Merge tag 'android11-5.4.286_r00' into android11-5.4

This catches the android11-5.4 branch up to the 5.4.286 LTS release.
Changes merged here are:

* 3871647e Revert "spi: Fix deadlock when adding SPI controllers on SPI buses"
* a1434939 Revert "spi: fix use-after-free of the add_lock mutex"
*   da1a7795 Merge 5.4.286 into android11-5.4-lts
|\
| * cd5b619a Linux 5.4.286
| * 3213fdca mm: avoid leaving partial pfn mappings around in error case
| * cfb280cc 9p: fix slab cache name creation for real
| * b97a50ad mm: add remap_pfn_range_notrack
| * 00106a04 mm/memory.c: make remap_pfn_range() reject unaligned addr
| * e681c830 mm: fix ambiguous comments for better code readability
| * 31ccf3b4 mm: clarify a confusing comment for remap_pfn_range()
| * 882e4c6a md/raid10: improve code of mrdev in raid10_sync_request
| * 8bb1d617 net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
| * 17ecb40c fs: Fix uninitialized value issue in from_kuid and from_kgid
| * 45eadf46 powerpc/powernv: Free name on error in opal_event_init()
| * 1fe7d27e sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
| * c868a06a bpf: use kvzmalloc to allocate BPF verifier environment
| * a8a1c7fe HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
| * 9c28c5ed 9p: Avoid creating multiple slab caches with the same name
| * fae6fcef ALSA: usb-audio: Add endianness annotations
| * fd8ae346 vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
| * 4fe1d42f hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
| * eea46baf ftrace: Fix possible use-after-free issue in ftrace_location()
| * 52300eb1 NFSD: Fix NFSv4's PUTPUBFH operation
| * 56fa2e5d ALSA: usb-audio: Add quirks for Dell WD19 dock
| * a19f12b5 ALSA: usb-audio: Support jack detection on Dell dock
| * 168a9b83 ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove()
| * 8cdb2d07 irqchip/gic-v3: Force propagation of the active state with a read-back
| * 2f29a9fb USB: serial: option: add Quectel RG650V
| * 02fcc5cd USB: serial: option: add Fibocom FG132 0x0112 composition
| * 853fffe7 USB: serial: qcserial: add support for Sierra Wireless EM86xx
| * 39709ce9 USB: serial: io_edgeport: fix use after free in debug printk
| * 4aa77d5e usb: musb: sunxi: Fix accessing an released usb phy
| * a1be63b9 fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
| * 684022f8 media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
| * b2b7c43c net: bridge: xmit: make sure we have at least eth header len bytes
| * 54c2c96e spi: fix use-after-free of the add_lock mutex
| * aa3f3d7b spi: Fix deadlock when adding SPI controllers on SPI buses
| * fb77ce71 mtd: rawnand: protect access to rawnand devices while in suspend
| * 93c5b8de btrfs: reinitialize delayed ref list after deleting it from the list
| * bbfcd261 nfs: Fix KMSAN warning in decode_getfattr_attrs()
| * 95da52fb dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow
| * 2222b092 dm cache: fix potential out-of-bounds access on the first resume
| * 8c3400a7 dm cache: optimize dirty bit checking with find_next_bit when resizing
| * 8501e38d dm cache: fix out-of-bounds access to the dirty bitset when resizing
| * a45d7856 dm cache: correct the number of origin blocks to match the target length
| * 8d7a28ec drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
| * 7ccd7817 drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
| * f1d086c9 pwm: imx-tpm: Use correct MODULO value for EPWM mode
| * 0bfc6e38 media: v4l2-tpg: prevent the risk of a division by zero
| * cad97ca8 media: cx24116: prevent overflows on SNR calculus
| * e5117f6e media: s5p-jpeg: prevent buffer overflows
| * 2df76b10 ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
| * 31e562e5 media: adv7604: prevent underflow condition when reporting colorspace
| * 5b389fe1 media: dvb_frontend: don't play tricks with underflow values
| * 3b88675e media: dvbdev: prevent the risk of out of memory access
| * 39023c18 media: stb0899_algo: initialize cfr before using it
| * 7ae4e56d net: hns3: fix kernel crash when uninstalling driver
| * 83b3b73a can: c_can: fix {rx,tx}_errors statistics
| * 9b5d42ae sctp: properly validate chunk size in sctp_sf_ootb()
| * 4d846b36 net: enetc: set MAC address to the VF net_device
| * 98394cf6 enetc: simplify the return expression of enetc_vf_set_mac_addr()
| * 4efb69a0 security/keys: fix slab-out-of-bounds in key_task_permission
| * 3f9e88f2 HID: core: zero-initialize the report buffer
| * 1e635487 ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
| * 18f4ca39 ARM: dts: rockchip: Fix the spi controller on rk3036
| * a10fa562 ARM: dts: rockchip: drop grf reference from rk3036 hdmi
| * 43b8d986 ARM: dts: rockchip: fix rk3036 acodec node
| * 27873e99 arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
| * b57072b8 arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
| * 8d258ec8 arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
| * 282a6ed2 arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-excavator
* | bc1dcc54 Revert "genetlink: hold RCU in genlmsg_mcast()"
* | 9d6ed89e Revert "arm64: probes: Fix uprobes for big-endian kernels"
* | 73ec729f Revert "arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning"
* | 39666daa Revert "inet: inet_defrag: prevent sk release while still in use"
* | 94424b0f Merge 5.4.285 into android11-5.4-lts
|\|
| * 6b8cbbd5 Linux 5.4.285
| * 8ebee756 mm: krealloc: Fix MTE false alarm in __do_krealloc
| * c6ab9679 mac80211: always have ieee80211_sta_restart()
| * dc794e87 vt: prevent kernel-infoleak in con_font_get()
| * 7e948e45 Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device"
| * 7cc30ada mm: shmem: fix data-race in shmem_getattr()
| * 64afad73 nilfs2: fix kernel bug due to missing clearing of checked flag
| * 95fbed8a ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
| * 23669f18 riscv: Remove unused GENERATING_ASM_OFFSETS
| * a1686db1 nilfs2: fix potential deadlock with newly created symlinks
| * fcd6b59f staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
| * 9d89941e wifi: iwlegacy: Clear stale interrupts before resuming device
| * 6fc9af3d wifi: ath10k: Fix memory leak in management tx
| * 78b698fb wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
| * d4dba9a0 Revert "driver core: Fix uevent_show() vs driver detach race"
| * b115ecd0 xhci: Fix Link TRB DMA in command ring stopped completion event
| * ceb2f3fe usb: phy: Fix API devm_usb_put_phy() can not release the phy
| * aaa1b283 usbip: tools: Fix detach_port() invalid port error path
| * d54dad3a misc: sgi-gru: Don't disable preemption in GRU driver
| * 57aabb8c net: amd: mvme147: Fix probe banner message
| * 14b6ca78 firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
| * 3c220670 drivers/misc: ti-st: Remove unneeded variable in st_tty_open
| * ac7df3fc netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
| * 477b35d9 net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
| * 5715da54 net: support ip generic csum processing in skb_csum_hwoffload_help
| * 91afbc0e bpf: Fix out-of-bounds write in trie_get_next_key()
| * dbe778b0 net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
| * 2bb69ce7 gtp: allow -1 to be specified as file description from userspace
| * 5f6907bf gtp: simplify error handling code in 'gtp_encap_enable()'
| * c593895b dt-bindings: gpu: Convert Samsung Image Rotator to dt-schema
| * b2ed38ff ASoC: cs42l51: Fix some error handling paths in cs42l51_probe()
| * 9c98ee7e wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
| * 8b30a66a wifi: iwlwifi: mvm: disconnect station vifs if recovery failed
| * 130b34a2 mac80211: Add support to trigger sta disconnect on hardware restart
| * 0a2112ed mac80211: do drv_reconfig_complete() before restarting all
| * e67cb5a1 wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
| * 4f3e9217 cgroup: Fix potential overflow issue when checking max_depth
| * 401ad99a xfrm: validate new SA's prefixlen using SA family when sel.family is unset
| * 9085d7ea arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
| * 5121ac67 selinux: improve error checking in sel_write_load()
| * 31a38a90 hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
| * ae95e023 ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593
| * 412a30b1 nilfs2: fix kernel bug due to missing clearing of buffer delay flag
| * 507f3934 ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
| * 0fdb5037 ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[]
| * 43b4fa6e drm/amd: Guard against bad data for ATIF ACPI method
| * 4cab98a1 ALSA: hda/realtek: Update default depop procedure
| * d5754143 ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
| * a8219446 posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
| * 6e2bbba8 r8169: avoid unsolicited interrupts
| * 2f868ce6 net: sched: fix use-after-free in taprio_change()
| * 9fc566df net: usb: usbnet: fix name regression
| * 6b7ce8ee be2net: fix potential memory leak in be_xmit()
| * 8d5b20fb net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
| * 5e3231b3 tracing: Consider the NULL character when validating the event length
| * 8bbfbf68 jfs: Fix sanity check in dbMount
| * 417bd613 udf: fix uninit-value use in udf_get_fileshortad
| * 02c86c5d drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
| * c491ce22 KVM: s390: gaccess: Check if guest address is in memslot
| * f334578c KVM: s390: gaccess: Cleanup access to guest pages
| * 8a2e8829 KVM: s390: gaccess: Refactor access address range check
| * f1f3615b KVM: s390: gaccess: Refactor gpa and length calculation
| * e6ab3362 arm64: probes: Fix uprobes for big-endian kernels
| * 5aa6cd31 arm64:uprobe fix the uprobe SWBP_INSN in big-endian
| * 2c439470 Bluetooth: bnep: fix wild-memory-access in proto_unregister
| * 2c15c413 usb: typec: altmode should keep reference to parent
| * 6f0516ef smb: client: fix OOBs when building SMB2_IOCTL request
| * 0d2bd44b genetlink: hold RCU in genlmsg_mcast()
| * 31701ef0 net: systemport: fix potential memory leak in bcm_sysport_xmit()
| * 389bdb09 net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
| * 37441f39 macsec: don't increment counters for an unrelated SA
| * ec674722 drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
| * 825ffa86 RDMA/bnxt_re: Return more meaningful error
| * 772d5834 ipv4: give an IPv4 dev to blackhole_netdev
| * d7c4fd49 RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
| * fc2f42e4 ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
| * 17648b72 RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
| * 7526339f mac80211: Fix NULL ptr deref for injected rate info
| * 9ff2d260 erofs: fix lz4 inplace decompression
| * b4b3dc9e nilfs2: propagate directory read errors from nilfs_find_entry()
| * 4aa89486 x86/apic: Always explicitly disarm TSC-deadline timer
| * fd7133ec x86/resctrl: Annotate get_mem_config() functions as __init
| * b0641e53 parport: Proper fix for array out-of-bounds access
| * 5ead5b44 USB: serial: option: add Telit FN920C04 MBIM compositions
| * bd704359 USB: serial: option: add support for Quectel EG916Q-GL
| * 1f8cab33 xhci: Fix incorrect stream context type macro
| * d42c3fa1 Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
| * 4b9cf50a Bluetooth: Remove debugfs directory on module init failure
| * f193dddd iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
| * f36e441f iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
| * 81c79512 iio: light: opt3001: add missing full-scale range value
| * 96c1a70c iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency()
| * 65cbc40d iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
| * 06f899ff iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
| * 28d6fb09 iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
| * ab4274f9 drm/vmwgfx: Handle surface check failure correctly
| * d04b72c9 blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
| * 9051f851 x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
| * 45d5596d KVM: s390: Change virtual to physical address access in diag 0x258 handler
| * f2f7d154 s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
| * 4c141136 KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
| * 2408f491 wifi: mac80211: fix potential key use-after-free
| * ba7f982c mm/swapfile: skip HugeTLB pages for unuse_vma
| * 085e68e9 fat: fix uninitialized variable
| * 10edcff0 PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
| * f198659e tracing/kprobes: Fix symbol counting logic by looking at modules as well
| * d3679f63 tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols
| * 87677556 arm64: probes: Fix simulate_ldr*_literal()
| * ae743dec arm64: probes: Remove broken LDR (literal) uprobe support
| * e0c966bd posix-clock: Fix missing timespec64 check in pc_clock_settime()
| * fd9bb7e9 nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
| * 8e0766fc net: Fix an unsafe loop on the list
| * 7f435eba hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma
| * 5319b50c usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
| * 72887e9f usb: xhci: Fix problem with xhci resume from suspend
| * edb9ef4d usb: dwc3: core: Stop processing of pending events if controller is halted
| * 3ac86888 Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
| * afaec542 HID: plantronics: Workaround for an unexcepted opposite volume key
| * 9957fbf3 CDC-NCM: avoid overflow in sanity checking
| * 333fbaf6 resource: fix region_intersects() vs add_memory_driver_managed()
| * a20d4f0d lockdep: fix deadlock issue between lockdep and rcu
| * abdc85d6 locking/lockdep: Avoid potential access of invalid memory in lock_class
| * 991e1297 locking/lockdep: Rework lockdep_lock
| * 60519a39 locking/lockdep: Fix bad recursion pattern
| * ba6501ea slip: make slhc_remember() more robust against malicious packets
| * 8dfe9390 ppp: fix ppp_async_encode() illegal access
| * 38a35450 sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start
| * ed494a60 net: annotate lockless accesses to sk->sk_max_ack_backlog
| * e9b8a262 net: annotate lockless accesses to sk->sk_ack_backlog
| * e2882b46 net: ibm: emac: mal: fix wrong goto
| * 2acbb953 net/sched: accept TCA_STAB only for root qdisc
| * c92cbd28 igb: Do not bring the device up after non-fatal error
| * 4fdc7ce5 gpio: aspeed: Use devm_clk api to manage clock source
| * eda428e5 gpio: aspeed: Add the flush write to ensure the write complete.
| * 869c6ee6 Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
| * 75dfcb75 netfilter: br_netfilter: fix panic with metadata_dst skb
| * b56fc640 tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
| * ff816282 tcp: fix to allow timestamp undo if no retransmits were sent
| * dcd96d73 SUNRPC: Fix integer overflow in decode_rc_list()
| * 761bcde5 ice: fix VLAN replay after reset
| * c91fb72a RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt
| * 57c4f4db fbdev: sisfb: Fix strbuf array overflow
| * 7ad47b64 driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
| * 33529e27 tools/iio: Add memory allocation failure check for trigger_name
| * 59ac565c virtio_pmem: Check device status before requesting flush
| * 0547f710 usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario
| * 2a806805 usb: chipidea: udc: enable suspend interrupt after usb reset
| * 6900b412 media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
| * 5126d8f5 ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition
| * 018a3568 PCI: Mark Creative Labs EMU20k2 INTx masking as broken
| * a3a4d6a4 i2c: i801: Use a different adapter-name for IDF adapters
| * 7ca8f74f PCI: Add ACS quirk for Qualcomm SA8775P
| * 96225fd1 clk: bcm: bcm53573: fix OF node leak in init
| * 978d7124 ktest.pl: Avoid false positives with grub2 skip regex
| * 4a7b9391 s390/cpum_sf: Remove WARN_ON_ONCE statements
| * aa03f841 ext4: nested locking for xattr inode
| * e040f33b s390/mm: Add cond_resched() to cmm_alloc/free_pages()
| * 06711219 s390/facility: Disable compile time optimization for decompressor code
| * d2e35f22 bpf: Check percpu map value size first
| * a9beea8c Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
| * 3088336f virtio_console: fix misc probe bugs
| * 578d66b0 tracing: Have saved_cmdlines arrays all in one allocation
| * 07effb3c drm/crtc: fix uninitialized variable use even harder
| * 49da44d2 tracing: Remove precision vsnprintf() check from print event
| * 7eb94e52 net: ethernet: cortina: Drop TSO support
| * 18b5f47e unicode: Don't special case ignorable code points
| * 6de83ed4 ext4: fix inode tree inconsistency caused by ENOMEM
| * c47843a8 ACPI: battery: Fix possible crash when unregistering a battery hook
| * b5b7d4a0 ACPI: battery: Simplify battery hook locking
| * 64648ae8 r8169: add tally counter fields added with RTL8125
| * c2d43f22 r8169: Fix spelling mistake: "tx_underun" -> "tx_underrun"
| * 9dcff844 clk: qcom: clk-rpmh: Fix overflow in BCM vote
| * 997526f8 clk: qcom: rpmh: Simplify clk_rpmh_bcm_send_cmd()
| * 86c3f613 nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
| * 8843824b nfsd: use ktime_get_seconds() for timestamps
| * fe5e9182 uprobes: fix kernel info leak via "[uprobes]" vma
| * 7fc8b769 arm64: errata: Expand speculative SSBS workaround once more
| * 3b35b446 arm64: cputype: Add Neoverse-N3 definitions
| * d493f26e arm64: Add Cortex-715 CPU part definition
| * 889b9129 i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
| * 66b9e6e2 i2c: qcom-geni: Grow a dev pointer to simplify code
| * d5bcb2f9 i2c: qcom-geni: Let firmware specify irq trigger flags
| * dd6a664b gpio: davinci: fix lazy disable
| * a71349b6 btrfs: wait for fixup workers before stopping cleaner kthread during umount
| * 1282f001 btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
| * af40b429 ACPI: resource: Add Asus ExpertBook B2502CVA to irq1_level_low_skip_override[]
| * fc2c0136 ACPI: resource: Add Asus Vivobook X1704VAP to irq1_level_low_skip_override[]
| * 5d9dcd5b Input: adp5589-keys - fix adp5589_gpio_get_value()
| * fe6cdc1e rtc: at91sam9: fix OF node leak in probe() error path
| * 3ba06256 tomoyo: fallback to realpath if symlink's pathname does not exist
| * 844738f4 iio: magnetometer: ak8975: Fix reading for ak099xx sensors
| * 63bbe264 media: venus: fix use after free bug in venus_remove due to race condition
| * 2f33c6b5 media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
| * fd0ef59c media: sun4i_csi: Implement link validate for sun4i_csi subdev
| * dc57b2cd clk: rockchip: fix error for unknown clocks
| * a786265a aoe: fix the potential use-after-free problem in more places
| * a3915200 riscv: define ILLEGAL_POINTER_VALUE for 64bit
| * e68c8323 ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
| * 703b2c7e ocfs2: fix null-ptr-deref when journal load failed.
| * 9753bcb1 ocfs2: remove unreasonable unlock in ocfs2_read_blocks
| * 89043e7e ocfs2: cancel dqi_sync_work before freeing oinfo
| * 74364cb5 ocfs2: reserve space for inline xattr before attaching reflink tree
| * cb9561ef ocfs2: fix uninit-value in ocfs2_get_block()
| * efbe8e49 ocfs2: fix the la space leak when unmounting an ocfs2 volume
| * c383263e mm: krealloc: consider spare memory for __GFP_ZERO
| * d5dc6537 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
| * c17a4f52 drm: omapdrm: Add missing check for alloc_ordered_workqueue
| * 6cda6810 of/irq: Support #msi-cells=<0> in of_msi_get_domain
| * c20a17c2 parisc: Fix stack start for ADDR_NO_RANDOMIZE personality
| * 8eed55de parisc: Fix 64-bit userspace syscall path
| * 897e2f51 ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
| * f9fd47c9 ext4: fix double brelse() the buffer of the extents path
| * 975ca06f ext4: aovid use-after-free in ext4_ext_insert_extent()
| * 2bcfc2dc ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
| * 0ddc7a79 ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
| * cdfd6ef3 ext4: no need to continue when the number of entries is 1
| * f49f4fd1 ALSA: core: add isascii() check to card ID generator
| * 24b4c5be drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
| * 107937ba parisc: Fix itlb miss handler for 64-bit programs
| * d3465999 perf/core: Fix small negative period being ignored
| * fec2ccd7 spi: bcm63xx: Fix module autoloading
| * 006c109d firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
| * 33efc8da i2c: xiic: Wait for TX empty to avoid missed TX NAKs
| * d6f1250a i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
| * f53c1712 selftests: vDSO: fix vDSO symbols lookup for powerpc64
| * 48441fd3 selftests: breakpoints: use remaining time to check if suspend succeed
| * d5d9b789 spi: s3c64xx: fix timeout counters in flush_fifo
| * 3c46d606 ext4: fix i_data_sem unlock order in ext4_ind_migrate()
| * 556452e9 ext4: ext4_search_dir should return a proper error
| * 7bd0f5cb of/irq: Refer to actual buffer size in of_irq_parse_one()
| * e17a5b81 drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
| * 7e19f1d2 scsi: aacraid: Rearrange order of struct aac_srb_unit
| * 93a4273e drm/printer: Allow NULL data in devcoredump printer
| * 8f0abb39 drm/amd/display: Initialize get_bytes_per_element's default to 1
| * f5f6d900 drm/amd/display: Fix index out of bounds in degamma hardware format translation
| * 471c5335 drm/amd/display: Check stream before comparing them
| * dac398ed jfs: Fix uninit-value access of new_ea in ea_buffer
| * 35b91f15 jfs: check if leafidx greater than num leaves per dmap tree
| * 3126ccde jfs: Fix uaf in dbFreeBits
| * 22b166d7 jfs: UBSAN: shift-out-of-bounds in dbFindBits
| * 2fe34fe0 ata: sata_sil: Rename sil_blacklist to sil_quirks
| * d35ad25f power: reset: brcmstb: Do not go into infinite loop if reset fails
| * 6d0a07f6 fbdev: pxafb: Fix possible use after free in pxafb_task()
| * da13b253 x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
| * 8e5dd7d8 ALSA: hdsp: Break infinite MIDI input flush loop
| * ce2953e4 ALSA: asihpi: Fix potential OOB array access
| * 53e9c1ab signal: Replace BUG_ON()s
| * 267960de nfp: Use IRQF_NO_AUTOEN flag in request_irq()
| * f9310a67 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
| * 299b9175 proc: add config & param to block forcing mem writes
| * f3b2acb1 ACPICA: iasl: handle empty connection_node
| * fb66354a tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
| * b9d3b045 ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
| * 0b54f8e7 ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
| * 89704e7a net: mvpp2: Increase size of queue_name buffer
| * c79768ff tipc: guard against string buffer overrun
| * 402b4c6b ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
| * bcb4a23f ACPI: EC: Do not release locks during operation region accesses
| * 1bf77d32 wifi: rtw88: select WANT_DEV_COREDUMP
| * f81b864f net: sched: consistently use rcu_replace_pointer() in taprio_change()
| * f2c2c674 ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
| * b340de28 ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
| * 62c0d526 net: hisilicon: hns_mdio: fix OF node leak in probe()
| * 8b8511d5 net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
| * beb04d55 net: hisilicon: hip04: fix OF node leak in probe()
| * bd51b0e6 ice: Adjust over allocation of memory in ice_sched_add_root_node() and ice_sched_add_node()
| * d1f2fbc6 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
| * d96512bf wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
| * 4ce87674 f2fs: Require FMODE_WRITE for atomic write ioctls
| * 9213d0b6 ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
| * ec7b2b0a ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
| * f30b5295 ALSA: hda/realtek: Fix the push button function for the ALC257
| * 0e4e2e60 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
| * 5ac44813 ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
| * 473426a1 net: add more sanity checks to qdisc_pkt_len_init()
| * 1598d70a net: avoid potential underflow in qdisc_pkt_len_init() with UFO
| * 60c06844 net: ethernet: lantiq_etop: fix memory disclosure
| * efd9ff49 Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()
| * 8f390b9e Bluetooth: btmrvl_sdio: Refactor irq wakeup
| * c0add6ed netfilter: nf_tables: prevent nf_skb_duplicated corruption
| * 83b0b227 net: ieee802154: mcr20a: Use IRQF_NO_AUTOEN flag in request_irq()
| * 4b16abbc netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
| * 409105f0 net/mlx5: Added cond_resched() to crdump collection
| * e61e5731 ieee802154: Fix build error
| * 97157519 drivers: net: Fix Kconfig indentation, continued
| * a720ee9c Minor fixes to the CAIF Transport drivers Kconfig file
| * 126b567a ceph: remove the incorrect Fw reference check when dirtying pages
| * b0de20de mailbox: bcm2835: Fix timeout during suspend mode
| * 07975f7b mailbox: rockchip: fix a typo in module autoloading
| * 37480a59 usb: yurex: Fix inconsistent locking bug in yurex_read()
| * 031533b6 i2c: isch: Add missed 'else'
| * 64af4be2 i2c: aspeed: Update the stop sw state when the bus recovery occurs
| * 6ed7f633 mm: only enforce minimum stack gap size if it's sensible
| * 8b8de998 pps: add an error check in parport_attach
| * 76abcdca pps: remove usage of the deprecated ida_simple_xx() API
| * e66c6266 USB: misc: yurex: fix race between read and write
| * 79038d94 usb: yurex: Replace snprintf() with the safer scnprintf() variant
| * c37bca2c soc: versatile: realview: fix soc_dev leak during device remove
| * 0f167c14 soc: versatile: realview: fix memory leak during device remove
| * 893e8314 PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
| * 12350c60 PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
| * a33145f4 ASoC: meson: axg-card: fix 'use-after-free'
| * 69f27ade ASoC: meson: axg: extract sound card utils
| * ba1cd08e nfs: fix memory leak in error path of nfs4_do_reclaim
| * deaf93e3 fs: Fix file_set_fowner LSM hook inconsistencies
| * 489faddb vfs: fix race between evice_inodes() and find_inode()&iput()
| * 63b1db26 hwrng: mtk - Use devm_pm_runtime_enable
| * 8c0b118b f2fs: avoid potential int overflow in sanity_check_area_boundary()
| * a71b1bec f2fs: prevent possible int overflow in dir_block_index()
| * 60be28d8 debugobjects: Fix conditions in fill_pool()
| * 8587887c wifi: rtw88: 8822c: Fix reported RX band width
| * 8855fe99 ACPI: resource: Add another DMI match for the TongFang GMxXGxx
| * 2364b6af ACPI: sysfs: validate return type of _STR method
| * 959974bf drbd: Add NULL check for net_conf to prevent dereference in state validation
| * 9679a6e1 drbd: Fix atomicity violation in drbd_uuid_set_bm()
| * 182e6a64 tty: rp2: Fix reset with non forgiving PCIe host bridges
| * 9b1ca33e firmware_loader: Block path traversal
| * 560ae225 USB: class: CDC-ACM: fix race between get_serial and set_serial
| * 34f0773c USB: misc: cypress_cy7c63: check for short transfer
| * 18ae85cc USB: appledisplay: close race between probe and completion handler
| * 2f4c0f5b drm/amd/display: Round calculated vtotal
| * 00ff8884 soc: versatile: integrator: fix OF node leak in probe() error path
| * 45240562 Remove *.orig pattern from .gitignore
| * b716e9c3 crypto: aead,cipher - zeroize key buffer after use
| * feea6020 netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
| * 16a73a08 net: qrtr: Update packets cloning when broadcasting
| * 16e0387d tcp: check skb is non-NULL in tcp_rto_delta_us()
| * b5a84b6c net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
| * 7bcbc4cd netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
| * b8efd48e coresight: tmc: sg: Do not leak sg_table
| * f7f24d67 iio: adc: ad7606: fix standby gpio state to match the documentation
| * d44f8a17 iio: adc: ad7606: fix oversampling gpio array
| * 6ec0f444 f2fs: reduce expensive checkpoint trigger frequency
| * 18a2f126 f2fs: remove unneeded check condition in __f2fs_setxattr()
| * 363eb38b f2fs: fix to update i_ctime in __f2fs_setxattr()
| * 97a5007f f2fs: fix typo
| * f1850e6c f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
| * 6d07040a nfsd: return -EINVAL when namelen is 0
| * c6b16e70 nfsd: call cache_put if xdr_reserve_space returns NULL
| * 4b2fbba4 ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
| * 4e1fe68d RDMA/cxgb4: Added NULL check for lookup_atid
| * b1a0c9e3 riscv: Fix fp alignment bug in perf_callchain_user()
| * 5db87952 RDMA/hns: Optimize hem allocation performance
| * 9a1fe8d6 watchdog: imx_sc_wdt: Don't disable WDT in suspend
| * 6b669f38 pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
| * 4679497a clk: ti: dra7-atl: Fix leak of of_nodes
| * 888d0b49 pinctrl: single: fix missing error code in pcs_probe()
| * 29b3bbd9 RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
| * fd9d50ee PCI: xilinx-nwl: Fix register misspelling
| * 9c9afc3e PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
| * 883f794c drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
| * 49b33c38 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
| * 08e13a9e clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
| * 1993819a perf time-utils: Fix 32-bit nsec parsing
| * fc8d0579 perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
| * 5c4a88f2 perf sched timehist: Fix missing free of session in perf_sched__timehist()
| * adfbc244 bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
| * ed76d381 nilfs2: fix potential oob read in nilfs_btree_check_delete()
| * 98d0c6f1 nilfs2: determine empty node blocks as corrupted
| * 1d94dbdf nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
| * 8adf0eb4 ext4: avoid OOB when system.data xattr changes underneath the filesystem
| * 52c5fdad ext4: return error on ext4_find_inline_entry
| * dd0bc5b7 ext4: avoid negative min_clusters in find_group_orlov()
| * e8c1082c smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
| * 22e130fe ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
| * cbb86a23 jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()
| * a611f9ff kthread: fix task state in kthread worker if being frozen
| * 0f0de5d3 kthread: add kthread_work tracepoints
| * 6c371167 xz: cleanup CRC32 edits from 2018
| * 8cd56998 selftests/bpf: Fix error compiling test_lru_map.c
| * 44d9436e selftests/bpf: Fix compiling tcp_rtt.c with musl-libc
| * a620219b selftests/bpf: Fix compiling flow_dissector.c with musl-libc
| * dc5f75f3 selftests/bpf: Fix compile error from rlim_t in sk_storage_map.c
| * 87e8134c tpm: Clean up TPM space after command failure
| * 5df29a44 xen/swiotlb: add alignment check for dma buffers
| * c87b0349 xen: use correct end address of kernel for conflict checking
| * 4dac65da drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind()
| * 5c9a3510 drm/msm: fix %s null argument error
| * 5434fdcc ipmi: docs: don't advertise deprecated sysfs entries
| * 9bcf5687 drm/msm/a5xx: fix races in preemption evaluation stage
| * 637823ff drm/msm/a5xx: properly clear preemption records on resume
| * 12994875 drm/msm/a5xx: disable preemption in submits by default
| * df8e4cf2 drm/msm: Fix incorrect file name output in adreno_request_fw()
| * 5ad6284c jfs: fix out-of-bounds in dbNextAG() and diAlloc()
| * 41a3ed41 drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
| * 2ee92b99 drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode
| * 20878dec drm/rockchip: vop: Allow 4096px width scaling
| * 746e3b6f drm/radeon: properly handle vbios fake edid sizing
| * 44776395 drm/radeon: Replace one-element array with flexible-array member
| * 4209b70f drm/amdgpu: properly handle vbios fake edid sizing
| * 24f4bdf1 drm/amdgpu: Replace one-element array with flexible-array member
| * ba231009 drm/stm: Fix an error handling path in stm_drm_platform_probe()
| * c3c9c5da mtd: powernv: Add check devm_kasprintf() returned value
| * bb8e820c fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
| * 65af6f4a power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
| * 575ea801 power: supply: axp20x_battery: Remove design from min and max voltage
| * 206734f5 power: supply: axp20x_battery: allow disabling battery charging
| * 1d8d2a03 hwmon: (ntc_thermistor) fix module autoloading
| * 31bd8df7 mtd: slram: insert break after errors in parsing the map
| * ce56acc0 hwmon: (max16065) Fix overflows seen when writing limits
| * 06ca666a clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
| * e8384bef reset: berlin: fix OF node leak in probe() error path
| * 1f578d21 ARM: versatile: fix OF node leak in CPUs prepare
| * d3a63fa2 ARM: dts: imx7d-zii-rmu2: fix Ethernet PHY pinctrl property
| * 2d98263d spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
| * dab65206 spi: ppc4xx: handle irq_of_parse_and_map() errors
| * 3a5f45a4 block, bfq: don't break merge chain in bfq_split_bfqq()
| * 140c8e2c block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
| * bc214053 block, bfq: fix possible UAF for bfqq->bic with merge chain
| * c3026230 net: tipc: avoid possible garbage value
| * 309eb08b Bluetooth: btusb: Fix not handling ZPL/short-transfer
| * a833da8e can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
| * bc05f685 sock_map: Add a cond_resched() in sock_hash_free()
| * 5a24cedc wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
| * 04f75f5b wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
| * 73d2e264 mac80211: parse radiotap header when selecting Tx queue
| * 7ce40a11 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
| * 7d38d0ce wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
| * 05f66316 netfilter: nf_tables: reject expiration higher than timeout
| * bd6b2e3a netfilter: nf_tables: reject element expiration with no timeout
| * 1f444ee9 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
| * 30e197f8 can: j1939: use correct function name in comment
| * ac076cb0 mount: handle OOM on mnt_warn_timestamp_expiry
| * c6c1e135 fs/namespace: fnic: Switch to use %ptTd
| * 7e2e113f mount: warn only once about timestamp range expiration
| * 92738aab fs: explicitly unregister per-superblock BDIs
| * 8f888123 wifi: ath9k: Remove error checks when creating debugfs entries
| * dab22cf5 wifi: ath9k: fix parameter check in ath9k_init_debug()
| * c2fbff12 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
| * fa652318 USB: usbtmc: prevent kernel-usb-infoleak
| * a6eb2a48 USB: serial: pl2303: add device id for Macrosilicon MS3020
| * 1f5e352b bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
| * 1b6de5e6 inet: inet_defrag: prevent sk release while still in use
| * 9ae2d8e7 gpio: prevent potential speculation leaks in gpio_device_get_desc()
| * e8f9c4af ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
| * 60c0d361 ocfs2: add bounds checking to ocfs2_xattr_find_entry()
| * 71fbc501 x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
| * a38644c1 spi: bcm63xx: Enable module autoloading
| * 1ccc2b0f drm: komeda: Fix an issue related to normalized zpos
| * 79d978f2 ASoC: tda7419: fix module autoloading
| * 16c1e5d5 wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
| * 5fa62c3f wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
| * 9023ef9c net: ftgmac100: Ensure tx descriptor updates are visible
| * 33d60cd4 microblaze: don't treat zero reserved memory regions as error
| * f03b3fe7 pinctrl: at91: make it work with current gpiolib
| * f7fe7300 ALSA: hda/realtek - FIxed ALC285 headphone no sound
| * 950b8ce6 ALSA: hda/realtek - Fixed ALC256 headphone no sound
| * 06064053 ASoC: allow module autoloading for table db1200_pids
| * 503e1d7c selftests: breakpoints: Fix a typo of function name
| * 2fdc7540 soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
| * aa05db44 spi: nxp-fspi: fix the KASAN report out-of-bounds bug
| * dc43a096 net: dpaa: Pad packets to ETH_ZLEN
| * cfb4552c net: ftgmac100: Enable TX interrupt to avoid TX timeout
| * 453e69e1 net/mlx5e: Add missing link modes to ptys2ethtool_map
| * 164df4ec ice: fix accounting for filters shared by multiple VSIs
| * d5901c49 arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
| * af8151c8 scripts: kconfig: merge_config: config files: add a trailing newline
| * bd21d964 net: phy: vitesse: repair vsc73xx autonegotiation
| * ef2c4556 net: ethernet: use ip_hdrlen() instead of bit shift
| * 11f5645c usbnet: ipheth: fix carrier detection in modes 1 and 4
* b1c3b104 Merge branch 'android11-5.4' into android11-5.4-lts

Change-Id: Ifb715a26a2184f0dd505fb6c6e969132bf7133a7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>