Merge branch 'android14-6.1' into branch 'android14-6.1-lts'

This catches the android14-6.1-lts branch up with recent changes added
to the android14-6.1 branch.  Included in here are the following
commits:

* 002bba562d Merge tag 'android14-6.1.90_r00' into android14-6.1
* 6d6afa9d3f FROMGIT: scsi: ufs: core: Suspend clk scaling on no request
* f858f0ff4e FROMGIT: scsi: ufs: qcom: Enable suspending clk scaling on no request
* f3437db870 ANDROID: 16K: Don't set padding vm_flags on 32-bit archs
* fc94b39f66 ANDROID: abi_gki_aarch64_qcom: Add groups_free symbol
* c78828e383 FROMLIST: usb: gadget: u_serial: Add null pointer checks after RX/TX submission
* 7de5ae52b1 UPSTREAM: erofs: fix uninitialized page cache reported by KMSAN
* 4965ad067b ANDROID: Fix abi issues in struct sk_buff
* 47d9c7690e UPSTREAM: inet: inet_defrag: prevent sk release while still in use

Change-Id: I8931b13494fd41d6d449ea8011ee24c5f6f792bc
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

android/abi_gki_aarch64.stg

@@ -41288,11 +41288,6 @@ member {
   id: 0x3e4f626d
   type_id: 0x7613f9a7
 }
-member {
-  id: 0x3e5d0376
-  type_id: 0x765a5eef
-  offset: 192
-}
 member {
   id: 0x3e670f18
   type_id: 0x76b2536c
@@ -111879,11 +111874,6 @@ member {
   type_id: 0x18bd6530
   offset: 4992
 }
-member {
-  id: 0x0e850e04
-  name: "ip_defrag_offset"
-  type_id: 0x6720d32f
-}
 member {
   id: 0xbc6a844a
   name: "ip_epilogue"
@@ -189234,6 +189224,12 @@ member {
   type_id: 0x351ca0f0
   offset: 64
 }
+member {
+  id: 0x0489a9d9
+  name: "suspend_on_no_request"
+  type_id: 0x6d7f5ff6
+  offset: 1672
+}
 member {
   id: 0x0b4c6d3f
   name: "suspend_opp"
@@ -218986,15 +218982,6 @@ struct_union {
     member_id: 0xa70d7362
   }
 }
-struct_union {
-  id: 0x765a5eef
-  kind: UNION
-  definition {
-    bytesize: 8
-    member_id: 0x828c89b5
-    member_id: 0x0e850e04
-  }
-}
 struct_union {
   id: 0x7689fdd5
   kind: UNION
@@ -258616,7 +258603,7 @@ struct_union {
   definition {
     bytesize: 248
     member_id: 0x34366909
-    member_id: 0x3e5d0376
+    member_id: 0x828c817c
     member_id: 0x318fd08b
     member_id: 0x53e7b9ea
     member_id: 0x345f6930
@@ -266614,6 +266601,7 @@ struct_union {
     member_id: 0xbbefba04
     member_id: 0xb768ef54
     member_id: 0x2061f6ba
+    member_id: 0x0489a9d9
     member_id: 0x2d081217
   }
 }
@@ -299013,6 +299001,11 @@ function {
   parameter_id: 0x18bd6530
   parameter_id: 0x6720d32f
 }
+function {
+  id: 0x17956035
+  return_type_id: 0x48b5725f
+  parameter_id: 0x1c34c69b
+}
 function {
   id: 0x179e48e8
   return_type_id: 0x48b5725f
@@ -373067,6 +373060,15 @@ elf_symbol {
   type_id: 0x9622351a
   full_name: "gro_cells_receive"
 }
+elf_symbol {
+  id: 0xa589de7f
+  name: "groups_free"
+  is_defined: true
+  symbol_type: FUNCTION
+  crc: 0x732dd326
+  type_id: 0x17956035
+  full_name: "groups_free"
+}
 elf_symbol {
   id: 0x3f69092d
   name: "gs_alloc_req"
@@ -415156,6 +415158,7 @@ interface {
   symbol_id: 0x0ac30c0d
   symbol_id: 0x61ad5a29
   symbol_id: 0x4b6846bd
+  symbol_id: 0xa589de7f
   symbol_id: 0x3f69092d
   symbol_id: 0x61776461
   symbol_id: 0xfeac8d5f

android/abi_gki_aarch64_qcom

@@ -1326,6 +1326,7 @@
   gro_cells_destroy
   gro_cells_init
   gro_cells_receive
+  groups_free
   h4_recv_buf
   handle_bad_irq
   handle_edge_irq

drivers/ufs/core/ufshcd.c

@@ -1503,7 +1503,8 @@ static int ufshcd_devfreq_target(struct device *dev,
 		ktime_to_us(ktime_sub(ktime_get(), start)), ret);
 
 out:
-	if (sched_clk_scaling_suspend_work && !scale_up)
+	if (sched_clk_scaling_suspend_work &&
+			(!scale_up || hba->clk_scaling.suspend_on_no_request))
 		queue_work(hba->clk_scaling.workq,
 			   &hba->clk_scaling.suspend_work);
 

drivers/ufs/host/ufs-qcom.c

@@ -1378,6 +1378,8 @@ static void ufs_qcom_config_scaling_param(struct ufs_hba *hba,
 	p->polling_ms = 60;
 	d->upthreshold = 70;
 	d->downdifferential = 5;
+
+	hba->clk_scaling.suspend_on_no_request = true;
 }
 #else
 static void ufs_qcom_config_scaling_param(struct ufs_hba *hba,

drivers/usb/gadget/function/u_serial.c

@@ -538,20 +538,16 @@ static int gs_alloc_requests(struct usb_ep *ep, struct list_head *head,
 static int gs_start_io(struct gs_port *port)
 {
 	struct list_head	*head = &port->read_pool;
-	struct usb_ep		*ep;
+	struct usb_ep		*ep = port->port_usb->out;
 	int			status;
 	unsigned		started;
 
-	if (!port->port_usb || !port->port.tty)
-		return -EIO;
-
 	/* Allocate RX and TX I/O buffers.  We can't easily do this much
 	 * earlier (with GFP_KERNEL) because the requests are coupled to
 	 * endpoints, as are the packet sizes we'll be using.  Different
 	 * configurations may use different endpoints with a given port;
 	 * and high speed vs full speed changes packet sizes too.
 	 */
-	ep = port->port_usb->out;
 	status = gs_alloc_requests(ep, head, gs_read_complete,
 		&port->read_allocated);
 	if (status)
@@ -568,12 +564,22 @@ static int gs_start_io(struct gs_port *port)
 	port->n_read = 0;
 	started = gs_start_rx(port);
 
+	/*
+	 * The TTY may be set to NULL by gs_close() after gs_start_rx() or
+	 * gs_start_tx() release locks for endpoint request submission.
+	 */
+	if (!port->port.tty)
+		goto out;
+
 	if (started) {
 		gs_start_tx(port);
 		/* Unblock any pending writes into our circular buffer, in case
 		 * we didn't in gs_start_tx() */
+		if (!port->port.tty)
+			goto out;
 		tty_wakeup(port->port.tty);
 	} else {
+out:
 		gs_free_requests(ep, head, &port->read_allocated);
 		gs_free_requests(port->port_usb->in, &port->write_pool,
 			&port->write_allocated);

fs/erofs/decompressor.c

@@ -330,7 +330,8 @@ static int z_erofs_transform_plain(struct z_erofs_decompress_req *rq,
 	unsigned int cur = 0, ni = 0, no, pi, po, insz, cnt;
 	u8 *kin;
 
-	DBG_BUGON(rq->outputsize > rq->inputsize);
+	if (rq->outputsize > rq->inputsize)
+		return -EOPNOTSUPP;
 	if (rq->alg == Z_EROFS_COMPRESSION_INTERLACED) {
 		cur = bs - (rq->pageofs_out & (bs - 1));
 		pi = (rq->pageofs_in + rq->inputsize - cur) & ~PAGE_MASK;

include/linux/pgsize_migration.h

@@ -62,6 +62,14 @@ extern void show_map_pad_vma(struct vm_area_struct *vma,
 
 extern void split_pad_vma(struct vm_area_struct *vma, struct vm_area_struct *new,
 			  unsigned long addr, int new_below);
+
+extern unsigned long vma_pad_fixup_flags(struct vm_area_struct *vma,
+					 unsigned long newflags);
+
+extern bool is_mergable_pad_vma(struct vm_area_struct *vma,
+				unsigned long vm_flags);
+
+extern unsigned long vma_data_pages(struct vm_area_struct *vma);
 #else /* PAGE_SIZE != SZ_4K || !defined(CONFIG_64BIT) */
 static inline void vma_set_pad_pages(struct vm_area_struct *vma,
 				     unsigned long nr_pages)
@@ -98,36 +106,22 @@ static inline void split_pad_vma(struct vm_area_struct *vma, struct vm_area_stru
 				 unsigned long addr, int new_below)
 {
 }
-#endif /* PAGE_SIZE == SZ_4K && defined(CONFIG_64BIT) */
 
-static inline unsigned long vma_data_pages(struct vm_area_struct *vma)
-{
-	return vma_pages(vma) - vma_pad_pages(vma);
-}
-
-/*
- * Sets the correct padding bits / flags for a VMA split.
- */
 static inline unsigned long vma_pad_fixup_flags(struct vm_area_struct *vma,
 						unsigned long newflags)
 {
-	if (newflags & VM_PAD_MASK)
-		return (newflags & ~VM_PAD_MASK) | (vma->vm_flags & VM_PAD_MASK);
-	else
-		return newflags;
+	return newflags;
 }
 
-/*
- * Merging of padding VMAs is uncommon, as padding is only allowed
- * from the linker context.
- *
- * To simplify the semantics, adjacent VMAs with padding are not
- * allowed to merge.
- */
 static inline bool is_mergable_pad_vma(struct vm_area_struct *vma,
 				       unsigned long vm_flags)
 {
-	/* Padding VMAs cannot be merged with other padding or real VMAs */
-	return !((vma->vm_flags | vm_flags) & VM_PAD_MASK);
+	return true;
 }
+
+static inline unsigned long vma_data_pages(struct vm_area_struct *vma)
+{
+	return vma_pages(vma);
+}
+#endif /* PAGE_SIZE == SZ_4K && defined(CONFIG_64BIT) */
 #endif /* _LINUX_PAGE_SIZE_MIGRATION_H */

include/linux/skbuff.h

@@ -872,6 +872,7 @@ struct sk_buff {
 		struct llist_node	ll_node;
 	};
 
+#ifdef __GENKSYMS__
 	/* ANDROID:
 	 * Put back the union removed in commit 7d0567842b78 ("inet:
 	 * inet_defrag: prevent sk release while still in use") to preserve the
@@ -881,6 +882,9 @@ struct sk_buff {
 		struct sock		*sk;
 		int			ip_defrag_offset;
 	};
+#else
+	struct sock		*sk;
+#endif
 
 	union {
 		ktime_t		tstamp;

include/ufs/ufshcd.h

@@ -425,6 +425,7 @@ struct ufs_saved_pwr_info {
  * @is_initialized: Indicates whether clock scaling is initialized or not
  * @is_busy_started: tracks if busy period has started or not
  * @is_suspended: tracks if devfreq is suspended or not
+ * @suspend_on_no_request: Flag to suspend clk scaling when there is no request
  */
 struct ufs_clk_scaling {
 	int active_reqs;
@@ -442,6 +443,10 @@ struct ufs_clk_scaling {
 	bool is_initialized;
 	bool is_busy_started;
 	bool is_suspended;
+	/* using hole here would not alter the overall size of the structure. */
+#ifndef __GENKSYMS__
+	bool suspend_on_no_request;
+#endif
 
 	ANDROID_KABI_RESERVE(1);
 };

mm/pgsize_migration.c

@@ -421,5 +421,37 @@ void split_pad_vma(struct vm_area_struct *vma, struct vm_area_struct *new,
 		vma_set_pad_pages(second, nr_vma2_pages);
 	}
 }
+
+/*
+ * Sets the correct padding bits / flags for a VMA split.
+ */
+unsigned long vma_pad_fixup_flags(struct vm_area_struct *vma,
+				  unsigned long newflags)
+{
+	if (newflags & VM_PAD_MASK)
+		return (newflags & ~VM_PAD_MASK) | (vma->vm_flags & VM_PAD_MASK);
+	else
+		return newflags;
+}
+
+/*
+ * Merging of padding VMAs is uncommon, as padding is only allowed
+ * from the linker context.
+ *
+ * To simplify the semantics, adjacent VMAs with padding are not
+ * allowed to merge.
+ */
+bool is_mergable_pad_vma(struct vm_area_struct *vma,
+			 unsigned long vm_flags)
+{
+	/* Padding VMAs cannot be merged with other padding or real VMAs */
+	return !((vma->vm_flags | vm_flags) & VM_PAD_MASK);
+}
+
+unsigned long vma_data_pages(struct vm_area_struct *vma)
+{
+	return vma_pages(vma) - vma_pad_pages(vma);
+}
+
 #endif /* PAGE_SIZE == SZ_4K */
 #endif /* CONFIG_64BIT */