merge-upstream/v5.15.140 from branch/tag: upstream/v5.15.140 into branch: main-R105-cos-5.15

Changelog:
-------------------------------------------------------------

Ajay Singh (1):
      wifi: wilc1000: use vmm_table as array in wilc struct

Al Viro (1):
      gfs2: fix an oops in gfs2_permission

Alain Volmat (1):
      dmaengine: stm32-mdma: correct desc prep when channel running

Alex Deucher (1):
      drm/amdgpu: don't use ATRM for external devices

Alexander Sverdlin (1):
      net: dsa: lan9303: consequently nested-lock physical MDIO

Alexey Kardashevskiy (1):
      powerpc/pseries/ddw: simplify enable_ddw()

Amir Goldstein (1):
      ima: annotate iint mutex to avoid lockdep false positive warnings

Anastasia Belova (1):
      cifs: spnego: add ';' in HOST_KEY_LEN

Andreas Gruenbacher (1):
      gfs2: Silence "suspicious RCU usage in gfs2_permission" warning

Andrew Lunn (1):
      net: ethtool: Fix documentation of ethtool_sprintf()

Artem Lukyanov (1):
      Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559

Axel Lin (1):
      i2c: sun6i-p2wi: Prevent potential division by zero

Bartosz Pawlowski (2):
      PCI: Extract ATS disabling to a helper function
      PCI: Disable ATS for specific Intel IPU E2000 devices

Baruch Siach (1):
      net: stmmac: fix rx budget limit check

Bas Nieuwenhuizen (1):
      drm/amd/pm: Handle non-terminated overdrive commands.

Basavaraj Natikar (1):
      xhci: Enable RPM on controllers that support low-power states

Benjamin Bara (2):
      kernel/reboot: emergency_restart: Set correct system_state
      i2c: core: Run atomic i2c xfer when !preemptible

Billy Tsai (1):
      i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.

Bjorn Helgaas (1):
      PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk

Bob Peterson (1):
      gfs2: ignore negated quota changes

Brian Geffon (2):
      PM: hibernate: Use __get_safe_page() rather than touching the list
      PM: hibernate: Clean up sync_read handling in snapshot_write_next()

Bryan O'Donoghue (4):
      media: qcom: camss: Fix pm_domain_on sequence in probe
      media: qcom: camss: Fix vfe_get() error jump
      media: qcom: camss: Fix VFE-17x vfe_disable_output()
      media: qcom: camss: Fix missing vfe_lite clocks check

Catalin Marinas (1):
      rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects

Cezary Rojewski (1):
      ALSA: hda: Fix possible null-ptr-deref when assigning a stream

Chandan Babu R (1):
      xfs: Fix false ENOSPC when performing direct write on a delalloc extent in cow fork

Chandradeep Dey (1):
      ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC

Chandrakanth patil (1):
      scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers

Chen Yu (1):
      tools/power/turbostat: Enable the C-state Pre-wake printing

Christian König (1):
      drm/amdgpu: fix error handling in amdgpu_bo_list_get()

Christian Marangi (1):
      cpufreq: stats: Fix buffer overflow detection in trans_stats()

Chuck Lever (1):
      svcrdma: Drop connection after an RDMA Read error

ChunHao Lin (1):
      r8169: fix network lost after resume on DASH systems

Dan Carpenter (4):
      pwm: Fix double shift bug
      SUNRPC: Add an IS_ERR() check back to where it was
      netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
      mmc: vub300: fix an error code

Darren Hart (1):
      sbsa_gwdt: Calculate timeout with 64-bit math

Darrick J. Wong (8):
      xfs: refactor buffer cancellation table allocation
      xfs: don't leak xfs_buf_cancel structures when recovery fails
      xfs: convert buf_cancel_table allocation to kmalloc_array
      xfs: prevent a UAF when log IO errors race with unmount
      xfs: fix use-after-free in xattr node block inactivation
      xfs: don't leak memory when attr fork loading fails
      xfs: fix intermittent hang during quotacheck
      xfs: avoid a UAF when log intent item recovery fails

David Woodhouse (3):
      hvc/xen: fix console unplug
      hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
      hvc/xen: fix event channel handling for secondary consoles

Dmitry Antipov (3):
      wifi: mac80211_hwsim: fix clang-specific fortify warning
      wifi: ath9k: fix clang-specific fortify warnings
      wifi: ath10k: fix clang-specific fortify warning

Dominique Martinet (1):
      9p: v9fs_listxattr: fix %s null argument warning

Douglas Anderson (2):
      wifi: ath10k: Don't touch the CE interrupt registers after power up
      kgdb: Flush console before entering kgdb on panic

Dust Li (1):
      net/mlx5e: fix double free of encap_header

Ekaterina Esina (1):
      cifs: fix check of rc in function generate_smb3signingkey

Eric Biggers (1):
      quota: explicitly forbid quota files from being encrypted

Eric Dumazet (6):
      net: annotate data-races around sk->sk_tx_queue_mapping
      net: annotate data-races around sk->sk_dst_pending_confirm
      ipvlan: add ipvlan_route_v6_outbound() helper
      ptp: annotate data-race around q->head and q->tail
      bonding: stop the device in bond_setup_by_slave()
      af_unix: fix use-after-free in unix_stream_read_actor()

Finn Thain (1):
      sched/core: Optimize in_task() and in_interrupt() a bit

Florian Westphal (4):
      mptcp: diag: switch to context structure
      mptcp: listen diag dump support
      netfilter: nf_tables: use the correct get/put helpers
      netfilter: nf_tables: add and use BE register load-store helpers

Frank Li (5):
      i3c: master: svc: fix race condition in ibi work thread
      i3c: master: svc: fix wrong data return when IBI happen during start frame
      i3c: master: svc: fix ibi may not return mandatory data byte
      i3c: master: svc: fix check wrong status register in irq handler
      i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen

Frederic Weisbecker (1):
      workqueue: Provide one lock class key per work_on_cpu() callsite

Gao Xiang (1):
      xfs: add missing cmap->br_state = XFS_EXT_NORM update

Gavin Li (1):
      net/mlx5e: fix double free of encap_header in update funcs

Greg Kroah-Hartman (1):
      Linux 5.15.140

Guan Wentao (1):
      Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE

Guo Xuenan (1):
      xfs: fix exception caused by unexpected illegal bestcount in leaf dir

Gustavo A. R. Silva (1):
      clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data

Hans Verkuil (1):
      media: vivid: avoid integer overflow

Hao Sun (1):
      bpf: Fix check_stack_write_fixed_off() to correctly spill imm

Harald Freudenberger (1):
      s390/ap: fix AP bus crash on early config change callback invocation

Hardik Gajjar (1):
      usb: gadget: f_ncm: Always set current gadget in ncm_bind()

Harshit Mogalapalli (1):
      i915/perf: Fix NULL deref bugs with drm_dbg() calls

Heiko Carstens (1):
      s390/cmma: fix detection of DAT pages

Heiner Kallweit (3):
      PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
      i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
      Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"

Helge Deller (3):
      parisc/pdc: Add width field to struct pdc_model
      parisc: Prevent booting 64-bit kernels on PA1.x machines
      parisc/pgtable: Do not drop upper 5 address bits of physical address

Herve Codina (1):
      genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware

Ilpo Järvinen (7):
      RDMA/hfi1: Use FIELD_GET() to extract Link Width
      PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
      atm: iphase: Do PCI error checks on own line
      PCI: Use FIELD_GET() to extract Link Width
      media: cobalt: Use FIELD_GET() to extract Link Width
      selftests/resctrl: Remove duplicate feature check from CMT test
      selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests

Jacky Bai (1):
      clocksource/drivers/timer-imx-gpt: Fix potential memory leak

Jani Nikula (1):
      drm/msm/dp: skip validity check for DP CTS EDID checksum

Jarkko Nikula (1):
      i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler

Jarkko Sakkinen (1):
      KEYS: trusted: Rollback init_trusted() consistently

Jens Axboe (1):
      io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid

Jesse Zhang (1):
      drm/amdkfd: Fix shift out-of-bounds issue

Jian Shen (3):
      net: hns3: fix add VLAN fail issue
      net: hns3: refine the definition for struct hclge_pf_to_vf_msg
      net: hns3: fix incorrect capability bit display for copper port

Jie Wang (1):
      net: hns3: add byte order conversion for PF to VF mailbox message

Jijie Shao (2):
      net: hns3: fix VF reset fail issue
      net: hns3: fix VF wrong speed and duplex issue

Jiri Kosina (1):
      HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W

Joel Fernandes (Google) (1):
      rcu/tree: Defer setting of jiffies during stall reset

Johan Hovold (3):
      wifi: ath11k: fix temperature event locking
      wifi: ath11k: fix dfs radar event locking
      wifi: ath11k: fix htt pktlog locking

John Stultz (1):
      locking/ww_mutex/test: Fix potential workqueue corruption

Johnathan Mantey (1):
      Revert ncsi: Propagate carrier gain/loss events to the NCSI controller

Josef Bacik (1):
      btrfs: don't arbitrarily slow down delalloc if we're committing

Joshua Yeong (1):
      i3c: master: cdns: Fix reading status register

Juergen Gross (1):
      xen/events: fix delayed eoi list handling

Juntong Deng (2):
      fs/jfs: Add check for negative db_l2nbperpage
      fs/jfs: Add validity check for db_maxag and db_agpref

Kailang Yang (1):
      ALSA: hda/realtek - Add Dell ALC295 to pin fall back table

Kaixu Xia (1):
      xfs: use invalidate_lock to check the state of mmap_lock

Kathiravan Thirumoorthy (3):
      clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
      clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
      firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit

Kees Cook (1):
      randstruct: Fix gcc-plugin performance mode to stay in group

Kemeng Shi (4):
      ext4: correct offset of gdb backup in non meta_bg group to update_backups
      ext4: correct return value of ext4_convert_meta_bg
      ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
      ext4: add missed brelse in update_backups

Klaus Kudielka (1):
      net: phylink: initialize carrier state at creation

Krister Johansen (1):
      watchdog: move softlockup_panic back to early_param

Krzysztof Kozlowski (2):
      ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix
      arm64: dts: qcom: ipq6018: switch TCSR mutex to MMIO

Kumar Kartikeya Dwivedi (1):
      bpf: Detect IP == ksym.end as part of BPF program

Kunwu Chan (1):
      drm/i915: Fix potential spectre vulnerability

Lad Prabhakar (1):
      serial: meson: Use platform_get_irq() to get the interrupt

Larry Finger (2):
      bluetooth: Add device 0bda:887b to device tables
      bluetooth: Add device 13d3:3571 to device tables

Laurentiu Tudor (1):
      arm64: dts: ls208xa: use a pseudo-bus to constrain usb dma size

Lewis Huang (1):
      drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox

Li Zetao (1):
      xfs: Fix unreferenced object reported by kmemleak in xfs_sysfs_init()

Linkui Xiao (1):
      netfilter: nf_conntrack_bridge: initialize err to 0

Linus Walleij (4):
      net: ethernet: cortina: Fix max RX frame define
      net: ethernet: cortina: Handle large frames
      net: ethernet: cortina: Fix MTU max setting
      mtd: cfi_cmdset_0001: Byte swap OTP info

Lu Jialin (1):
      crypto: pcrypt - Fix hungtask for PADATA_RESET

Lukas Wunner (1):
      PCI/sysfs: Protect driver's D3cold preference from user space

Ma Ke (3):
      drm/panel: fix a possible null pointer dereference
      drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
      drm/amdgpu/vkms: fix a possible null pointer dereference

Maciej S. Szmigiero (1):
      KVM: x86: Ignore MSR_AMD64_TW_CFG access

Mahmoud Adam (1):
      nfsd: fix file memleak on client_opens_release

Manas Ghandat (2):
      jfs: fix array-index-out-of-bounds in dbFindLeaf
      jfs: fix array-index-out-of-bounds in diAlloc

Marco Elver (1):
      9p/trans_fd: Annotate data-racy writes to file::f_flags

Marek Szyprowski (1):
      media: cec: meson: always include meson sub-directory in Makefile

Mario Limonciello (2):
      drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
      drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

Mark Brown (1):
      regmap: Ensure range selector registers are updated after cache sync

Martin KaFai Lau (3):
      net: inet: Remove count from inet_listen_hashbucket
      net: inet: Open code inet_hash2 and inet_unhash2
      net: inet: Retire port only listening_hash

Masum Reza (1):
      Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables

Max Kellermann (1):
      ext4: apply umask if ACL support is disabled

Michael Ellerman (1):
      powerpc/powernv: Fix fortify source warnings in opal-prd.c

Mike Rapoport (IBM) (1):
      x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size

Mikhail Khvainitski (1):
      HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround

Mimi Zohar (1):
      ima: detect changes to the backing overlay file

Miri Korenblit (1):
      wifi: iwlwifi: Use FW rate for non-data frames

Muhammad Usama Anjum (1):
      tty/sysrq: replace smp_processor_id() with get_cpu()

Nam Cao (1):
      riscv: kprobes: allow writing to x0

Namjae Jeon (1):
      ksmbd: fix slab out of bounds write in smb_inherit_dacl()

Nathan Chancellor (1):
      arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer

Nicholas Piggin (1):
      powerpc/perf: Fix disabling BHRB and instruction sampling

Nicolas Saenz Julienne (1):
      KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space

Nitin Yadav (1):
      mmc: sdhci_am654: fix start loop index for TAP value parsing

Olga Kornievskaia (1):
      NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO

Olli Asikainen (1):
      platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e

Ondrej Jirman (1):
      drm/panel: st7703: Pick different reset sequence

Ondrej Mosnacek (2):
      lsm: fix default return value for vm_enough_memory
      lsm: fix default return value for inode_getsecctx

Pablo Neira Ayuso (2):
      netfilter: nf_tables: remove catchall element in GC sync path
      netfilter: nf_tables: split async and sync catchall in two functions

Paul Blakey (1):
      net/mlx5e: Refactor mod header management API

Paul Moore (2):
      audit: don't take task_lock() in audit_exe_compare() code path
      audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()

Pavel Krasavin (1):
      tty: serial: meson: fix hard LOCKUP on crtscts mode

Philipp Stanner (5):
      string.h: add array-wrappers for (v)memdup_user()
      kernel: kexec: copy user-array safely
      kernel: watch_queue: copy user-array safely
      drm: vmwgfx_surface.c: copy user-array safely
      i2c: dev: copy userspace array safely

Ping-Ke Shih (1):
      wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

Pratyush Yadav (1):
      media: cadence: csi2rx: Unregister v4l2 async notifier

Pu Wen (1):
      x86/cpu/hygon: Fix the CPU topology evaluation for real

Qu Huang (1):
      drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

Quinn Tran (1):
      scsi: qla2xxx: Fix system crash due to bad pointer access

Rahul Rameshbabu (1):
      net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors

Rajeshwar R Shinde (1):
      media: gspca: cpia1: shift-out-of-bounds in set_flicker

Ranjan Kumar (1):
      scsi: mpt3sas: Fix loop logic

Richard Fitzgerald (1):
      ASoC: soc-card: Add storage for PCI SSID

Robert Marko (1):
      Revert "i2c: pxa: move to generic GPIO recovery"

Roi Dayan (2):
      net/mlx5e: Remove incorrect addition of action fwd flag
      net/mlx5e: Move mod hdr allocation to a single place

Roman Gushchin (1):
      mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors

Ronald Wahl (1):
      clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware

Rong Chen (1):
      mmc: meson-gx: Remove setting of CMD_CFG_ERROR

Roxana Nicolescu (1):
      crypto: x86/sha - load modules based on CPU features

Saeed Mahameed (1):
      net/mlx5e: Reduce the size of icosq_str

Sakari Ailus (2):
      media: ccs: Fix driver quirk struct documentation
      media: ccs: Correctly initialise try compose rectangle

Sanjuán García, Jorge (1):
      mcb: fix error handling for different scenarios when parsing

Saravana Kannan (1):
      driver core: Release all resources during unbind before updating device links

Sean Young (2):
      media: lirc: drop trailing space from scancode transmit
      media: sharp: fix sharp encoding

Shigeru Yoshida (2):
      tty: Fix uninit-value access in ppp_sync_receive()
      tipc: Fix kernel-infoleak due to uninitialized TLV value

Shuai Xue (1):
      perf/core: Bail out early if the request AUX area is out of bound

Shung-Hsi Yu (1):
      bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END

Sieng-Piaw Liew (1):
      atl1c: Work around the DMA RX overflow issue

Stanislav Fomichev (1):
      net: set SOCK_RCU_FREE before inserting socket into hashtable

Stanley.Yang (1):
      drm/amdgpu: Fix potential null pointer derefernce

Steven Rostedt (Google) (2):
      tracing: Have the user copy of synthetic event address use correct context
      tracing: Have trace_event_file have ref counters

Steven Rostedt (VMware) (2):
      tracing: Reuse logic from perf's get_recursion_context()
      tracing/perf: Add interrupt_context_level() helper

Su Hui (1):
      f2fs: avoid format-overflow warning

Takashi Iwai (2):
      media: imon: fix access to invalid resource for the second interface
      ALSA: info: Fix potential deadlock at disconnection

Tam Nguyen (1):
      i2c: designware: Disable TX_EMPTY irq while waiting for block length byte

Tony Lindgren (1):
      ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings

Trond Myklebust (1):
      SUNRPC: ECONNRESET might require a rebind

Tyrel Datwyler (1):
      scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool

Uwe Kleine-König (3):
      PCI: exynos: Don't discard .remove() callback
      PCI: keystone: Don't discard .remove() callback
      PCI: keystone: Don't discard .probe() callback

Vasily Khoruzhick (1):
      ACPI: FPDT: properly handle invalid FPDT subtables

Vicki Pfau (1):
      Input: xpad - add VID for Turtle Beach controllers

Victor Shih (2):
      mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2
      mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER

Vignesh Viswanathan (2):
      arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
      arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size

Vikash Garodia (4):
      media: venus: hfi: add checks to perform sanity on queue pointers
      media: venus: hfi_parser: Add check to keep the number of codecs within range
      media: venus: hfi: fix the check to handle session buffer requirement
      media: venus: hfi: add checks to handle capabilities from firmware

Vincent Whitchurch (1):
      ARM: 9320/1: fix stack depot IRQ stack filter

Vitaly Prosyak (1):
      drm/amdgpu: fix software pci_unplug on some chips

Vlad Buslov (2):
      net/mlx5e: Fix pedit endianness
      macvlan: Don't propagate promisc change to lower dev in passthru

Wayne Lin (1):
      drm/amd/display: Avoid NULL dereference of timing generator

Wenchao Hao (1):
      scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

Wenjing Liu (1):
      drm/amd/display: use full update for clip size increase of large plane source

Werner Sembach (1):
      ACPI: resource: Do IRQ override on TongFang GMxXGxx

Willem de Bruijn (1):
      ppp: limit MRU to 64K

Xiaogang Chen (1):
      drm/amdkfd: Fix a race condition of vram buffer unref in svm code

Yi Yang (1):
      tty: vcc: Add check for kstrdup() in vcc_probe()

Yihang Li (1):
      scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs

Yonglong Liu (2):
      net: hns3: add barrier in vf mailbox reply process
      net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()

Yoshihiro Shimoda (1):
      misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller

Yuezhang Mo (1):
      exfat: support handle zero-size directory

Zeng Heng (1):
      xfs: fix memory leak in xfs_errortag_init

Zhang Rui (1):
      tools/power/turbostat: Fix a knl bug

Zhang Yi (2):
      xfs: flush inode gc workqueue before clearing agi bucket
      ext4: correct the start block of counting reserved clusters

ZhengHan Wang (1):
      Bluetooth: Fix double free in hci_conn_cleanup

Zhihao Cheng (1):
      jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev

Zi Yan (2):
      mm/cma: use nth_page() in place of direct struct page manipulation
      mm/memory_hotplug: use pfn math in place of direct struct page manipulation

Zongmin Zhou (1):
      drm/qxl: prevent memory leak

baozhu.liu (1):
      drm/komeda: drop all currently held locks if deadlock happens

felix (1):
      SUNRPC: Fix RPC client cleaned up the freed pipefs dentries

hexiaole (1):
      xfs: fix inode reservation space for removing transaction

youwan Wang (1):
      Bluetooth: btusb: Add date->evt_skb is NULL check

zhenwei pi (1):
      virtio-blk: fix implicit overflow on virtio_max_dma_size

zhujun2 (1):
      selftests/efivarfs: create-read: fix a resource leak

BUG=b/313823646
TEST=tryjob, validation and K8s e2e
RELEASE_NOTE=Updated the Linux kernel to v5.15.140.

Change-Id: I84287f50845fce3ca9ef3e9794786d071399b3fe
Signed-off-by: COS Kernel Merge Bot <cloud-image-merge-automation@prod.google.com>