Merge 6.12.28 into android16-6.12-lts

GKI (arm64) relevant 33 out of 166 changes, affecting 52 files +454/-363
  0aaae77be5 ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface() [1 file, +7/-0]
  fdf0ae5e9e ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset [1 file, +2/-1]
  38d9ca7405 binder: fix offset calculation in debug log [1 file, +1/-1]
  f1dfc94584 drm/fdinfo: Protect against driver unbind [1 file, +6/-0]
  090c8714ef arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays [1 file, +2/-0]
  eb9b72e4fe mm/memblock: pass size instead of end to memblock_set_node() [1 file, +1/-1]
  9c4ddea497 mm/memblock: repeat setting reserved region nid if array is doubled [1 file, +10/-0]
  0988dd0263 tracing: Do not take trace_event_sem in print_event_fields() [1 file, +2/-2]
  f451082572 dm-bufio: don't schedule in atomic context [1 file, +8/-1]
  510aea4ef0 dm: always update the array size in realloc_argv on success [1 file, +3/-2]
  2e303d0107 iommu: Fix two issues in iommu_copy_struct_from_user() [1 file, +4/-4]
  573b047229 cpufreq: Avoid using inconsistent policy->min and policy->max [1 file, +25/-7]
  962d88304c cpufreq: Fix setting policy limits when frequency tables are used [4 files, +73/-41]
  1f27a3e93b tracing: Fix oob write in trace_seq_to_buffer() [1 file, +3/-2]
  220395054c ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties [1 file, +13/-19]
  29a4a29112 ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence [1 file, +4/-1]
  65d3c57061 xsk: Fix race condition in AF_XDP generic RX path [4 files, +6/-6]
  fe81c26d2d Bluetooth: hci_conn: Remove alloc from critical section [1 file, +10/-18]
  eb8b860e87 Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver [6 files, +95/-107]
  620810ac1f Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync [7 files, +88/-109]
  432572d536 Bluetooth: L2CAP: copy RX timestamp to new fragments [1 file, +3/-0]
  6b1355860d scsi: ufs: core: Remove redundant query_complete trace [1 file, +0/-2]
  5ad0b1b554 nvme-pci: fix queue unquiesce check on slot_reset [1 file, +1/-1]
  6effe1c0fa net: ipv6: fix UDPv6 GSO segmentation with NAT [1 file, +60/-1]
  c0dba059b1 net: use sock_gen_put() when sk_state is TCP_TIME_WAIT [2 files, +2/-2]
  e10ec6e32b blk-mq: create correct map for fallback case [1 file, +1/-2]
  dab2a13059 mm, slab: clean up slab->obj_exts always [1 file, +7/-20]
  0a188c0e19 sch_htb: make htb_qlen_notify() idempotent [1 file, +2/-0]
  969d8beaa2 firmware: arm_scmi: Balance device refcount when destroying devices [1 file, +3/-0]
  3b41b5efae kernel: param: rename locate_module_kobject [1 file, +3/-3]
  69113bf740 kernel: globalize lookup_or_create_module_kobject() [2 files, +3/-1]
  e1eea69858 drivers: base: handle module_kobject creation [1 file, +5/-8]
  db62809197 dm: fix copying after src array boundaries [1 file, +1/-1]

Changes in 6.12.28
        Bluetooth: btusb: add Foxconn 0xe0fc for Qualcomm WCN785x
        Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x
        Bluetooth: btusb: Add one more ID 0x13d3:0x3623 for Qualcomm WCN785x
        Bluetooth: btusb: Add ID 0x2c7c:0x0130 for Qualcomm WCN785x
        Bluetooth: btusb: Add new VID/PID for WCN785x
        Bluetooth: btusb: Add 13 USB device IDs for Qualcomm WCN785x
        Revert "rndis_host: Flag RNDIS modems as WWAN devices"
        ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()
        ALSA: usb-audio: Add second USB ID for Jabra Evolve 65 headset
        binder: fix offset calculation in debug log
        btrfs: adjust subpage bit start based on sectorsize
        btrfs: fix COW handling in run_delalloc_nocow()
        cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode
        drm/fdinfo: Protect against driver unbind
        drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill()
        EDAC/altera: Test the correct error reg offset
        EDAC/altera: Set DDR and SDMMC interrupt mask before registration
        i2c: imx-lpi2c: Fix clock count when probe defers
        arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays
        parisc: Fix double SIGFPE crash
        perf/x86/intel: Only check the group flag for X86 leader
        perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value.
        amd-xgbe: Fix to ensure dependent features are toggled with RX checksum offload
        irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs
        mm/memblock: pass size instead of end to memblock_set_node()
        mm/memblock: repeat setting reserved region nid if array is doubled
        mmc: renesas_sdhi: Fix error handling in renesas_sdhi_probe
        spi: tegra114: Don't fail set_cs_timing when delays are zero
        tracing: Do not take trace_event_sem in print_event_fields()
        wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
        x86/boot/sev: Support memory acceptance in the EFI stub under SVSM
        dm-bufio: don't schedule in atomic context
        dm-integrity: fix a warning on invalid table line
        dm: always update the array size in realloc_argv on success
        drm/amdgpu: Fix offset for HDP remap in nbio v7.11
        drm: Select DRM_KMS_HELPER from DRM_DEBUG_DP_MST_TOPOLOGY_REFS
        iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
        iommu/arm-smmu-v3: Fix iommu_device_probe bug due to duplicated stream ids
        iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
        iommu/vt-d: Apply quirk_iommu_igfx for 8086:0044 (QM57/QS57)
        iommu: Fix two issues in iommu_copy_struct_from_user()
        platform/x86/amd: pmc: Require at least 2.5 seconds between HW sleep cycles
        platform/x86/intel-uncore-freq: Fix missing uncore sysfs during CPU hotplug
        ksmbd: fix use-after-free in ksmbd_session_rpc_open
        ksmbd: fix use-after-free in kerberos authentication
        ksmbd: fix use-after-free in session logoff
        smb: client: fix zero length for mkdir POSIX create context
        cpufreq: Avoid using inconsistent policy->min and policy->max
        cpufreq: Fix setting policy limits when frequency tables are used
        tracing: Fix oob write in trace_seq_to_buffer()
        drm/amd/display: Default IPS to RCG_IN_ACTIVE_IPS2_IN_OFF
        ASoC: soc-core: Stop using of_property_read_bool() for non-boolean properties
        ASoC: cs-amp-lib-test: Don't select SND_SOC_CS_AMP_LIB
        ASoC: soc-pcm: Fix hw_params() and DAPM widget sequence
        book3s64/radix : Align section vmemmap start address to PAGE_SIZE
        pinctrl: imx: Return NULL if no group is matched and found
        powerpc/boot: Check for ld-option support
        ASoC: Intel: sof_sdw: Add NULL check in asoc_sdw_rt_dmic_rtd_init()
        ALSA: hda/realtek - Enable speaker for HP platform
        drm/i915/pxp: fix undefined reference to `intel_pxp_gsccs_is_ready_for_sessions'
        wifi: iwlwifi: don't warn if the NIC is gone in resume
        wifi: iwlwifi: fix the check for the SCRATCH register upon resume
        wifi: plfxlc: Remove erroneous assert in plfxlc_mac_release
        powerpc/boot: Fix dash warning
        vxlan: vnifilter: Fix unlocked deletion of default FDB entry
        xsk: Fix race condition in AF_XDP generic RX path
        net/mlx5e: Use custom tunnel header for vxlan gbp
        net/mlx5: E-Switch, Initialize MAC Address for Default GID
        net/mlx5e: TC, Continue the attr process even if encap entry is invalid
        net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover
        net/mlx5: E-switch, Fix error handling for enabling roce
        accel/ivpu: Correct DCT interrupt handling
        ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot
        Bluetooth: hci_conn: Remove alloc from critical section
        Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver
        Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync
        Bluetooth: btintel_pcie: Avoid redundant buffer allocation
        Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()
        Bluetooth: btintel_pcie: Add additional to checks to clear TX/RX paths
        Bluetooth: L2CAP: copy RX timestamp to new fragments
        net: mscc: ocelot: delete PVID VLAN when readding it as non-PVID
        octeon_ep_vf: Resolve netdevice usage count issue
        bnxt_en: improve TX timestamping FIFO configuration
        rtase: Modify the condition used to detect overflow in rtase_calc_time_mitigation
        net: ethernet: mtk-star-emac: fix spinlock recursion issues on rx/tx poll
        net: ethernet: mtk-star-emac: rearm interrupts in rx_poll only when advised
        net: ethernet: mtk_eth_soc: sync mtk_clks_source_name array
        pds_core: make pdsc_auxbus_dev_del() void
        pds_core: specify auxiliary_device to be created
        pds_core: remove write-after-free of client_id
        net_sched: drr: Fix double list add in class with netem as child qdisc
        net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
        net_sched: ets: Fix double list add in class with netem as child qdisc
        net_sched: qfq: Fix double list add in class with netem as child qdisc
        ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr()
        idpf: fix offloads support for encapsulated packets
        scsi: ufs: core: Remove redundant query_complete trace
        ALSA: ump: Fix buffer overflow at UMP SysEx message conversion
        nvme-pci: fix queue unquiesce check on slot_reset
        drm/tests: shmem: Fix memleak
        drm/mipi-dbi: Fix blanking for non-16 bit formats
        net: dlink: Correct endianness handling of led_mode
        net: mdio: mux-meson-gxl: set reversed bit when using internal phy
        idpf: fix potential memory leak on kcalloc() failure
        idpf: protect shutdown from reset
        igc: fix lock order in igc_ptp_reset
        net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM
        net: dsa: felix: fix broken taprio gate states after clock jump
        net: ipv6: fix UDPv6 GSO segmentation with NAT
        ALSA: hda/realtek: Fix built-mic regression on other ASUS models
        bnxt_en: Fix error handling path in bnxt_init_chip()
        bnxt_en: Fix ethtool selftest output in one of the failure cases
        bnxt_en: Add missing skb_mark_for_recycle() in bnxt_rx_vlan()
        bnxt_en: call pci_alloc_irq_vectors() after bnxt_reserve_rings()
        bnxt_en: Fix coredump logic to free allocated buffer
        bnxt_en: Fix out-of-bound memcpy() during ethtool -w
        bnxt_en: Fix ethtool -d byte order for 32-bit values
        nvme-tcp: fix premature queue removal and I/O failover
        nvme-tcp: select CONFIG_TLS from CONFIG_NVME_TCP_TLS
        nvmet-tcp: select CONFIG_TLS from CONFIG_NVME_TARGET_TCP_TLS
        ASoC: simple-card-utils: Fix pointer check in graph_util_parse_link_direction
        bnxt_en: fix module unload sequence
        net: use sock_gen_put() when sk_state is TCP_TIME_WAIT
        ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
        net: lan743x: Fix memleak issue when GSO enabled
        net: fec: ERR007885 Workaround for conventional TX
        octeon_ep: Fix host hang issue during device reboot
        net: hns3: store rx VLAN tag offload state for VF
        net: hns3: fix an interrupt residual problem
        net: hns3: fixed debugfs tm_qset size
        net: hns3: defer calling ptp_clock_register()
        net: vertexcom: mse102x: Fix possible stuck of SPI interrupt
        net: vertexcom: mse102x: Fix LEN_MASK
        net: vertexcom: mse102x: Add range check for CMD_RTS
        net: vertexcom: mse102x: Fix RX error handling
        blk-mq: create correct map for fallback case
        mm, slab: clean up slab->obj_exts always
        bcachefs: Remove incorrect __counted_by annotation
        net: Fix the devmem sock opts and msgs for parisc
        accel/ivpu: Make DB_ID and JOB_ID allocations incremental
        accel/ivpu: Use xa_alloc_cyclic() instead of custom function
        accel/ivpu: Fix a typo
        accel/ivpu: Update VPU FW API headers
        accel/ivpu: Abort all jobs after command queue unregister
        accel/ivpu: Fix locking order in ivpu_job_submit
        accel/ivpu: Add handling of VPU_JSM_STATUS_MVNCI_CONTEXT_VIOLATION_HW
        sch_htb: make htb_qlen_notify() idempotent
        sch_drr: make drr_qlen_notify() idempotent
        sch_hfsc: make hfsc_qlen_notify() idempotent
        sch_qfq: make qfq_qlen_notify() idempotent
        sch_ets: make est_qlen_notify() idempotent
        drm/xe: Ensure fixed_slice_mode gets set after ccs_mode change
        firmware: arm_scmi: Balance device refcount when destroying devices
        firmware: arm_ffa: Skip Rx buffer ownership release if not acquired
        arm64: dts: imx95: Correct the range of PCIe app-reg region
        ARM: dts: opos6ul: add ksz8081 phy properties
        arm64: dts: st: Adjust interrupt-controller for stm32mp25 SoCs
        arm64: dts: st: Use 128kB size for aliased GIC400 register access on stm32mp25 SoCs
        Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"
        kernel: param: rename locate_module_kobject
        kernel: globalize lookup_or_create_module_kobject()
        drivers: base: handle module_kobject creation
        drm/amd/display: Add scoped mutexes for amdgpu_dm_dhcp
        drm/amd/display: Fix slab-use-after-free in hdcp
        dm: fix copying after src array boundaries
        Linux 6.12.28

Change-Id: I79f3d50a10acfe53f329b4b5a4af502f488c61f3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

kernel/trace/trace.c

@@ -6702,13 +6702,14 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
 		/* Copy the data into the page, so we can start over. */
 		ret = trace_seq_to_buffer(&iter->seq,
 					  page_address(spd.pages[i]),
-					  trace_seq_used(&iter->seq));
+					  min((size_t)trace_seq_used(&iter->seq),
+						  PAGE_SIZE));
 		if (ret < 0) {
 			__free_page(spd.pages[i]);
 			break;
 		}
 		spd.partial[i].offset = 0;
-		spd.partial[i].len = trace_seq_used(&iter->seq);
+		spd.partial[i].len = ret;
 
 		trace_seq_init(&iter->seq);
 	}

kernel/trace/trace_output.c

@@ -950,11 +950,12 @@ enum print_line_t print_event_fields(struct trace_iterator *iter,
 	struct trace_event_call *call;
 	struct list_head *head;
 
+	lockdep_assert_held_read(&trace_event_sem);
+
 	/* ftrace defined events have separate call structures */
 	if (event->type <= __TRACE_LAST_TYPE) {
 		bool found = false;
 
-		down_read(&trace_event_sem);
 		list_for_each_entry(call, &ftrace_events, list) {
 			if (call->event.type == event->type) {
 				found = true;
@@ -964,7 +965,6 @@ enum print_line_t print_event_fields(struct trace_iterator *iter,
 			if (call->event.type > __TRACE_LAST_TYPE)
 				break;
 		}
-		up_read(&trace_event_sem);
 		if (!found) {
 			trace_seq_printf(&iter->seq, "UNKNOWN TYPE %d\n", event->type);
 			goto out;