Merge 5.15.89 into android14-5.15

Changes in 5.15.89
	netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
	ALSA: control-led: use strscpy in set_led_id()
	ALSA: hda/realtek - Turn on power early
	ALSA: hda/realtek: Enable mute/micmute LEDs on HP Spectre x360 13-aw0xxx
	KVM: arm64: Fix S1PTW handling on RO memslots
	KVM: arm64: nvhe: Fix build with profile optimization
	selftests: kvm: Fix a compile error in selftests/kvm/rseq_test.c
	efi: tpm: Avoid READ_ONCE() for accessing the event log
	docs: Fix the docs build with Sphinx 6.0
	net: stmmac: add aux timestamps fifo clearance wait
	perf auxtrace: Fix address filter duplicate symbol selection
	s390/kexec: fix ipl report address for kdump
	ASoC: qcom: lpass-cpu: Fix fallback SD line index handling
	s390/cpum_sf: add READ_ONCE() semantics to compare and swap loops
	s390/percpu: add READ_ONCE() to arch_this_cpu_to_op_simple()
	drm/virtio: Fix GEM handle creation UAF
	drm/i915/gt: Reset twice
	net/mlx5e: Set action fwd flag when parsing tc action goto
	cifs: Fix uninitialized memory read for smb311 posix symlink create
	platform/x86: dell-privacy: Only register SW_CAMERA_LENS_COVER if present
	platform/surface: aggregator: Ignore command messages not intended for us
	platform/x86: dell-privacy: Fix SW_CAMERA_LENS_COVER reporting
	dt-bindings: msm: dsi-controller-main: Fix operating-points-v2 constraint
	drm/msm/adreno: Make adreno quirks not overwrite each other
	dt-bindings: msm: dsi-controller-main: Fix power-domain constraint
	dt-bindings: msm: dsi-controller-main: Fix description of core clock
	dt-bindings: msm: dsi-phy-28nm: Add missing qcom, dsi-phy-regulator-ldo-mode
	platform/x86: ideapad-laptop: Add Legion 5 15ARH05 DMI id to set_fn_lock_led_list[]
	drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer
	dt-bindings: msm/dsi: Don't require vdds-supply on 10nm PHY
	dt-bindings: msm/dsi: Don't require vcca-supply on 14nm PHY
	platform/x86: sony-laptop: Don't turn off 0x153 keyboard backlight during probe
	ixgbe: fix pci device refcount leak
	ipv6: raw: Deduct extension header length in rawv6_push_pending_frames
	bus: mhi: host: Fix race between channel preparation and M0 event
	usb: ulpi: defer ulpi_register on ulpi_read_id timeout
	iommu/iova: Fix alloc iova overflows issue
	iommu/mediatek-v1: Fix an error handling path in mtk_iommu_v1_probe()
	sched/core: Fix use-after-free bug in dup_user_cpus_ptr()
	netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
	powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
	x86/boot: Avoid using Intel mnemonics in AT&T syntax asm
	EDAC/device: Fix period calculation in edac_device_reset_delay_period()
	x86/resctrl: Fix task CLOSID/RMID update race
	regulator: da9211: Use irq handler when ready
	scsi: mpi3mr: Refer CONFIG_SCSI_MPI3MR in Makefile
	scsi: ufs: Stop using the clock scaling lock in the error handler
	scsi: ufs: core: WLUN suspend SSU/enter hibern8 fail recovery
	ASoC: wm8904: fix wrong outputs volume after power reactivation
	ALSA: usb-audio: Make sure to stop endpoints before closing EPs
	ALSA: usb-audio: Relax hw constraints for implicit fb sync
	tipc: fix unexpected link reset due to discovery messages
	octeontx2-af: Fix LMAC config in cgx_lmac_rx_tx_enable
	hvc/xen: lock console list traversal
	nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()
	af_unix: selftest: Fix the size of the parameter to connect()
	tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list
	tools/nolibc: x86-64: Use `mov $60,%eax` instead of `mov $60,%rax`
	tools/nolibc: use pselect6 on RISCV
	tools/nolibc/std: move the standard type definitions to std.h
	tools/nolibc/types: split syscall-specific definitions into their own files
	tools/nolibc/arch: split arch-specific code into individual files
	tools/nolibc/arch: mark the _start symbol as weak
	tools/nolibc: Remove .global _start from the entry point code
	tools/nolibc: restore mips branch ordering in the _start block
	tools/nolibc: fix the O_* fcntl/open macro definitions for riscv
	net/sched: act_mpls: Fix warning during failed attribute validation
	net/mlx5: Fix ptp max frequency adjustment range
	net/mlx5e: Don't support encap rules with gbp option
	perf build: Properly guard libbpf includes
	igc: Fix PPS delta between two synchronized end-points
	platform/surface: aggregator: Add missing call to ssam_request_sync_free()
	mm: Always release pages to the buddy allocator in memblock_free_late().
	Documentation: KVM: add API issues section
	KVM: x86: Do not return host topology information from KVM_GET_SUPPORTED_CPUID
	io_uring: lock overflowing for IOPOLL
	arm64: atomics: format whitespace consistently
	arm64: atomics: remove LL/SC trampolines
	arm64: cmpxchg_double*: hazard against entire exchange variable
	efi: fix NULL-deref in init error path
	scsi: mpt3sas: Remove scsi_dma_map() error messages
	io_uring/io-wq: free worker if task_work creation is canceled
	io_uring/io-wq: only free worker if it was allocated for creation
	block: handle bio_split_to_limits() NULL return
	Revert "usb: ulpi: defer ulpi_register on ulpi_read_id timeout"
	pinctrl: amd: Add dynamic debugging for active GPIOs
	Linux 5.15.89

Change-Id: I66c4f269aa7751b2e4aac919f822dfdcb844a69d
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

net/netfilter/ipset/ip_set_bitmap_ip.c

@@ -308,8 +308,8 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[],
 			return -IPSET_ERR_BITMAP_RANGE;
 
 		pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask);
-		hosts = 2 << (32 - netmask - 1);
-		elements = 2 << (netmask - mask_bits - 1);
+		hosts = 2U << (32 - netmask - 1);
+		elements = 2UL << (netmask - mask_bits - 1);
 	}
 	if (elements > IPSET_BITMAP_MAX_RANGE + 1)
 		return -IPSET_ERR_BITMAP_RANGE_SIZE;

net/netfilter/nft_payload.c

@@ -63,7 +63,7 @@ nft_payload_copy_vlan(u32 *d, const struct sk_buff *skb, u8 offset, u8 len)
 			return false;
 
 		if (offset + len > VLAN_ETH_HLEN + vlan_hlen)
-			ethlen -= offset + len - VLAN_ETH_HLEN + vlan_hlen;
+			ethlen -= offset + len - VLAN_ETH_HLEN - vlan_hlen;
 
 		memcpy(dst_u8, vlanh + offset - vlan_hlen, ethlen);