Merge tag 'ASB-2025-06-05_11-5.4' of...

Merge tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

https://source.android.com/docs/security/bulletin/2025-06-01

* tag 'ASB-2025-06-05_11-5.4' of https://android.googlesource.com/kernel/common:
  ANDROID: binder: fix minimum node priority comparison
  ANDROID: 16K: Remove ELF padding entry from map_file ranges
  Linux 5.4.293
  MIPS: cm: Fix warning if MIPS_CM is disabled
  crypto: atmel-sha204a - Set hwrng quality to lowest possible
  comedi: jr3_pci: Fix synchronous deletion of timer
  md/raid1: Add check for missing source disk in process_checks()
  scsi: pm80xx: Set phy_attached to zero when device is gone
  x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline
  ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls
  selftests: ublk: fix test_stripe_04
  udmabuf: fix a buf size overflow issue during udmabuf creation
  KVM: s390: Don't use %pK through tracepoints
  sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP
  ntb: reduce stack usage in idt_scan_mws
  qibfs: fix _another_ leak
  usb: gadget: aspeed: Add NULL pointer check in ast_vhub_init_dev()
  dmaengine: dmatest: Fix dmatest waiting less when interrupted
  usb: host: max3421-hcd: Add missing spi_device_id table
  parisc: PDT: Fix missing prototype warning
  clk: check for disabled clock-provider in of_clk_get_hw_from_clkspec()
  crypto: null - Use spin lock instead of mutex
  MIPS: cm: Detect CM quirks from device tree
  USB: VLI disk crashes if LPM is used
  usb: quirks: Add delay init quirk for SanDisk 3.2Gen1 Flash Drive
  usb: quirks: add DELAY_INIT quirk for Silicon Motion Flash Drive
  usb: dwc3: gadget: check that event count does not exceed event buffer length
  USB: OHCI: Add quirk for LS7A OHCI controller (rev 0x02)
  usb: cdns3: Fix deadlock when using NCM gadget
  USB: serial: simple: add OWON HDS200 series oscilloscope support
  USB: serial: option: add Sierra Wireless EM9291
  USB: serial: ftdi_sio: add support for Abacus Electrics Optical Probe
  serial: sifive: lock port in startup()/shutdown() callbacks
  USB: storage: quirk for ADATA Portable HDD CH94
  mcb: fix a double free bug in chameleon_parse_gdd()
  virtio_console: fix missing byte order handling for cols and rows
  net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
  net_sched: hfsc: Fix a UAF vulnerability in class handling
  tipc: fix NULL pointer dereference in tipc_mon_reinit_self()
  net: phy: leds: fix memory leak
  cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
  drm/amd/pm: Prevent division by zero
  misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error
  misc: pci_endpoint_test: Use INTX instead of LEGACY
  PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX
  iio: adc: ad7768-1: Fix conversion result sign
  iio: adc: ad7768-1: Move setting of val a bit later to avoid unnecessary return value check
  net: dsa: mv88e6xxx: fix VTU methods for 6320 family
  media: vim2m: print device name after registering device
  ext4: fix OOB read when checking dotdot dir
  ext4: optimize __ext4_check_dir_entry()
  ext4: don't over-report free space or inodes in statvfs
  ext4: code cleanup for ext4_statfs_project()
  ext4: simplify checking quota limits in ext4_statfs()
  platform/x86: ISST: Correct command storage data length
  MIPS: ds1287: Match ds1287_set_base_clock() function types
  MIPS: cevt-ds1287: Add missing ds1287.h include
  MIPS: dec: Declare which_prom() as static
  virtio-net: Add validation for used length
  RDMA/srpt: Support specifying the srpt_service_guid parameter
  openvswitch: fix lockup on tx to unregistering netdev with carrier
  net: openvswitch: fix race on port output
  mmc: cqhci: Fix checking of CQHCI_HALT state
  nvmet-fc: Remove unused functions
  usb: dwc3: support continuous runtime PM with dual role
  misc: pci_endpoint_test: Fix 'irq_type' to convey the correct type
  misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error
  tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
  powerpc/prom_init: Use -ffreestanding to avoid a reference to bcmp
  kbuild: Add '-fno-builtin-wcslen'
  cpufreq: Reference count policy in cpufreq_update_limits()
  drm/sti: remove duplicate object names
  drm/nouveau: prime: fix ttm_bo_delayed_delete oops
  drm/repaper: fix integer overflows in repeat functions
  module: sign with sha512 instead of sha1 by default
  perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR
  perf/x86/intel: Allow to update user space GPRs from PEBS records
  virtiofs: add filesystem context source name check
  riscv: Avoid fortify warning in syscall_get_arguments()
  isofs: Prevent the use of too small fid
  i2c: cros-ec-tunnel: defer probe if parent EC is not present
  hfs/hfsplus: fix slab-out-of-bounds in hfs_bnode_read_key
  btrfs: correctly escape subvol in btrfs_show_options()
  nfs: add missing selections of CONFIG_CRC32
  nfs: move nfs_fhandle_hash to common include file
  NFSD: Constify @fh argument of knfsd_fh_hash()
  asus-laptop: Fix an uninitialized variable
  writeback: fix false warning in inode_to_wb()
  net: b53: enable BPDU reception for management port
  net: openvswitch: fix nested key length validation in the set() action
  Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
  Bluetooth: btrtl: Prevent potential NULL dereference
  Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address
  RDMA/usnic: Fix passing zero to PTR_ERR in usnic_ib_pci_probe()
  scsi: iscsi: Fix missing scsi_host_put() in error path
  wifi: wl1251: fix memory leak in wl1251_tx_work
  wifi: mac80211: Purge vif txq in ieee80211_do_stop()
  wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()
  wifi: at76c50x: fix use after free access in at76_disconnect
  HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
  pwm: mediatek: always use bus clock for PWM on MT7622
  Bluetooth: hci_uart: Fix another race during initialization
  x86/e820: Fix handling of subpage regions when calculating nosave ranges in e820__register_nosave_regions()
  PCI: Fix reference leak in pci_alloc_child_bus()
  of/irq: Fix device node refcount leakages in of_irq_init()
  of/irq: Fix device node refcount leakage in API irq_of_parse_and_map()
  of/irq: Fix device node refcount leakages in of_irq_count()
  ntb: use 64-bit arithmetic for the MSI doorbell mask
  gpio: zynq: Fix wakeup source leaks on device unbind
  ftrace: Add cond_resched() to ftrace_graph_set_hash()
  dm-integrity: set ti->error on memory allocation failure
  crypto: ccp - Fix check for the primary ASP device
  thermal/drivers/rockchip: Add missing rk3328 mapping entry
  sctp: detect and prevent references to a freed transport in sendmsg
  mm: add missing release barrier on PGDAT_RECLAIM_LOCKED unlock
  sparc/mm: disable preemption in lazy mmu mode
  arm64: dts: mediatek: mt8173: Fix disp-pwm compatible string
  mtd: rawnand: Add status chack in r852_ready()
  mtd: inftlcore: Add error check for inftl_read_oob()
  lib: scatterlist: fix sg_split_phys to preserve original scatterlist offsets
  locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()
  jbd2: remove wrong sb->s_sequence check
  i3c: Add NULL pointer check in i3c_master_queue_ibi()
  ext4: fix off-by-one error in do_split
  wifi: mac80211: fix integer overflow in hwmp_route_info_get()
  net: dsa: mv88e6xxx: workaround RGMII transmit delay erratum for 6320 family
  media: venus: hfi_parser: add check to avoid out of bound access
  media: i2c: ov7251: Introduce 1 ms delay between regulators and en GPIO
  media: i2c: ov7251: Set enable GPIO low in probe
  media: v4l2-dv-timings: prevent possible overflow in v4l2_detect_gtf()
  media: streamzap: prevent processing IR data on URB failure
  mtd: rawnand: brcmnand: fix PM resume warning
  arm64: cputype: Add MIDR_CORTEX_A76AE
  xenfs/xensyms: respect hypervisor's "next" indication
  media: siano: Fix error handling in smsdvb_module_init()
  media: venus: hfi: add check to handle incorrect queue size
  media: venus: hfi: add a check to handle OOB in sfr region
  media: i2c: adv748x: Fix test pattern selection mask
  ext4: don't treat fhandle lookup of ea_inode as FS corruption
  ext4: reject casefold inode flag without casefold feature
  bpf: support SKF_NET_OFF and SKF_LL_OFF on skb frags
  bpf: Add endian modifiers to fix endian warnings
  pwm: fsl-ftm: Handle clk_get_rate() returning 0
  pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()
  pwm: mediatek: Always use bus clock
  fbdev: omapfb: Add 'plane' value check
  drm/mediatek: mtk_dpi: Explicitly manage TVD clock in power on/off
  drm/amdkfd: Fix pqm_destroy_queue race with GPU reset
  drm/amdkfd: clamp queue size to minimum
  drm: panel-orientation-quirks: Add new quirk for GPD Win 2
  drm: panel-orientation-quirks: Add support for AYANEO 2S
  drm: allow encoder mode_set even when connectors change for crtc
  Bluetooth: hci_uart: fix race during initialization
  tracing: fix return value in __ftrace_event_enable_disable for TRACE_REG_UNREGISTER
  net: vlan: don't propagate flags on open
  wifi: mt76: mt76x2u: add TP-Link TL-WDN6200 ID to device table
  scsi: st: Fix array overflow in st_setup()
  ext4: ignore xattrs past end
  ext4: protect ext4_release_dquot against freezing
  ahci: add PCI ID for Marvell 88SE9215 SATA Controller
  ata: libata-eh: Do not use ATAPI DMA for a device limited to PIO mode
  jfs: add sanity check for agwidth in dbMount
  jfs: Prevent copying of nlink with value 0 from disk inode
  fs/jfs: Prevent integer overflow in AG size calculation
  fs/jfs: cast inactags to s64 to prevent potential overflow
  page_pool: avoid infinite loop to schedule delayed worker
  ALSA: usb-audio: Fix CME quirk for UF series keyboards
  ALSA: hda: intel: Fix Optimus when GPU has no sound
  HID: pidff: Fix null pointer dereference in pidff_find_fields
  HID: pidff: Do not send effect envelope if it's empty
  HID: pidff: Convert infinite length from Linux API to PID standard
  xen/mcelog: Add __nonstring annotations for unterminated strings
  perf: arm_pmu: Don't disable counter in armpmu_add()
  x86/cpu: Don't clear X86_FEATURE_LAHF_LM flag in init_amd_k8() on AMD when running in a virtual machine
  pm: cpupower: bench: Prevent NULL dereference on malloc failure
  net: ppp: Add bound checking for skb data on ppp_sync_txmung
  ata: sata_sx4: Add error handling in pdc20621_i2c_read()
  ata: sata_sx4: Drop pointless VPRINTK() calls and convert the remaining ones
  tipc: fix memory leak in tipc_link_xmit
  ata: pata_pxa: Fix potential NULL pointer dereference in pxa_ata_probe()

 Conflicts:
	arch/arm64/include/asm/cputype.h
	drivers/usb/core/quirks.c
	drivers/usb/dwc3/gadget.c

Change-Id: Ie734fa9555f5cdd3575d8b29f71ab946102b5f84