Merge tag 'ASB-2025-09-05_11-5.4' of...

Merge tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

https://source.android.com/docs/security/bulletin/2025-09-01
CVE-2025-21755
CVE-2025-38352
CVE-2025-021701

* tag 'ASB-2025-09-05_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: perf/core: Fix potential NULL deref
  UPSTREAM: net/packet: fix a race in packet_set_ring() and packet_notifier()
  ANDROID: 16K: Allocate pad vma on the stack
  ANDROID: 16K: Don't copy data vma for maps/smaps output
  ANDROID: GKI: update Trimble symbol list
  UPSTREAM: net/sched: Always pass notifications when child class becomes empty
  Revert "drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling"
  Linux 5.4.296
  net: ipv6: Discard next-hop MTU less than minimum link MTU
  x86/mm: Disable hugetlb page table sharing on 32-bit
  Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID
  HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras
  HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY
  vt: add missing notification when switching back to text mode
  net: usb: qmi_wwan: add SIMCom 8230C composition
  atm: idt77252: Add missing `dma_map_error()`
  bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT
  bnxt_en: Fix DCB ETS validation
  can: m_can: m_can_handle_lost_msg(): downgrade msg lost in rx message to debug level
  net: phy: microchip: limit 100M workaround to link-down events on LAN88xx
  net: appletalk: Fix device refcount leak in atrtr_create()
  md/raid1: Fix stack memory use after return in raid1_reshape
  wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev()
  dma-buf: fix timeout handling in dma_resv_wait_timeout v2
  Input: xpad - support Acer NGR 200 Controller
  Input: xpad - add VID for Turtle Beach controllers
  Input: xpad - add support for Amazon Game Controller
  NFSv4/flexfiles: Fix handling of NFS level errors in I/O
  flexfiles/pNFS: update stats on NFS4ERR_DELAY for v4.1 DSes
  RDMA/mlx5: Fix vport loopback for MPV device
  netlink: Fix rmem check in netlink_broadcast_deliver().
  netlink: make sure we allow at least one dump skb
  pwm: mediatek: Ensure to disable clocks in error path
  Revert "ACPI: battery: negate current when discharging"
  usb: gadget: u_serial: Fix race condition in TTY wakeup
  drm/sched: Increment job count before swapping tail spsc queue
  pinctrl: qcom: msm: mark certain pins as invalid for interrupts
  x86/mce: Make sure CMCI banks are cleared during shutdown on Intel
  x86/mce: Don't remove sysfs if thresholding sysfs init fails
  x86/mce/amd: Fix threshold limit reset
  rxrpc: Fix oops due to non-existence of prealloc backlog struct
  net/sched: Abort __tc_modify_qdisc if parent class does not exist
  atm: clip: Fix NULL pointer dereference in vcc_sendmsg()
  atm: clip: Fix infinite recursive call of clip_push().
  atm: clip: Fix memory leak of struct clip_vcc.
  atm: clip: Fix potential null-ptr-deref in to_atmarpd().
  tipc: Fix use-after-free in tipc_conn_close().
  netlink: Fix wraparounds of sk->sk_rmem_alloc.
  fix proc_sys_compare() handling of in-lookup dentries
  proc: Clear the pieces of proc_inode that proc_evict_inode cares about
  drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
  staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
  media: uvcvideo: Rollback non processed entities on error
  media: uvcvideo: Send control events for partial succeeds
  media: uvcvideo: Return the number of processed controls
  ACPI: PAD: fix crash in exit_round_robin()
  usb: typec: displayport: Fix potential deadlock
  Logitech C-270 even more broken
  rose: fix dangling neighbour pointers in rose_rt_device_down()
  net: rose: Fix fall-through warnings for Clang
  drm/i915/gt: Fix timeline left held on VMA alloc error
  drm/i915/selftests: Change mock_request() to return error pointers
  spi: spi-fsl-dspi: Clear completion counter before initiating transfer
  spi: spi-fsl-dspi: Fix interrupt-less DMA mode taking an XSPI code path
  spi: spi-fsl-dspi: Rename fifo_{read,write} and {tx,cmd}_fifo_write
  dpaa2-eth: fix xdp_rxq_info leak
  ethernet: atl1: Add missing DMA mapping error checks and count errors
  btrfs: use btrfs_record_snapshot_destroy() during rmdir
  btrfs: propagate last_unlink_trans earlier when doing a rmdir
  RDMA/mlx5: Fix CC counters query for MPV
  RDMA/core: Create and destroy counters in the ib_core
  scsi: ufs: core: Fix spelling of a sysfs attribute name
  drm/v3d: Disable interrupts before resetting the GPU
  mtk-sd: reset host->mrq on prepare_data() error
  mtk-sd: Prevent memory corruption from DMA map failure
  mmc: mediatek: use data instead of mrq parameter from msdc_{un}prepare_data()
  regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
  regulator: gpio: Add input_supply support in gpio_regulator_config
  ACPICA: Refuse to evaluate a method if arguments are missing
  wifi: ath6kl: remove WARN on bad firmware input
  wifi: mac80211: drop invalid source address OCB frames
  powerpc: Fix struct termio related ioctl macros
  ata: pata_cs5536: fix build on 32-bit UML
  ALSA: sb: Force to disable DMAs once when DMA mode is changed
  net/sched: Always pass notifications when child class becomes empty
  nui: Fix dma_mapping_error() check
  enic: fix incorrect MTU comparison in enic_change_mtu()
  amd-xgbe: align CL37 AN sequence as per databook
  lib: test_objagg: Set error message in check_expect_hints_stats()
  drm/exynos: fimd: Guard display clock control with runtime PM calls
  btrfs: fix missing error handling when searching for inode refs during log replay
  scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
  nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
  RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
  platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
  mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
  usb: typec: altmodes/displayport: do not index invalid pin_assignments
  Revert "mmc: sdhci: Disable SD card clock before changing parameters"
  mmc: sdhci: Add a helper function for dump register in dynamic debug mode
  vsock/vmci: Clear the vmci transport packet properly when initializing it
  btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
  arm64: Restrict pagetable teardown to avoid false warning
  s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS
  drm/bridge: cdns-dsi: Check return value when getting default PHY config
  drm/bridge: cdns-dsi: Fix connecting to next bridge
  drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
  drm/tegra: Assign plane type before registration
  HID: wacom: fix kobject reference count leak
  HID: wacom: fix memory leak on sysfs attribute creation failure
  HID: wacom: fix memory leak on kobject creation failure
  dm-raid: fix variable in journal device check
  Bluetooth: L2CAP: Fix L2CAP MTU negotiation
  atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
  net: enetc: Correct endianness handling in _enetc_rd_reg64
  um: ubd: Add missing error check in start_io_thread()
  vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
  wifi: mac80211: fix beacon interval calculation overflow
  attach_recursive_mnt(): do not lock the covering tree when sliding something under it
  ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
  i2c: robotfuzz-osif: disable zero-length read messages
  i2c: tiny-usb: disable zero-length read messages
  RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
  RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
  media: vivid: Change the siize of the composing
  media: omap3isp: use sgtable-based scatterlist wrappers
  media: cxusb: no longer judge rbuf when the write fails
  media: cxusb: use dev_dbg() rather than hand-rolled debug
  jfs: validate AG parameters in dbMount() to prevent crashes
  fs/jfs: consolidate sanity checking in dbMount
  ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
  of: Add of_property_present() helper
  of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
  kbuild: hdrcheck: fix cross build with clang
  kbuild: add --target to correctly cross-compile UAPI headers with Clang
  bpfilter: match bit size of bpfilter_umh to that of the kernel
  kbuild: use -MMD instead of -MD to exclude system headers from dependency
  VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
  VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF
  ovl: Check for NULL d_inode() in ovl_dentry_upper()
  ceph: fix possible integer overflow in ceph_zero_objects()
  ALSA: hda: Ignore unsol events for cards being shut down
  usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
  usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
  usb: Add checks for snprintf() calls in usb_alloc_dev()
  tty: serial: uartlite: register uart driver in init
  usb: potential integer overflow in usbg_make_tpg()
  iio: pressure: zpa2326: Use aligned_s64 for the timestamp
  md/md-bitmap: fix dm-raid max_write_behind setting
  dmaengine: xilinx_dma: Set dma_device directions
  mfd: max14577: Fix wakeup source leaks on device unbind
  mailbox: Not protect module_put with spin_lock_irqsave
  cifs: Fix cifs_query_path_info() for Windows NT servers

 Conflicts:
	drivers/hid/hid-ids.h
	drivers/pinctrl/qcom/pinctrl-msm.c

Change-Id: Ifd5acd2c013f9985e02b866e3f9383383077e3f0