Merge tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

https://source.android.com/docs/security/bulletin/2025-02-01
CVE-2024-53104
CVE-2025-0088

* tag 'ASB-2025-02-05_11-5.4' of https://android.googlesource.com/kernel/common: (449 commits)
  ANDROID: gki - change networking configuration
  ANDROID: kernelci build-break for 64-bit riscv clang builds (5.4 only)
  Revert "BACKPORT: RISC-V: Stop relying on GCC's register allocator's hueristics"
  Revert "ANDROID: declare sp_in_global outside of CONFIG_FRAME_POINTER"
  ANDROID: GKI: add Trimble symbol list
  UPSTREAM: selinux: ignore unknown extended permissions
  ANDROID: ABI: Update allowed list for galaxy
  Revert "netfilter: Replace zero-length array with flexible-array member"
  Revert "tracing: Constify string literal data member in struct trace_event_call"
  Revert "skb_expand_head() adjust skb->truesize incorrectly"
  Linux 5.4.289
  ftrace: use preempt_enable/disable notrace macros to avoid double fault
  mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
  drm: adv7511: Drop dsi single lane support
  net/sctp: Prevent autoclose integer overflow in sctp_association_init()
  sky2: Add device ID 11ab:4373 for Marvell 88E8075
  pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
  RDMA/uverbs: Prevent integer overflow issue
  modpost: fix the missed iteration for the max bit in do_input()
  modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host
  ...

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/clock/adi,axi-clkgen.yaml
	arch/arm64/boot/dts/vendor/bindings/clock/axi-clkgen.txt
	drivers/rpmsg/qcom_glink_native.c
	drivers/soc/qcom/socinfo.c

Change-Id: I60727e0cdd974fda5ca71f938bc2f984a8bbf19a

drivers/crypto/bcm/cipher.c

@@ -2478,6 +2478,7 @@ static int ahash_hmac_setkey(struct crypto_ahash *ahash, const u8 *key,
 
 static int ahash_hmac_init(struct ahash_request *req)
 {
+	int ret;
 	struct iproc_reqctx_s *rctx = ahash_request_ctx(req);
 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
 	struct iproc_ctx_s *ctx = crypto_ahash_ctx(tfm);
@@ -2487,7 +2488,9 @@ static int ahash_hmac_init(struct ahash_request *req)
 	flow_log("ahash_hmac_init()\n");
 
 	/* init the context as a hash */
-	ahash_init(req);
+	ret = ahash_init(req);
+	if (ret)
+		return ret;
 
 	if (!spu_no_incr_hash(ctx)) {
 		/* SPU-M can do incr hashing but needs sw for outer HMAC */

drivers/crypto/cavium/cpt/cptpf_main.c

@@ -45,7 +45,7 @@ static void cpt_disable_cores(struct cpt_device *cpt, u64 coremask,
 		dev_err(dev, "Cores still busy %llx", coremask);
 		grp = cpt_read_csr64(cpt->reg_base,
 				     CPTX_PF_EXEC_BUSY(0));
-		if (timeout--)
+		if (!timeout--)
 			break;
 
 		udelay(CSR_DELAY);
@@ -303,6 +303,8 @@ static int cpt_ucode_load_fw(struct cpt_device *cpt, const u8 *fw, bool is_ae)
 
 	ret = do_cpt_init(cpt, mcode);
 	if (ret) {
+		dma_free_coherent(&cpt->pdev->dev, mcode->code_size,
+				  mcode->code, mcode->phys_base);
 		dev_err(dev, "do_cpt_init failed with ret: %d\n", ret);
 		goto fw_release;
 	}
@@ -395,7 +397,7 @@ static void cpt_disable_all_cores(struct cpt_device *cpt)
 		dev_err(dev, "Cores still busy");
 		grp = cpt_read_csr64(cpt->reg_base,
 				     CPTX_PF_EXEC_BUSY(0));
-		if (timeout--)
+		if (!timeout--)
 			break;
 
 		udelay(CSR_DELAY);

drivers/crypto/chelsio/chtls/chtls_main.c

@@ -339,8 +339,9 @@ static struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl,
 	 * driver. Once driver synthesizes cpl_pass_accpet_req the skb will go
 	 * through the regular cpl_pass_accept_req processing in TOM.
 	 */
-	skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req)
-			- pktshift, GFP_ATOMIC);
+	skb = alloc_skb(size_add(gl->tot_len,
+				 sizeof(struct cpl_pass_accept_req)) -
+			pktshift, GFP_ATOMIC);
 	if (unlikely(!skb))
 		return NULL;
 	__skb_put(skb, gl->tot_len + sizeof(struct cpl_pass_accept_req)