UPDATE: 6.18.36

[fepitre-bot]

Update to 6.18.36

Details

Changes since previous version:
gregkh/linux@87dfb977bdb6 bpf: Free reuseport cBPF prog after RCU grace period.
gregkh/linux@22e26df355af ARM: group is_permission_fault() with is_translation_fault()
gregkh/linux@8bdb574b2176 ARM: allow __do_kernel_fault() to report execution of memory faults
gregkh/linux@05e22564a4f9 ARM: fix hash_name() fault
gregkh/linux@9e767af5f109 ARM: fix branch predictor hardening
gregkh/linux@97706097f9b8 KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
gregkh/linux@ffbcf31f032e i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
gregkh/linux@4203806f700b ipv6: mcast: Fix use-after-free when processing MLD queries
gregkh/linux@dcd90f42a33e net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
gregkh/linux@d5b57bb314d7 tee: optee: prevent use-after-free when the client exits before the supplicant
gregkh/linux@a171bc68e9af soc: qcom: ice: Allow explicit votes on 'iface' clock for ICE
gregkh/linux@9cb93ec617fb arm64: dts: qcom: x1-dell-thena: remove i2c20 (battery SMBus) and reserve its pins
gregkh/linux@40fc6ed12f91 ARM: dts: microchip: sam9x7: fix GMAC clock configuration
gregkh/linux@633db9a1991a soc: qcom: ice: Return -ENODEV if the ICE platform device is not found
gregkh/linux@ac7eca1ae4e5 tee: fix tee_ioctl_object_invoke_arg padding
gregkh/linux@8db2fabb5ecd tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()
gregkh/linux@50fd261b1ec4 erofs: tidy up synchronous decompression
gregkh/linux@00bf6868df65 erofs: fix use-after-free on sbi->sync_decompress
gregkh/linux@9dca67624721 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
gregkh/linux@e735dbd489e3 ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
gregkh/linux@cdaf13260c99 netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
gregkh/linux@25918720ba97 ipvs: clear the svc scheduler ptr early on edit
gregkh/linux@aaf80701dc2f netfilter: synproxy: add mutex to guard hook reference counting
gregkh/linux@9e5da2379f96 netfilter: conntrack_irc: fix possible out-of-bounds read
gregkh/linux@f071b0bf0781 netfilter: nft_ct: bail out on template ct in get eval
gregkh/linux@b18675263db1 netfilter: bridge: make ebt_snat ARP rewrite writable
gregkh/linux@42ff6774ecd9 dm cache policy smq: check allocation under invalidate lock
gregkh/linux@b60e9391142e net/sched: act_api: use RCU with deferred freeing for action lifecycle
gregkh/linux@c32f30ef5e66 6lowpan: fix off-by-one in multicast context address compression
gregkh/linux@e251d4cdfc72 l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
gregkh/linux@927f96861f93 devlink: Release nested relation on devlink free
gregkh/linux@e3f6ba5f8cf3 drm/imx: Fix three kernel-doc warnings in dcss-scaler.c
gregkh/linux@9b40c59bab08 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
gregkh/linux@83810d51d699 pcnet32: stop holding device spin lock during napi_complete_done
gregkh/linux@07f13816be5a net: Annotate sk->sk_write_space() for UDP SOCKMAP.
gregkh/linux@66a46e22396f hsr: Remove WARN_ONCE() in hsr_addr_is_self().
gregkh/linux@04e22fefac1a net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
gregkh/linux@76244b33640b net: lan743x: permit VLAN-tagged packets up to configured MTU
gregkh/linux@23bf7d5c250b net: fec: fix pinctrl default state restore order on resume
gregkh/linux@15be7e9fdbff ipv6: anycast: insert aca into global hash under idev->lock
gregkh/linux@fb8db813eba2 wifi: fix leak if split 6 GHz scanning fails
gregkh/linux@8802413ce631 Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
gregkh/linux@1a3c8ffbb469 Bluetooth: MGMT: validate advertising TLV before type checks
gregkh/linux@3eabc6d47a0a Bluetooth: RFCOMM: validate skb length in MCC handlers
gregkh/linux@7f5367f1ad9b Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling
gregkh/linux@c893e17d2809 Bluetooth: bnep: reject short frames before parsing
gregkh/linux@ce4b4cac3c57 Bluetooth: fix memory leak in error path of hci_alloc_dev()
gregkh/linux@33d677d2e371 Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
gregkh/linux@ab84fd7779a2 Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls
gregkh/linux@446a17b1b509 Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect
gregkh/linux@58d810354de1 Bluetooth: MGMT: Fix backward compatibility with userspace
gregkh/linux@0dfe05b93843 xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata()
gregkh/linux@ddf930f28be6 octeontx2-pf: Fix NDC sync operation errors
gregkh/linux@f010cf9aea01 octeontx2-af: Fix initialization of mcam's entry2target_pffunc field
gregkh/linux@91106d0348a5 af_unix: Fix inq_len update problem in partial read
gregkh/linux@a4f3fd651692 ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
gregkh/linux@9a263bbd1ec0 ptp: vclock: Switch from RCU to SRCU
gregkh/linux@6f829e2c17a5 net: airoha: Fix use-after-free in metadata dst teardown
gregkh/linux@e634408d2b0c net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
gregkh/linux@b198ed4e5258 net/sched: fix pedit partial COW leading to page cache corruption
gregkh/linux@cc272185c9a9 sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
gregkh/linux@eb676fb14427 octeontx2-af: npc: Fix CPT channel mask in npc_install_flow
gregkh/linux@8e4d1188bad7 vxlan: vnifilter: send notification on VNI add
gregkh/linux@3b7ee029b556 vxlan: vnifilter: fix spurious notification on VNI update
gregkh/linux@285b0842f2e0 ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
gregkh/linux@42446ca0f357 net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
gregkh/linux@a6207349e703 sctp: purge outqueue on stale COOKIE-ECHO handling
gregkh/linux@1639df1a9844 Drivers: hv: VMBus protocol version 6.0
gregkh/linux@b0f77f76231b Drivers: hv: vmbus: Provide option to skip VMBus unload on panic
gregkh/linux@752e22ecf4df drm/hyperv: During panic do VMBus unload after frame buffer is flushed
gregkh/linux@6dc6e5b5c32e selftests: harness: fix pidfd leak in __wait_for_test
gregkh/linux@8c046f36222c signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
gregkh/linux@ed0ad6574126 hyperv: Clean up and fix the guest ID comment in hvgdk.h
gregkh/linux@6b71956c25f9 time: Fix off-by-one in settimeofday() usec validation
gregkh/linux@cd98837db15f ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
gregkh/linux@6671a46144f8 ALSA: seq: dummy: fix UMP event stack overread
gregkh/linux@63a9f6012f45 spi: cadence-quadspi: fix unclocked access on unbind
gregkh/linux@65046b0d853d cpufreq/amd-pstate: drop stale @epp_cached kdoc
gregkh/linux@618193aba6fe tools/rv: Ensure monitor name and desc are NUL-terminated
gregkh/linux@2122d68f0864 tools/rv: Fix substring match bug in monitor name search
gregkh/linux@fd1923910bbf tools/rv: Fix substring match when listing container monitors
gregkh/linux@73590b4cfd05 tools/rv: Fix cleanup after failed trace setup
gregkh/linux@43ad0a0da486 verification/rvgen: Fix options shared among commands
gregkh/linux@0c03692e2372 verification/rvgen: Fix ltl2k writing True as a literal
gregkh/linux@e27c17346628 tap: free page on error paths in tap_get_user_xdp()
gregkh/linux@8d9a79fbf517 xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
gregkh/linux@4ee4d628c4d9 dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments
gregkh/linux@5513dcb378f9 dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device
gregkh/linux@b5316e2b8614 xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
gregkh/linux@6bdbe6f43ecf ice: fix missing priority callbacks for U.FL DPLL pins
gregkh/linux@640edc281d2f idpf: fix mailbox capability for set device clock time
gregkh/linux@6b8baf42b1b7 net: ena: PHC: Add missing barrier
gregkh/linux@972c106f5d01 bnge: fix context mem iteration
gregkh/linux@0c4bb32ad7fd netlabel: validate unlabeled address and mask attribute lengths
gregkh/linux@6136c1474db8 gpio: mvebu: fix NULL pointer dereference in suspend/resume
gregkh/linux@12e579b88962 ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
gregkh/linux@ede69b8f6670 tcp: restrict SO_ATTACH_FILTER to priv users
gregkh/linux@0cde3a004119 net: add pskb_may_pull() to skb_gro_receive_list()
gregkh/linux@8b0541231091 net/mlx4: avoid GCC 10 __bad_copy_from() false positive
gregkh/linux@c09c2e236eef net: ibm: emac: Fix use-after-free during device removal
gregkh/linux@c299321bc623 netdev: fix double-free in netdev_nl_bind_rx_doit()
gregkh/linux@3a254779c169 net: phy: clean the sfp upstream if phy probing fails
gregkh/linux@ab269990ed58 net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
gregkh/linux@0f807764bb12 net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list
gregkh/linux@2789b74ae1f4 net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
gregkh/linux@289c06418ed9 net/mlx5: Use effective affinity mask for IRQ selection
gregkh/linux@2fa49b2715e1 ipv6: sit: reload inner IPv6 header after GSO offloads
gregkh/linux@ecc55aad3390 net: openvswitch: fix possible kfree_skb of ERR_PTR
gregkh/linux@c838ffc154cb r8152: handle the return value of usb_reset_device()
gregkh/linux@5d4bca5cbb69 gpio: zynq: fix runtime PM leak on remove
gregkh/linux@bace7b99bfa5 gpio: rockchip: fix generic IRQ chip leak on remove
gregkh/linux@9c46f3ee1837 net: mctp: usb: fix race between urb completion and rx_retry cancellation
gregkh/linux@6c75ee4d1d40 net: mctp: usb: don't fail mctp_usb_rx_queue on a deferred submission
gregkh/linux@d23d53355300 ASoC: SOF: amd: fix for ipc flags check
gregkh/linux@f76a8b323e28 sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
gregkh/linux@ecf8904067dc ip6_vti: set netns_immutable on the fallback device.
gregkh/linux@7560afb8cdda sctp: validate embedded INIT chunk and address list lengths in cookie
gregkh/linux@3dde4fb941fa net: guard timestamp cmsgs to real error queue skbs
gregkh/linux@dcf458120add net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
gregkh/linux@5fd1fa5a4254 tun: zero the whole vnet header in tun_put_user()
gregkh/linux@2abfb19bbb81 ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
gregkh/linux@5ae8a38169fc rds: mark snapshot pages dirty in rds_info_getsockopt()
gregkh/linux@865e94f6d8a5 spi: rzv2h-rspi: Fix SPDR read access width for 16-bit RX
gregkh/linux@4beffcd726e2 netfilter: revalidate bridge ports
gregkh/linux@9d017671dcfc netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
gregkh/linux@08a3e218064d netfilter: x_tables: avoid leaking percpu counter pointers
gregkh/linux@af1b7699466f netfilter: nf_log: validate MAC header was set before dumping it
gregkh/linux@78069a6d8bc8 netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
gregkh/linux@a13199fa224e net: mvpp2: sync RX data at the hardware packet offset
gregkh/linux@910617a4e67d net: mvpp2: limit XDP frame size to the RX buffer
gregkh/linux@8a2126c5afe8 net: mvpp2: refill RX buffers before XDP or skb use
gregkh/linux@af08fe9ba091 net: mvpp2: build skb from XDP-adjusted data on XDP_PASS
gregkh/linux@7649ba2b1291 net: txgbe: optimize the flow to setup PHY for AML devices
gregkh/linux@9157060fed92 net: txgbe: support CR modules for AML devices
gregkh/linux@19a4d2aace1d net: txgbe: rename the SFP related
gregkh/linux@2c98343c9b23 net: txgbe: initialize module info buffer
gregkh/linux@07d9a0870a17 ipv6: Fix a potential NPD in cleanup_prefix_route()
gregkh/linux@f34689e7a0b3 KVM: VMX: Update SVI during runtime APICv activation
gregkh/linux@656939c67595 clk: qcom: x1e80100-dispcc: Stop disp_cc_mdss_mdp_clk_src from getting parked
gregkh/linux@3a4fc3617b7e clk: samsung: gs101: Fix missing USI7_USI DIV clock in peric0_clk_regs
gregkh/linux@489f6d759fa4 clk: qcom: dispcc-sc8280xp: Don't park mdp_clk_src at registration time
gregkh/linux@dda720b2928d drm/i915/edp: Check supported link rates DPCD read
gregkh/linux@19a6a00ff50c drm/virtio: Fix driver removal with disabled KMS
gregkh/linux@02f5e4db57c0 drm/vc4: fix krealloc() memory leak
gregkh/linux@361e97d81331 drm/xe: fix refcount leak in xe_range_fence_insert()
gregkh/linux@e83fc4c28226 accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
gregkh/linux@941d7394efda netfilter: nft_tunnel: fix use-after-free on object destroy
gregkh/linux@07acb9798477 netfilter: nft_meta_bridge: fix stale stack leak via IIFHWADDR register
gregkh/linux@c10c9c48b290 tee: shm: fix shm leak in register_shm_helper()
gregkh/linux@dafc9f57140e Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
gregkh/linux@dedc92b96dc1 Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
gregkh/linux@cc160ce08540 soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get()
gregkh/linux@dd77a83915b0 mm/memory-failure: fix hugetlb_lock AA deadlock in get_huge_page_for_hwpoison
gregkh/linux@8ec70c0dbdf0 accel/ivpu: Add bounds checks for firmware log indices
gregkh/linux@fa598556ecef accel/ivpu: Add buffer overflow check in MS get_info_ioctl
gregkh/linux@45cb105b8642 accel/ivpu: Fix signed integer truncation in IPC receive
gregkh/linux@09df291fdf96 tracing: Fix CFI violation in probestub being called by tprobes
gregkh/linux@592be0dc491d tracing/probes: Point the error offset correctly for eprobe argument error
gregkh/linux@00875811f372 rust: x86: support Rust >= 1.98.0 target spec
gregkh/linux@5037b2ee1a17 ARM: Do not select HAVE_RUST when KASAN is enabled
gregkh/linux@d0f25a1755f2 rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
gregkh/linux@a0a4600b396b rust: kasan/kbuild: fix rustc-option when cross-compiling
gregkh/linux@8bcbedce9bfa mmc: litex_mmc: Use DIV_ROUND_UP for more accurate clock calculation
gregkh/linux@0864bdde152e mshv: add a missing padding field
gregkh/linux@343e95c8ecc4 KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
gregkh/linux@196f1ee137eb KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
gregkh/linux@0b79bcff7210 KVM: arm64: Restore POR_EL0 access to host EL0
gregkh/linux@32d4c5d328a3 drm/i915/gem: Fix phys BO pread/pwrite with offset
gregkh/linux@0b38870d81ab hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
gregkh/linux@14d2eee0193a ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
gregkh/linux@f9b38a8fbfa0 xfrm: espintcp: do not reuse an in-progress partial send
gregkh/linux@dd66f7f6e360 xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
gregkh/linux@a13ca53e47e5 xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
gregkh/linux@f96cf7bf9fbf USB: serial: io_ti: fix heap overflow in get_manuf_info()
gregkh/linux@294692d3296e USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
gregkh/linux@85bd2b3afa0a USB: serial: option: add usb-id for Dell Wireless DW5826e-m
gregkh/linux@372f33ebed74 USB: serial: kl5kusb105: fix bulk-out buffer overflow
gregkh/linux@f46093dd2296 ALSA: timer: Forcibly close timer instances at closing
gregkh/linux@3d39da65b5c4 ALSA: timer: Fix UAF at snd_timer_user_params()
gregkh/linux@0bbc9481f970 io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
gregkh/linux@8348567a6afb drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
gregkh/linux@edabfe80e34e drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info()
gregkh/linux@5f5b604e1e6b mm/huge_memory: update file PMD counter before folio_put()
gregkh/linux@cb5230b6d8a0 mm/damon/ops-common: call folio_test_lru() after folio_get()
gregkh/linux@e99807bdcd20 mm/huge_memory: update file PUD counter before folio_put()
gregkh/linux@96b6e98ff12d RDMA/core: Validate the passed in fops for ib_get_ucaps()
gregkh/linux@bd5e818be796 RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc
gregkh/linux@f92a285db7ff RDMA/srp: bound SRP_RSP sense copy by the received length
gregkh/linux@c96786d6ff1a zram: fix use-after-free in zram_bvec_write_partial()
gregkh/linux@6822eed69572 udp: clear skb->dev before running a sockmap verdict
gregkh/linux@6243a363ec90 ARM: socfpga: Fix OF node refcount leak in SMP setup
gregkh/linux@da295adc9dab ARM: 9474/1: io: avoid KASAN instrumentation of raw halfword I/O
gregkh/linux@517720913bd3 ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
gregkh/linux@95f27fcda681 arm64: mm: call pagetable dtor when freeing hot-removed page tables
gregkh/linux@edaf0c955ace mptcp: fix retransmission loop when csum is enabled
gregkh/linux@3b8cbba7c0ed mptcp: close TOCTOU race while computing rcv_wnd
gregkh/linux@653245266913 mptcp: allow subflow rcv wnd to shrink
gregkh/linux@c0c152fc4ae6 mptcp: pm: fix extra_subflows underflow on userspace PM subflow creation
gregkh/linux@f591cbc088c9 mptcp: sockopt: check timestamping ret value
gregkh/linux@7bbc11437a20 mptcp: sockopt: set sockopt on all subflows
gregkh/linux@6ea1134f1b5f selftests: mptcp: add test for extra_subflows underflow on userspace PM
gregkh/linux@9f21885c11ba mptcp: add-addr: always drop other suboptions
gregkh/linux@d84ed2f9718e xfs: fix error returns in CoW fork repair
gregkh/linux@fcfdff42e841 xfs: fix rtgroup cleanup in CoW fork repair
gregkh/linux@ac2000be0cbe wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
gregkh/linux@265c07c09c83 wifi: nl80211: reject oversized EMA RNR lists
gregkh/linux@ba9ad6015937 vsock/vmci: fix sk_ack_backlog leak on failed handshake
gregkh/linux@1d6c2062b77b timers/migration: Fix livelock in tmigr_handle_remote_up()
gregkh/linux@735dabdf2156 staging: rtl8723bs: fix buffer over-read in rtw_update_protection
gregkh/linux@6f72b902c34d ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
gregkh/linux@3884976f8744 bnxt_en: Fix NULL pointer dereference
gregkh/linux@32138633e51e fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
gregkh/linux@df422fd273c9 IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
gregkh/linux@89b909e97045 inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
gregkh/linux@2990f143ec86 pidfd: refuse access to tasks that have started exiting harder
gregkh/linux@57a9c085be07 fs/qnx6: fix pointer arithmetic in directory iteration
gregkh/linux@12df4cfa738a fuse: reject fuse_notify() pagecache ops on directories
gregkh/linux@56763afa0134 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
gregkh/linux@16f8e17184b3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
gregkh/linux@b39f30c0a72f i2c: imx-lpi2c: fix resource leaks switching to devm_dma_request_chan()
gregkh/linux@9fa82cf393ba i2c: imx: fix clock and pinctrl state inconsistency in runtime PM
gregkh/linux@a162a260c8c4 i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
gregkh/linux@6018d73137cd i2c: stm32f7: fix timing computation ignoring i2c-analog-filter
gregkh/linux@7f59e4f72a78 i2c: tegra: Fix NOIRQ suspend/resume
gregkh/linux@a3dff1e1a554 Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
gregkh/linux@f35a368fee8a Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
gregkh/linux@ab61c990a87d iommu/dma: Do not try to iommu_map a 0 length region in swiotlb
gregkh/linux@db752ebfdaf2 ipc/shm: serialize orphan cleanup with shm_nattch updates
gregkh/linux@a388e3dfaf95 locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
gregkh/linux@89bd8215e25a memcg: use round-robin victim selection in refill_stock
gregkh/linux@5278ccd357e0 misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
gregkh/linux@992f121796b7 misc: fastrpc: fix use-after-free race in fastrpc_map_create
gregkh/linux@53e06f8a3c2b misc: fastrpc: fix DMA address corruption due to find_vma misuse
gregkh/linux@d5de9cb5355d misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
gregkh/linux@0a46c7a5646d firmware: samsung: acpm: Fix mailbox channel leak on probe error
gregkh/linux@e0df4d9c0909 net/mlx5: Reorder completion before putting command entry in cmd_work_handler
gregkh/linux@01f7d4b50458 net: airoha: Add NULL check for of_reserved_mem_lookup() in airoha_qdma_init_hfwd_queues()
gregkh/linux@bcb8fad90f27 net: bonding: fix NULL pointer dereference in bond_do_ioctl()
gregkh/linux@4a73cacb5586 net: mv643xx: fix OF node refcount
gregkh/linux@52b8f5ef82c8 net: phonet: free phonet_device after RCU grace period
gregkh/linux@1d4ec754ee38 net: rds: clear i_sends on setup unwind
gregkh/linux@bef389a210e7 net: sfp: initialize i2c_block_size at adapter configure time
gregkh/linux@cb85ef5a227b nvmem: core: fix use-after-free bugs in error paths
gregkh/linux@4a4d21f531cc nvmem: layouts: onie-tlv: fix hang on unknown types
gregkh/linux@e646b86b3b48 octeontx2-af: fix memory leak in rvu_setup_hw_resources()
gregkh/linux@3fdcca838f97 pinctrl: mcp23s08: Read spi-present-mask as u8 not u32
gregkh/linux@c888d5198ffc io_uring/kbuf: don't truncate end buffer for bundles
gregkh/linux@d5d37b7b72a9 io_uring/wait: fix min_timeout behavior
gregkh/linux@52078596dce1 mm/cma: fix reserved page leak on activation failure
gregkh/linux@d83390b21a02 mm/cma_debug: fix invalid accesses for inactive CMA areas
gregkh/linux@6d48f1565939 mm/damon/lru_sort: handle ctx allocation failure
gregkh/linux@66bc00ea37fa mm/damon/reclaim: handle ctx allocation failure
gregkh/linux@ecc24f0a8a30 mm/hugetlb: avoid false positive lockdep assertion
gregkh/linux@c72469ac0f27 mm/hugetlb: restore reservation on error in hugetlb folio copy paths
gregkh/linux@c19ff4351214 mm/list_lru: drain before clearing xarray entry on reparent
gregkh/linux@a8f91ddf67f6 mm/mincore: handle non-swap entries before !CONFIG_SWAP guard
gregkh/linux@c677b13671dc mmc: core: Fix host controller programming for fixed driver type
gregkh/linux@7f8007be13e6 mmc: dw_mmc-rockchip: Add missing private data for very old controllers
gregkh/linux@2f72d36f8acc mmc: litex_mmc: Set mandatory idle clocks before CMD0
gregkh/linux@535ff092b686 mmc: renesas_sdhi: Add OF entry for RZ/G2H SoC
gregkh/linux@0aecf3c7b8f8 mmc: sdhci: add signal voltage switch in sdhci_resume_host
gregkh/linux@0d11992d1898 pmdomain: imx: fix OF node refcount
gregkh/linux@ddcf84b25af0 pmdomain: ti_sci: add wakeup constraint to parent devices of wakeup source
gregkh/linux@54f9cdcd7311 rtase: Avoid sleeping in get_stats64()
gregkh/linux@1bf84f4013fa rtase: Reset TX subqueue when clearing TX ring
gregkh/linux@566c4c1244de rxrpc: Fix the ACK parser to extract the SACK table for parsing
gregkh/linux@78c4f964b2f9 sctp: diag: reject stale associations in dump_one path
gregkh/linux@d5ea0b3e261f sctp: stream: fully roll back denied add-stream state
gregkh/linux@2e0ddac549eb thunderbolt: Reject zero-length property entries in validator
gregkh/linux@60ba62174607 thunderbolt: Bound root directory content to block size
gregkh/linux@fcbd0cdab928 thunderbolt: Clamp XDomain response data copy to allocation size
gregkh/linux@46da5c3ea011 thunderbolt: Validate XDomain request packet size before type cast
gregkh/linux@b5daa920f44c thunderbolt: Limit XDomain response copy to actual frame size
gregkh/linux@6890bd2451a9 slimbus: qcom-ngd-ctrl: fix OF node refcount
gregkh/linux@d6cb003e4661 slimbus: qcom-ngd-ctrl: Fix up platform_driver registration
gregkh/linux@3bb2ac834ed3 slimbus: qcom-ngd-ctrl: Fix probe error path ordering
gregkh/linux@24ec89123fc9 slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd
gregkh/linux@dd8e1025a84e slimbus: qcom-ngd-ctrl: Initialize controller resources in controller
gregkh/linux@5204cd22c1c7 slimbus: qcom-ngd-ctrl: Correct PDR and SSR cleanup ownership
gregkh/linux@8f4b371f4939 slimbus: qcom-ngd-ctrl: Balance pm_runtime enablement for NGD
gregkh/linux@9f0d45d509b4 slimbus: qcom-ngd-ctrl: Avoid ABBA on tx_lock/ctrl->lock
gregkh/linux@c0639ede2f24 drm/gem: Try to fix change_handle ioctl, attempt 4
gregkh/linux@72e259a32084 drm/amdkfd: fix NULL dereference in get_queue_ids()
gregkh/linux@d3efcadfe3ee drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
gregkh/linux@0f68ddfaaebf drm/xe/display: fix oops in suspend/shutdown without display
gregkh/linux@4c10fd55187a drm/xe: Clear pending_disable before signaling suspend fence
gregkh/linux@11e9bdf8824b drm/v3d: Wait for pending L2T flush before cleaning caches
gregkh/linux@3e1947573140 drm/v3d: Fix global performance monitor reference counting
gregkh/linux@90b629269088 drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
gregkh/linux@9655b56b6de9 drm/v3d: Skip CSD when it has zeroed workgroups
gregkh/linux@68455b117258 drm/amdgpu: fix waiting for all submissions for userptrs
gregkh/linux@fcd51a085e9a drm/amdgpu: restart the CS if some parts of the VM are still invalidated
gregkh/linux@39b5397bf8de drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
gregkh/linux@8979ded4d899 drm/amd/pm: fix smu13 power limit default/cap calculation
gregkh/linux@932642791cb1 drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2
gregkh/linux@57607fe55e6d drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
gregkh/linux@0e56f460bddb drm/amd/display: Bound VBIOS record-chain walk loops
gregkh/linux@1906064d50d1 drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
gregkh/linux@3f32d52ec604 drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
gregkh/linux@c000da79df78 drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs
gregkh/linux@bb6f705b73b5 drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
gregkh/linux@454d3b3d499c drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
gregkh/linux@e09689286385 drm/amd/display: Use krealloc_array() in dal_vector_reserve()
gregkh/linux@20a93e397abe fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
gregkh/linux@17faa39ba980 driver core: reject devices with unregistered buses
gregkh/linux@4dac39a4db14 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
gregkh/linux@37c059d4d92f wifi: mac80211: tests: mark HT check strict
gregkh/linux@0ffcad63b19a sched_ext: Don't warn on NULL cgrp_moving_from in scx_cgroup_move_task()
gregkh/linux@ceddd32231dd RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper
gregkh/linux@5f3286ca5fbb RDMA/umem: Move umem dmabuf revoke logic into helper function
gregkh/linux@f58efaf9fcf7 RDMA/umem: Add helpers for umem dmabuf revoke lock
gregkh/linux@2904e985a291 RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
gregkh/linux@84d8f58cf28a netfilter: nft_fib: fix stale stack leak via the OIFNAME register
gregkh/linux@ebf22feff492 RDMA/umem: fix kernel-doc warnings
gregkh/linux@cd26d54bfbc2 RDMA: Move DMA block iterator logic into dedicated files
gregkh/linux@afd35fec9297 RDMA/umem: Fix truncation for block sizes >= 4G
gregkh/linux@cdce1e797add ipvs: skip ipv6 extension headers for csum checks
gregkh/linux@9bdc637fde66 vsock/virtio: fix potential unbounded skb queue
gregkh/linux@eca6743b148a vsock/virtio: fix skb overhead accounting to preserve full buf_alloc
gregkh/linux@e9ea7cb17677 arm64: cputype: Add C1-Ultra definitions
gregkh/linux@8097f93f9b77 arm64: cputype: Add C1-Premium definitions
gregkh/linux@d4fd42822040 arm64: errata: Mitigate TLBI errata on various Arm CPUs
gregkh/linux@99abe00c605e arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
gregkh/linux@7b569b3a2f29 arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
gregkh/linux@36a0faaa4e3d block: fix handling of dead zone write plugs
gregkh/linux@f455405e3207 vsock/virtio: fix skb overhead overflow on 32-bit builds
gregkh/linux@bf7a9cacd95e cfi: Include uaccess.h for get_kernel_nofault()
gregkh/linux@5d634afb8b83 netfilter: require Ethernet MAC header before using eth_hdr()
gregkh/linux@275d294b2b24 Linux 6.18.36