5):
      xdp: use modulo operation to calculate XDP frag tailroom
      xsk: introduce helper to determine rxq->frag_size
      i40e: fix registering XDP RxQ info
      i40e: use xdp.frame_sz as XDP RxQ info frag_size
      xdp: produce a warning when calculated tailroom is negative

Lewis Mason (1):
      ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)

Lorenzo Bianconi (4):
      wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
      wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
      wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
      net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()

MD Danish Anwar (1):
      net: ti: icssg-prueth: Fix ping failure after offload mode setup when link speed is not 1G

Maciej Fijalkowski (2):
      xsk: Get rid of xdp_buff_xsk::xskb_list_node
      xsk: s/free_list_node/list_node/

Marco Crivellari (2):
      workqueue: Add system_percpu_wq and system_dfl_wq
      Input: synaptics_i2c - replace use of system_wq with system_dfl_wq

Mario Limonciello (1):
      drm/amd: Fix hang on amdgpu unload by using pci_dev_is_disconnected()

Mark Harmstone (5):
      btrfs: fix incorrect key offset in error message in check_dev_extent_item()
      btrfs: fix objectid value in error message in check_extent_data_ref()
      btrfs: fix warning in scrub_verify_one_metadata()
      btrfs: print correct subvol num if active swapfile prevents deletion
      btrfs: fix compat mask in error messages in btrfs_check_features()

Massimiliano Pellizzer (5):
      apparmor: validate DFA start states are in bounds in unpack_pdb
      apparmor: fix memory leak in verify_header
      apparmor: replace recursive profile removal with iterative approach
      apparmor: fix side-effect bug in match_char() macro usage
      apparmor: fix missing bounds check on DEFAULT table in verify_dfa()

Mathias Krause (1):
      scsi: lpfc: Properly set WC for DPP mapping

Mathieu Desnoyers (1):
      rseq: Clarify rseq registration rseq_size bound check comment

Matthew Brost (1):
      drm/xe: Do not preempt fence signaling CS instructions

Matthias Fend (2):
      media: dw9714: move power sequences to dedicated functions
      media: dw9714: add support for powerdown pin

Matthieu Baerts (NGI0) (1):
      selftests: mptcp: join: check removing signal+subflow endp

Mieczyslaw Nalewaj (1):
      net: dsa: realtek: rtl8365mb: fix rtl8365mb_phy_ocp_write return value

Mike Rapoport (Microsoft) (1):
      x86/efi: defer freeing of boot services memory

Ming Lei (1):
      nvme: fix admin queue leak on controller reset

Minseong Kim (1):
      Input: synaptics_i2c - guard polling restart in resume

Miquel Sabaté Solà (1):
      btrfs: define the AUTO_KFREE/AUTO_KVFREE helper macros

Nam Cao (1):
      irqchip/sifive-plic: Fix frozen interrupt due to affinity setting

Namjae Jeon (2):
      ksmbd: check return value of xa_store() in krb5_authenticate
      ksmbd: add chann_lock to protect ksmbd_chann_list xarray

Naohiro Aota (4):
      btrfs: zoned: fixup last alloc pointer after extent removal for RAID1
      btrfs: zoned: fixup last alloc pointer after extent removal for DUP
      btrfs: zoned: fix stripe width calculation
      btrfs: zoned: fixup last alloc pointer after extent removal for RAID0/10

Naresh Solanki (1):
      hwmon: (max6639) : Configure based on DT property

Nathan Chancellor (1):
      ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18

Nikhil P. Rao (2):
      xsk: Fix fragment node deletion to prevent buffer leak
      xsk: Fix zero-copy AF_XDP fragment drop

Niklas Cassel (6):
      PCI: dwc: ep: Use align addr function for dw_pcie_ep_raise_{msi,msix}_irq()
      PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
      PCI: dw-rockchip: Don't wait for link since we can detect Link Up
      Revert "PCI: dw-rockchip: Don't wait for link since we can detect Link Up"
      Revert "PCI: qcom: Don't wait for link if we can detect Link Up"
      ata: libata: cancel pending work after clearing deferred_qc

Oliver Hartkopp (1):
      can: bcm: fix locking for bcm_op runtime updates

Olivier Sobrie (1):
      hwmon: (max6639) fix inverted polarity

Ovidiu Panait (1):
      net: stmmac: Fix error handling in VLAN add and delete paths

Paolo Abeni (1):
      selftests: mptcp: more stable simult_flows tests

Paulo Alcantara (1):
      smb: client: fix broken multichannel with krb5+signing

Peng Fan (2):
      mailbox: Use dev_err when there is error
      mailbox: Use guard/scoped_guard for con_mutex

Peter Wang (1):
      scsi: ufs: core: Move link recovery for hibern8 exit failure to wl_resume

Peter Zijlstra (1):
      perf: Fix __perf_event_overflow() vs perf_remove_from_context() race

Phillip Lougher (1):
      Squashfs: check metadata block offset is within range

Prithvi Tambewagh (1):
      scsi: target: Fix recursive locking in __configfs_open_file()

Qing Wang (1):
      tracing: Fix WARN_ON in tracing_buffers_mmap_close

Qu Wenruo (1):
      btrfs: always fallback to buffered write if the inode requires checksum

Raju Rangoju (2):
      amd-xgbe: fix MAC_TCR_SS register width for 2.5G and 10M speeds
      amd-xgbe: fix sleep while atomic on suspend/resume

Ricardo Ribalda (1):
      media: dw9714: Fix powerup sequence

Richard Fitzgerald (1):
      ALSA: hda: cs35l56: Fix signedness error in cs35l56_hda_posture_put()

Salomon Dushimirimana (1):
      scsi: pm8001: Fix use-after-free in pm8001_queue_command()

Sean Christopherson (1):
      KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()

Sebastian Andrzej Siewior (1):
      LoongArch/orc: Use RCU in all users of __module_address().

Sebastian Krzyszkowiak (1):
      wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config

Shawn Lin (2):
      arm64: dts: rockchip: Fix rk356x PCIe range mappings
      arm64: dts: rockchip: Fix rk3588 PCIe range mappings

Shuicheng Lin (1):
      drm/xe/reg_sr: Fix leak on xa_store failure

Shuvam Pandey (1):
      kunit: tool: copy caller args in run_kernel to prevent mutation

Stefan Hajnoczi (1):
      nvme: reject invalid pr_read_keys() num_keys values

Steven Chen (4):
      ima: rename variable the seq_file "file" to "ima_kexec_file"
      ima: define and call ima_alloc_kexec_file_buf()
      kexec: define functions to map and unmap segments
      ima: kexec: define functions to copy IMA log at soft boot

Sun Jian (1):
      selftests/harness: order TEST_F and XFAIL_ADD constructors

Sun YangKai (1):
      btrfs: fix periodic reclaim condition

Sungwoo Kim (1):
      nvme: fix memory allocation in nvme_pr_read_keys()

Takashi Iwai (4):
      ALSA: usb-audio: Cap the packet size pre-calculations
      ALSA: usb-audio: Use inclusive terms
      ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
      ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314

Thomas Gleixner (1):
      i40e: Fix preempt count leak in napi poll tracepoint

Thomas Richard (TI) (1):
      usb: cdns3: fix role switching during resume

Thomas Weißschuh (1):
      ARM: clean up the memset64() C wrapper

Thorsten Blum (3):
      drm/amdgpu: Replace kzalloc + copy_from_user with memdup_user
      platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data
      smb: client: Don't log plaintext credentials in cifs_set_cifscreds

Théo Lebrun (1):
      usb: cdns3: call cdns_power_is_lost() only once in cdns_resume()

Tiezhu Yang (3):
      LoongArch: Remove unnecessary checks for ORC unwinder
      LoongArch: Handle percpu handler address for ORC unwinder
      LoongArch: Remove some extern variables in source files

Tudor Ambarus (3):
      mailbox: don't protect of_parse_phandle_with_args with con_mutex
      mailbox: sort headers alphabetically
      mailbox: remove unused header files

Vahagn Vardanian (1):
      wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()

Victor Nogueira (1):
      net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks

Vimlesh Kumar (4):
      octeon_ep: Relocate counter updates before NAPI
      octeon_ep: avoid compiler and IQ/OQ reordering
      octeon_ep_vf: Relocate counter updates before NAPI
      octeon_ep_vf: avoid compiler and IQ/OQ reordering

Vitaly Lifshits (1):
      e1000e: clear DPG_EN after reset to avoid autonomous power-gating

Waiman Long (1):
      cgroup/cpuset: Fix incorrect use of cpuset_update_tasks_cpumask() in update_cpumasks_hier()

Wake Liu (1):
      kselftest/harness: Use helper to avoid zero-size memset warning

Wentao Liang (1):
      drm/exynos/vidi: Remove redundant error handling in vidi_get_modes()

Yang Erkun (1):
      ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT

Yazen Ghannam (1):
      x86/acpi/boot: Correct acpi_is_processor_usable() check again

Yifan Wu (1):
      selftest/arm64: Fix sve2p1_sigill() to hwcap test

Yujie Liu (1):
      drm/sched: Fix kernel-doc warning for drm_sched_job_done()

Yung Chih Su (1):
      net: ipv4: fix ARM64 alignment fault in multipath hash seed

Zhang Yi (1):
      ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O

ZhangGuoDong (2):
      smb/client: fix buffer size for smb311_posix_qinfo in smb2_compound_op()
      smb/client: fix buffer size for smb311_posix_qinfo in SMB311_posix_query_info()

Zilin Guan (1):
      media: tegra-video: Fix memory leak in __tegra_channel_try_format()

BUG=b/492704033
TEST=tryjob, validation and K8s e2e
RELEASE_NOTE=Updated the Linux kernel to v6.12.77.

Change-Id: Iec2349514015e524c728b49a1882d53ad23b08d1
Signed-off-by: COS Kernel Merge Bot <cloud-image-merge-automation@prod.google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/138001
Reviewed-by: Kevin Berry <kpberry@google.com>
Reviewed-by: Daniel Velasquez <rdvelasquez@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>