Merge 5.10.165 into android12-5.10-lts

Changes in 5.10.165
	btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
	pNFS/filelayout: Fix coalescing test for single DS
	selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
	tools/virtio: initialize spinlocks in vring_test.c
	net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
	RDMA/srp: Move large values to a new enum for gcc13
	btrfs: always report error in run_one_delayed_ref()
	x86/asm: Fix an assembler warning with current binutils
	f2fs: let's avoid panic if extent_tree is not created
	wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
	wifi: mac80211: sdata can be NULL during AMPDU start
	Add exception protection processing for vd in axi_chan_handle_err function
	zonefs: Detect append writes at invalid locations
	nilfs2: fix general protection fault in nilfs_btree_insert()
	efi: fix userspace infinite retry read efivars after EFI runtime services page fault
	ALSA: hda/realtek - Turn on power early
	drm/i915/gt: Reset twice
	Bluetooth: hci_qca: Wait for timeout during suspend
	Bluetooth: hci_qca: Fix driver shutdown on closed serdev
	io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL
	io_uring: improve send/recv error handling
	io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly
	io_uring: add flag for disabling provided buffer recycling
	io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG)
	io_uring: allow re-poll if we made progress
	io_uring: fix async accept on O_NONBLOCK sockets
	io_uring: check for valid register opcode earlier
	io_uring: lock overflowing for IOPOLL
	io_uring: fix CQ waiting timeout handling
	io_uring: ensure that cached task references are always put on exit
	io_uring: remove duplicated calls to io_kiocb_ppos
	io_uring: update kiocb->ki_pos at execution time
	io_uring: do not recalculate ppos unnecessarily
	io_uring/rw: defer fsnotify calls to task context
	xhci-pci: set the dma max_seg_size
	usb: xhci: Check endpoint is valid before dereferencing it
	xhci: Fix null pointer dereference when host dies
	xhci: Add update_hub_device override for PCI xHCI hosts
	xhci: Add a flag to disable USB3 lpm on a xhci root port level.
	usb: acpi: add helper to check port lpm capability using acpi _DSM
	xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
	prlimit: do_prlimit needs to have a speculation check
	USB: serial: option: add Quectel EM05-G (GR) modem
	USB: serial: option: add Quectel EM05-G (CS) modem
	USB: serial: option: add Quectel EM05-G (RS) modem
	USB: serial: option: add Quectel EC200U modem
	USB: serial: option: add Quectel EM05CN (SG) modem
	USB: serial: option: add Quectel EM05CN modem
	staging: vchiq_arm: fix enum vchiq_status return types
	USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
	misc: fastrpc: Don't remove map on creater_process and device_release
	misc: fastrpc: Fix use-after-free race condition for maps
	usb: core: hub: disable autosuspend for TI TUSB8041
	comedi: adv_pci1760: Fix PWM instruction handling
	mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
	mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
	btrfs: fix race between quota rescan and disable leading to NULL pointer deref
	cifs: do not include page data when checking signature
	thunderbolt: Use correct function to calculate maximum USB3 link rate
	tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
	USB: gadgetfs: Fix race between mounting and unmounting
	USB: serial: cp210x: add SCALANCE LPE-9000 device id
	usb: host: ehci-fsl: Fix module alias
	usb: typec: altmodes/displayport: Add pin assignment helper
	usb: typec: altmodes/displayport: Fix pin assignment calculation
	usb: gadget: g_webcam: Send color matching descriptor per frame
	usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
	usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
	dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
	dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
	serial: pch_uart: Pass correct sg to dma_unmap_sg()
	dmaengine: tegra210-adma: fix global intr clear
	serial: atmel: fix incorrect baudrate setup
	gsmi: fix null-deref in gsmi_get_variable
	mei: me: add meteor lake point M DID
	drm/i915: re-disable RC6p on Sandy Bridge
	drm/amd/display: Fix set scaling doesn's work
	drm/amd/display: Calculate output_color_space after pixel encoding adjustment
	drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
	arm64: efi: Execute runtime services from a dedicated stack
	efi: rt-wrapper: Add missing include
	Revert "drm/amdgpu: make display pinning more flexible (v2)"
	x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
	tracing: Use alignof__(struct {type b;}) instead of offsetof()
	io_uring: io_kiocb_update_pos() should not touch file for non -1 offset
	io_uring/net: fix fast_iov assignment in io_setup_async_msg()
	net/ulp: use consistent error code when blocking ULP
	net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
	Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
	soc: qcom: apr: Make qcom,protection-domain optional again
	Bluetooth: hci_qca: Wait for SSR completion during suspend
	Bluetooth: hci_qca: check for SSR triggered flag while suspend
	Bluetooth: hci_qca: Fixed issue during suspend
	mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
	io_uring: Clean up a false-positive warning from GCC 9.3.0
	io_uring: fix double poll leak on repolling
	io_uring/rw: ensure kiocb_end_write() is always called
	io_uring/rw: remove leftover debug statement
	Linux 5.10.165

Change-Id: Icb91157d9fa1b56cd79eedb8a9cc6118d0705244
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

kernel/sys.c

@@ -1558,6 +1558,8 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
 
 	if (resource >= RLIM_NLIMITS)
 		return -EINVAL;
+	resource = array_index_nospec(resource, RLIM_NLIMITS);
+
 	if (new_rlim) {
 		if (new_rlim->rlim_cur > new_rlim->rlim_max)
 			return -EINVAL;