Merge branch 'android11-5.4-lts' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

* 'android11-5.4-lts' of https://android.googlesource.com/kernel/common:
  Revert "genirq: Provide new interfaces for affinity hints"
  Revert "i40e: Use irq_update_affinity_hint()"
  Revert "i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path"
  Linux 5.4.300
  mm/hugetlb: fix folio is still mapped when deleted
  i40e: add mask to apply valid bits for itr_idx
  i40e: fix validation of VF state in get resources
  i40e: fix idx validation in config queues msg
  i40e: add validation for ring_len param
  i40e: increase max descriptors for XL710
  mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
  fbcon: Fix OOB access in font allocation
  fbcon: fix integer overflow in fbcon_do_set_font
  i40e: add max boundary check for VF filters
  i40e: fix input validation logic for action_meta
  i40e: fix idx validation in i40e_validate_queue_map
  drm/gma500: Fix null dereference in hdmi teardown
  can: peak_usb: fix shift-out-of-bounds issue
  can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
  can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
  can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
  can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
  IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
  usb: core: Add 0x prefix to quirks debug output
  ALSA: usb-audio: Fix build with CONFIG_INPUT=n
  ALSA: usb-audio: Convert comma to semicolon
  ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
  ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
  ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
  ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
  ALSA: usb-audio: Fix block comments in mixer_quirks
  KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active
  net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
  net: rfkill: gpio: add DT support
  serial: sc16is7xx: fix bug in flow control levels init
  USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels
  usb: gadget: dummy_hcd: remove usage of list iterator past the loop body
  ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message
  ASoC: wm8974: Correct PLL rate rounding
  ASoC: wm8940: Correct typo in control name
  rds: ib: Increment i_fastreg_wrs before bailing out
  mmc: mvsdio: Fix dma_unmap_sg() nents value
  power: supply: bq27xxx: restrict no-battery detection to bq27000
  power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery
  nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/*
  cnic: Fix use-after-free bugs in cnic_delete_task
  net: liquidio: fix overflow in octeon_init_instr_queue()
  Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set"
  tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
  i40e: remove redundant memory barrier when cleaning Tx descs
  net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure
  cgroup: split cgroup_destroy_wq into 3 workqueues
  pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
  wifi: mac80211: fix incorrect type for ret
  ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported
  mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
  soc: qcom: mdt_loader: Deal with zero e_shentsize
  phy: ti-pipe3: fix device leak at unbind
  dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
  dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
  can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails
  can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed
  i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
  i40e: Use irq_update_affinity_hint()
  genirq: Provide new interfaces for affinity hints
  genirq: Export affinity setter for modules
  genirq/affinity: Add irq_update_affinity_desc()
  igb: fix link test skipping when interface is admin down
  net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
  USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions
  USB: serial: option: add Telit Cinterion FN990A w/audio compositions
  tty: hvc_console: Call hvc_kick in hvc_write unconditionally
  mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing
  mtd: nand: raw: atmel: Fix comment in timings preparation
  mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer
  mm/khugepaged: fix the address passed to notifier on testing young
  fuse: prevent overflow in copy_file_range return value
  fuse: check if copy_file_range() returns larger than requested size
  mtd: rawnand: stm32_fmc2: fix ECC overwrite
  ocfs2: fix recursive semaphore deadlock in fiemap call
  EDAC/altera: Delete an inappropriate dma_free_coherent() call
  tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
  NFSv4: Don't clear capabilities that won't be reset
  net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
  usb: hub: Fix flushing of delayed work used for post resume purposes

Change-Id: I9cbae559320c1ca8d46d8443b8ce47f1c9a50f4b

net/ipv4/tcp.c

@@ -2601,6 +2601,7 @@ int tcp_disconnect(struct sock *sk, int flags)
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct tcp_sock *tp = tcp_sk(sk);
 	int old_state = sk->sk_state;
+	struct request_sock *req;
 	u32 seq;
 
 	if (old_state != TCP_CLOSE)
@@ -2712,6 +2713,10 @@ int tcp_disconnect(struct sock *sk, int flags)
 
 
 	/* Clean up fastopen related fields */
+	req = rcu_dereference_protected(tp->fastopen_rsk,
+					lockdep_sock_is_held(sk));
+	if (req)
+		reqsk_fastopen_remove(sk, req, false);
 	tcp_free_fastopen_req(tp);
 	inet->defer_connect = 0;
 	tp->fastopen_client_fail = 0;

net/ipv4/tcp_bpf.c

@@ -336,8 +336,11 @@ more_data:
 		if (!psock->cork) {
 			psock->cork = kzalloc(sizeof(*psock->cork),
 					      GFP_ATOMIC | __GFP_NOWARN);
-			if (!psock->cork)
+			if (!psock->cork) {
+				sk_msg_free(sk, msg);
+				*copied = 0;
 				return -ENOMEM;
+			}
 		}
 		memcpy(psock->cork, msg, sizeof(*msg));
 		return 0;