Merge tag 'ASB-2023-07-05_4.14-stable' of...

Merge tag 'ASB-2023-07-05_4.14-stable' of https://android.googlesource.com/kernel/common into android13-4.14-msmnile

https://source.android.com/docs/security/bulletin/2023-07-01
CVE-2022-42703
CVE-2023-21255
CVE-2023-25012

* tag 'ASB-2023-07-05_4.14-stable' of https://android.googlesource.com/kernel/common:
  UPSTREAM: xfrm: Check if_id in xfrm_migrate
  Linux 4.14.320
  i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle
  x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
  drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
  drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
  drm/exynos: vidi: fix a wrong error return
  s390/cio: unregister device when the only path is gone
  usb: gadget: udc: fix NULL dereference in remove()
  fbdev: imsttfb: Release framebuffer and dealloc cmap on error path
  nfcsim.c: Fix error checking for debugfs_create_dir
  arm64: Add missing Set/Way CMO encodings
  HID: wacom: Add error check to wacom_parse_and_register()
  scsi: target: iscsi: Prevent login threads from racing between each other
  netfilter: nf_tables: disallow element updates of bound anonymous sets
  be2net: Extend xmit workaround to BE3 chip
  mmc: usdhi60rol0: fix deferred probing
  mmc: omap_hsmmc: fix deferred probing
  mmc: omap: fix deferred probing
  mmc: mtk-sd: fix deferred probing
  net: qca_spi: Avoid high load if QCA7000 is not available
  xfrm: Linearize the skb after offloading if needed.
  nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
  cgroup: Do not corrupt task iteration when rebinding subsystem
  Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
  nilfs2: fix buffer corruption due to concurrent device reads
  nilfs2: reject devices with insufficient block count
  serial: lantiq: add missing interrupt ack
  Linux 4.14.319
  mmc: block: ensure error propagation for non-blk
  powerpc: Fix defconfig choice logic when cross compiling
  neighbour: delete neigh_lookup_nodev as not used
  neighbour: Remove unused inline function neigh_key_eq16()
  selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
  net: tipc: resize nlattr array to correct size
  net: lapbether: only support ethernet devices
  drm/nouveau/dp: check for NULL nv_connector->native_mode
  igb: fix nvm.ops.read() error handling
  sctp: fix an error code in sctp_sf_eat_auth()
  IB/isert: Fix incorrect release of isert connection
  IB/isert: Fix possible list corruption in CMA handler
  IB/isert: Fix dead lock in ib_isert
  ping6: Fix send to link-local addresses with VRF.
  netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
  USB: serial: option: add Quectel EM061KGL series
  Remove DECnet support from kernel
  net: usb: qmi_wwan: add support for Compal RXM-G1
  nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
  nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
  nios2: dts: Fix tse_mac "max-frame-size" property
  ocfs2: check new file size on fallocate call
  ocfs2: fix use-after-free when unmounting read-only filesystem
  xen/blkfront: Only check REQ_FUA for writes
  mips: Move initrd_start check after initrd address sanitisation.
  MIPS: Alchemy: fix dbdma2
  power: supply: Fix logic checking if system is running from battery
  regulator: Fix error checking for debugfs_create_dir
  power: supply: Ratelimit no data debug output
  ARM: dts: vexpress: add missing cache properties
  power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
  power: supply: ab8500: Fix external_power_changed race
  Linux 4.14.318
  Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
  btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
  btrfs: check return value of btrfs_commit_transaction in relocation
  ext4: only check dquot_initialize_needed() when debugging
  i2c: sprd: Delete i2c adapter in .remove's error path
  Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
  ceph: fix use-after-free bug for inodes when flushing capsnaps
  drm/amdgpu: fix xclk freq on CHIP_STONEY
  Input: psmouse - fix OOB access in Elantech protocol
  Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
  batman-adv: Broken sync while rescheduling delayed work
  bnxt_en: Query default VLAN before VNIC setup on a VF
  lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
  net: sched: move rtm_tca_policy declaration to include file
  rfs: annotate lockless accesses to RFS sock flow table
  rfs: annotate lockless accesses to sk->sk_rxhash
  Bluetooth: L2CAP: Add missing checks for invalid DCID
  Bluetooth: Fix l2cap_disconnect_req deadlock
  spi: qup: Request DMA before enabling clocks
  i40e: fix build warnings in i40e_alloc.h
  i40iw: fix build warning in i40iw_manage_apbvt()
  Linux 4.14.317
  wifi: rtlwifi: 8192de: correct checking of IQK reload
  Fix double fget() in vhost_net_set_backend()
  net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
  cdc_ncm: Fix the build warning
  cdc_ncm: Implement the 32-bit version of NCM Transfer Block
  scsi: dpt_i2o: Do not process completions with invalid addresses
  scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD)
  fbcon: Fix null-ptr-deref in soft_cursor
  ext4: add lockdep annotations for i_data_sem for ea_inode's
  selinux: don't use make's grouped targets feature yet
  tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
  mmc: vub300: fix invalid response handling
  regulator: da905{2,5}: Remove unnecessary array check
  wifi: rtlwifi: remove always-true condition pointed out by GCC 12
  lib/dynamic_debug.c: use address-of operator on section symbols
  kernel/extable.c: use address-of operator on section symbols
  eth: sun: cassini: remove dead code
  gcc-12: disable '-Wdangling-pointer' warning for now
  ACPI: thermal: drop an always true check
  x86/boot: Wrap literal addresses in absolute_pointer()
  ata: libata-scsi: Use correct device no in ata_find_dev()
  scsi: stex: Fix gcc 13 warnings
  usb: gadget: f_fs: Add unbind event before functionfs_unbind
  net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
  iio: dac: mcp4725: Fix i2c_master_send() return value handling
  HID: wacom: avoid integer overflow in wacom_intuos_inout()
  iio: adc: mxs-lradc: fix the order of two cleanup operations
  mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
  atm: hide unused procfs functions
  ALSA: oss: avoid missing-prototype warnings
  netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
  wifi: b43: fix incorrect __packed annotation
  scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
  wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
  media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
  media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
  media: netup_unidvb: fix irq init by register it at the end of probe
  media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
  media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
  media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
  media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
  media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
  media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
  ASoC: ssm2602: Add workaround for playback distortions
  ASoC: dwc: limit the number of overrun messages
  nbd: Fix debugfs_create_dir error checking
  fbdev: stifb: Fix info entry in sti_struct on error path
  fbdev: modedb: Add 1920x1080 at 60 Hz video mode
  ARM: 9295/1: unwind:fix unwind abort for uleb128 case
  mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
  net: dsa: mv88e6xxx: Increase wait after reset deactivation
  udp6: Fix race condition in udp6_sendmsg & connect
  tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
  af_packet: do not use READ_ONCE() in packet_bind()
  af_packet: Fix data-races of pkt_sk(sk)->num.
  netrom: fix info-leak in nr_write_internal()
  dmaengine: pl330: rename _start to prevent build error
  bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
  ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
  power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize

 Conflicts:
	drivers/mmc/core/block.c
	drivers/usb/gadget/function/f_fs.c
	include/net/pkt_sched.h

Change-Id: I9956e5eb95976891020ecda6396647616352a9f3