Merge tag 'android11-5.4.276_r00' into android11-5.4

This merges the 5.4.276 LTS release into android11-5.4.  Included in
here are the following commits:

*   7b99a729 Merge 5.4.276 into android11-5.4-lts
|\
| * 24d2be37 Linux 5.4.276
| * ef9ea1c4 pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback
| * 20c17102 pinctrl: mediatek: remove set but not used variable 'e'
| * fa812e30 pinctrl: mediatek: Fix some off by one bugs
| * 1c86f75d pinctrl: mediatek: Fix fallback behavior for bias_set_combo
| * 3bbbcafb regulator: core: fix debugfs creation regression
| * 7b0e6458 net: fix out-of-bounds access in ops_init
| * cef0962f drm/vmwgfx: Fix invalid reads in fence signaled events
| * 343081c2 dyndbg: fix old BUG_ON in >control parser
| * 93bc2d6d tipc: fix UAF in error path
| * 77e49fb4 usb: gadget: f_fs: Fix a race condition when processing setup packets.
| * 567fed8d usb: gadget: composite: fix OS descriptors w_value logic
| * 7b8c7bd2 firewire: nosy: ensure user_length is taken into account when fetching packet contents
| * e44d4063 net: qede: use return from qede_parse_flow_attr() for flower
| * e4bb83fb net: qede: sanitize 'rc' in qede_add_tc_flower_fltr()
| * ddec23f2 ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()
| * 2c110b45 net: bridge: fix corrupted ethernet header on multicast-to-unicast
| * dc6beac0 phonet: fix rtm_phonet_notify() skb allocation
| * 5e7ef2d8 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
| * 6466ee65 Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
| * 3212afd0 Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
| * 1796ca9c tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().
| * ed5e279b tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets
| * 810e964d xfrm: Preserve vlan tags for transport mode software GRO
| * 4cc43efc pinctrl: mediatek: Fix fallback call path
| * d23431fc net:usb:qmi_wwan: support Rolling modules
| * 69a0fae3 fs/9p: drop inodes immediately on non-.L too
| * b1877285 clk: Don't hold prepare_lock when calling kref_put()
| * e29234b7 gpio: crystalcove: Use -ENOTSUPP consistently
| * aa4df1ee gpio: wcove: Use -ENOTSUPP consistently
| * f633cf1d 9p: explicitly deny setlease attempts
| * 09335c69 fs/9p: translate O_TRUNC into OTRUNC
| * df1962a1 fs/9p: only translate RWX permissions for plain 9P2000
| * 19e8d8df selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior
| * 43efb3f0 MIPS: scall: Save thread_info.syscall unconditionally on entry
| * 2cd614ba gpu: host1x: Do not setup DMA for virtual devices
| * a6601878 scsi: target: Fix SELinux error when systemd-modules loads the target module
| * e52f7c2d btrfs: always clear PERTRANS metadata during commit
| * 50fe716c btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve
| * 0ef9d9c3 tools/power turbostat: Fix Bzy_MHz documentation typo
| * ab1931d6 tools/power turbostat: Fix added raw MSR output
| * 31279bbc firewire: ohci: mask bus reset interrupts between ISR and bottom half
| * 63f6a1a4 ata: sata_gemini: Check clk_enable() result
| * c0edb679 net: bcmgenet: Reset RBUF on first open
| * 909859ed ALSA: line6: Zero-initialize message buffers
| * acd370c1 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload
| * ea668eff net: mark racy access on sk->sk_rcvbuf
| * 5492c86d wifi: cfg80211: fix rdev_dump_mpp() arguments order
| * e394ea8a wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc
| * a93f5806 gfs2: Fix invalid metadata access in punch_hole
| * 2ffd47de scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic
| * fe11826f clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change
| * 2f87fd94 tipc: fix a possible memleak in tipc_buf_append
| * 4945c046 net: bridge: fix multicast-to-unicast with fraglist GSO
| * 37a067e2 net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341
| * c82ac8fb net: dsa: mv88e6xxx: Add number of MACs in the ATU
| * 049b4d10 net: qede: use return from qede_parse_flow_attr() for flow_spec
| * 8155d5a5 net l2tp: drop flow hash on forward
| * 46134031 nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().
| * 80578ec1 bna: ensure the copied buf is NUL terminated
| * 74f677ab s390/mm: Fix clearing storage keys for huge pages
| * 8e63d2ba s390/mm: Fix storage key clearing for guest huge pages
| * 47d253c4 pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
| * 8ade2092 power: rt9455: hide unused rt9455_boost_voltage_values
| * b33ca18c nfs: Handle error of rpc_proc_register() in nfs_net_init().
| * 19f51adc nfs: make the rpc_stat per net namespace
| * 31dd0cda nfs: expose /proc/net/sunrpc/nfs in net namespaces
| * 0ce85909 sunrpc: add a struct rpc_stats arg to rpc_create_args
| * 54834d07 pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE
| * 43fa2f6b pinctrl: mediatek: paris: Rework mtk_pinconf_{get,set} switch/case logic
| * 8840d7ff pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback
| * b0639130 pinctrl: mediatek: remove shadow variable declaration
| * 79be366d pinctrl: mediatek: Backward compatible to previous Mediatek's bias-pull usage
| * 20ea2b1e pinctrl: mediatek: Refine mtk_pinconf_get()
| * 22fddbac pinctrl: mediatek: Refine mtk_pinconf_get() and mtk_pinconf_set()
| * 3d7b213d pinctrl: mediatek: Supporting driving setting without mapping current to register value
| * 61754e33 pinctrl: mediatek: Check gpio pin number and use binary search in mtk_hw_pin_field_lookup()
| * cdaa1714 pinctrl: core: delete incorrect free in pinctrl_enable()
| * 97792d06 wifi: nl80211: don't free NULL coalescing rule
| * 3762017c dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"
| * 6e23e7e3 dmaengine: pl330: issue_pending waits until WFP state
* | b9e6f923 Revert "clk: Get runtime PM before walking tree during disable_unused"
* | 65d89570 Merge 5.4.275 into android11-5.4-lts
|/
* 936e689e Linux 5.4.275
* 7ae3c1fb serial: core: fix kernel-doc for uart_port_unlock_irqrestore()
* 06fdb177 udp: preserve the connected status if only UDP cmsg
* 86f4a49f dm: limit the number of targets and parameter size area
* d34a516f bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
* c448a9fd HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up
* ad3c3ac7 i2c: smbus: fix NULL function pointer dereference
* 65a241aa idma64: Don't try to serve interrupts when device is powered off
* abfe16c8 dmaengine: owl: fix register access functions
* fc5bb101 tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
* 53fab9ce tcp: Clean up kernel listener's reqsk in inet_twsk_purge()
* 672c5715 mtd: diskonchip: work around ubsan link failure
* 7d3996c7 stackdepot: respect __GFP_NOLOCKDEP allocation flag
* 90be0c77 net: b44: set pause params only when interface is up
* 53c9574b ethernet: Add helper for assigning packet type when dest address does not match device address
* b72d2b14 irqchip/gic-v3-its: Prevent double free on error
* 851a52eb drm/amdgpu: Fix leak when GPU memory allocation fails
* 21722c0b arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma
* 73db209d btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
* 34497277 Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853
* 9c25b429 Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()
* 049f36ee tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together
* 92e64e26 tracing: Show size of requested perf buffer
* c9e38f7a net/mlx5e: Fix a race in command alloc flow
* 62c724e5 Revert "crypto: api - Disallow identical driver names"
* f6803937 drm/amdgpu: validate the parameters of bo mapping operations more clearly
* d83c337e amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
* 3b418dca drm/amdgpu: restrict bo mapping within gpu address limits
* 21535ef0 serial: mxs-auart: add spinlock around changing cts state
* e8646f5d serial: core: Provide port lock wrappers
* eb27704f af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
* 4077b864 iavf: Fix TC config comparison with existing adapter TC config
* 546d0fe9 i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
* 51cefc9d mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work
* 0b2c13b6 mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
* 0b886318 mlxsw: spectrum_acl_tcam: Fix warning during rehash
* c6f3fa7f mlxsw: spectrum_acl_tcam: Fix memory leak during rehash
* a43a0423 mlxsw: spectrum_acl_tcam: Rate limit error message
* e118e7ea mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
* 1b73f6e4 mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update
* 40bdd69f mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work
* 589523cf net: openvswitch: Fix Use-After-Free in ovs_ct_exit
* 3606e77b ipvs: Fix checksumming on GSO of SCTP packets
* 718df1bc net: gtp: Fix Use-After-Free in gtp_dellink
* b51177e4 net: usb: ax88179_178a: stop lying about skb->truesize
* 380bf477 NFC: trf7970a: disable all regulators on removal
* 42de7aa3 mlxsw: core: Unregister EMAD trap using FORWARD action
* 51cf144f vxlan: drop packets from invalid src-address
* ef3c87d5 ARC: [plat-hsdk]: Remove misplaced interrupt-cells property
* 8378341b arm64: dts: mediatek: mt2712: fix validation errors
* 8f70bcc8 arm64: dts: mt2712: add ethernet device node
* 73556b21 arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block
* 1e4ce3ba arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"
* dcc04db7 arm64: dts: mediatek: mt7622: fix IR nodename
* 55f3e91e arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma
* 2d7d8094 arm64: dts: rockchip: fix alphabetical ordering RK3399 puma
* 7dc6e67f KVM: async_pf: Cleanup kvm_setup_async_pf()
* 90f43980 nilfs2: fix OOB in nilfs_set_de_type
* 1bc4825d nouveau: fix instmem race condition around ptr stores
* 57baab0f fs: sysfs: Fix reference leak in sysfs_break_active_protection()
* 8f6b6212 speakup: Avoid crash on very long word
* c64704f0 usb: Disable USB3 LPM at shutdown
* 75bf5e78 usb: dwc2: host: Fix dereference issue in DDMA completion flow.
* 164be0a8 Revert "usb: cdc-wdm: close race between read and workqueue"
* 11a3e5c7 USB: serial: option: add Telit FN920C04 rmnet compositions
* 3a7fca20 USB: serial: option: add Rolling RW101-GL and RW135-GL support
* 386fb39e USB: serial: option: support Quectel EM060K sub-models
* 12248185 USB: serial: option: add Lonsung U8300/U9300 product
* 8e5ddf4a USB: serial: option: add support for Fibocom FM650/FG650
* fc693ec1 USB: serial: option: add Fibocom FM135-GL variants
* d679c816 serial/pmac_zilog: Remove flawed mitigation for rx irq flood
* a3b8ae7e comedi: vmk80xx: fix incomplete endpoint checking
* 68a28f55 binder: check offset alignment in binder_get_object()
* 58ecead1 x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ
* 253ab38d clk: Get runtime PM before walking tree during disable_unused
* 8cf77c61 clk: Initialize struct clk_core kref earlier
* 1d09f800 clk: Print an info line before disabling unused clocks
* 25ce8c71 clk: remove extra empty line
* fdd3437c clk: Mark 'all_lists' as const
* b9ef935c clk: Remove prepare_lock hold assertion in __clk_release()
* 5050ae87 drm: nv04: Fix out of bounds access
* 4b1930bd RDMA/mlx5: Fix port number for counter query in multi-port configuration
* 80997511 RDMA/rxe: Fix the problem "mutex_destroy missing"
* 4b0dcae5 tun: limit printing rate when illegal packet received by tun dev
* b38a133d netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
* 2450a69d Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"
* 93eb31e7 kprobes: Fix possible use-after-free issue on kprobe registration
* 49cacd34 selftests/ftrace: Limit length in subsystem-enable tests
* 14b74fc2 btrfs: record delayed inode root in transaction
* b282473a x86/apic: Force native_apic_mem_read() to use the MOV instruction
* ed180e21 selftests: timers: Fix abs() warning in posix_timers test
* 5fd4f814 vhost: Add smp_rmb() in vhost_vq_avail_empty()
* 5a2f957e drm/client: Fully protect modes[] with dev->mode_config.mutex
* 70040ce9 btrfs: qgroup: correctly model root qgroup rsv in convert
* 1cb6c82d net: ena: Fix potential sign extension issue
* 343c5372 af_unix: Fix garbage collector racing against connect()
* 7f4c391d af_unix: Do not use atomic ops for unix_sk(sk)->inflight.
* 1263b0b2 net/mlx5: Properly link new fs rules into the tree
* cca606e1 ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
* 3af3f21d ipv4/route: avoid unused-but-set-variable warning
* e9f4cfe4 ipv6: fib: hide unused 'pn' variable
* d3adf11d geneve: fix header validation in geneve[6]_xmit_skb
* 2f755176 u64_stats: fix u64_stats_init() for lockdep when used repeatedly in one file
* e7d818b8 net: openvswitch: fix unwanted error log on timeout policy probing
* ccabbf1d nouveau: fix function cast warning
* 4beab84f Bluetooth: Fix memory leak in hci_req_sync_complete()
* b3ddf690 batman-adv: Avoid infinite loop trying to resize local TT

Change-Id: Ic74fa9cbcfafb5458436712aba76731401e099a3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>