UPDATE: 6.18.20

[fepitre-bot]

Update to 6.18.20

Details

Changes since previous version:
gregkh/linux@dd26ea937ef5 Linux 6.18.20
gregkh/linux@a52e3970f971 xen/privcmd: add boot control for restricted usage in domU
gregkh/linux@389bae9a4409 xen/privcmd: restrict usage in unprivileged domU
gregkh/linux@f909f22f5cec hwmon: (max6639) Fix pulses-per-revolution implementation
gregkh/linux@96955cf9f5ba arm64: realm: Fix PTE_NS_SHARED for 52bit PA support
gregkh/linux@ef6e6484747e tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
gregkh/linux@d03e8c281fd3 lib/bootconfig: check xbc_init_node() return in override path
gregkh/linux@3ab1d7c8b6b7 fs/tests: exec: Remove bad test vector
gregkh/linux@cf4b224ffb9a drm/i915/gt: Check set_default_submission() before deferencing
gregkh/linux@a5828c14a9e3 ksmbd: fix use-after-free in durable v2 replay of active file handles
gregkh/linux@7f7468fd2a75 ksmbd: fix use-after-free of share_conf in compound request
gregkh/linux@2cb24caacee2 drm/bridge: dw-hdmi-qp: fix multi-channel audio output
gregkh/linux@c51a5319bf65 drm/amd: fix dcn 2.01 check
gregkh/linux@430334e9e4e8 drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr()
gregkh/linux@58abeb7b9562 iommu/sva: Fix crash in iommu_sva_unbind_device()
gregkh/linux@3f300a41a366 drm/vmwgfx: Don't overwrite KMS surface dirty tracker
gregkh/linux@bec21d97c968 spi: amlogic-spisg: Fix memory leak in aml_spisg_probe()
gregkh/linux@f15e0706e366 spi: amlogic: spifc-a4: Remove redundant clock cleanup
gregkh/linux@a9e119d027fd mtd: rawnand: brcmnand: skip DMA during panic write
gregkh/linux@5fd5c078af23 mtd: rawnand: serialize lock/unlock against other NAND operations
gregkh/linux@f8b5b833728b binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4
gregkh/linux@75668e58244e tracing: Fix trace_marker copy link list updates
gregkh/linux@79f0faf81d3b x86/platform/uv: Handle deconfigured sockets
gregkh/linux@38539f55f61a tracing: Fix failure to read user space from system call trace events
gregkh/linux@b6925774dd15 ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
gregkh/linux@886fa8691539 perf/x86: Move event pointer setup earlier in x86_pmu_enable()
gregkh/linux@ed1f5c1d43c3 perf/x86/intel: Add missing branch counters constraint apply
gregkh/linux@560ec8f99852 irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe()
gregkh/linux@aa9faa6486cf i2c: pxa: defer reset on Armada 3700 when recovery is used
gregkh/linux@bf8a9c92cdd1 i2c: fsi: Fix a potential leak in fsi_i2c_probe()
gregkh/linux@a9778298f470 i2c: cp2615: fix serial string NULL-deref at probe
gregkh/linux@7003794316b1 USB: serial: f81232: fix incomplete serial port generation
gregkh/linux@58b91c5cb685 hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
gregkh/linux@81f61e3e1ca2 hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value
gregkh/linux@48fed6459080 hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
gregkh/linux@4418f3186b22 hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value
gregkh/linux@beab26de7bca MPTCP: fix lock class name family in pm_nl_create_listen_socket
gregkh/linux@d938dd5a0ad7 icmp: fix NULL pointer dereference in icmp_tag_validation()
gregkh/linux@6ab68b4adf74 net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
gregkh/linux@719f6784f918 net: shaper: protect from late creation of hierarchy
gregkh/linux@581eee0890a8 net: shaper: protect late read accesses to the hierarchy
gregkh/linux@7df2b50cae1a net: mvpp2: guard flow control update with global_tx_fc in buffer switching
gregkh/linux@3932620c04c2 nfnetlink_osf: validate individual option lengths in fingerprints
gregkh/linux@c8092edb9a11 netfilter: nf_tables: release flowtable after rcu grace period on error
gregkh/linux@c25e0dec366a netfilter: bpf: defer hook memory release until rcu readers are done
gregkh/linux@017d674cf693 net: bonding: fix NULL deref in bond_debug_rlb_hash_show
gregkh/linux@003343985f26 udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
gregkh/linux@96c9c25b7468 net/mlx5e: Fix race condition during IPSec ESN update
gregkh/linux@2c6a5be0aee5 net/mlx5e: Prevent concurrent access to IPSec ASO context
gregkh/linux@ea52e95be463 net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
gregkh/linux@c852ebfe4334 net: macb: fix uninitialized rx_fs_lock
gregkh/linux@63e192b8956a netdevsim: drop PSP ext ref on forward failure
gregkh/linux@98473309a36a ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
gregkh/linux@06e769dddcbe wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
gregkh/linux@46c670ff1ff4 wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
gregkh/linux@44699c6cdfce wifi: mac80211: fix NULL deref in mesh_matches_local()
gregkh/linux@5f284b12cc12 libie: prevent memleak in fwlog code
gregkh/linux@cff11b1c03e6 iavf: fix VLAN filter lost on add/delete race
gregkh/linux@31521c124e64 igc: fix page fault in XDP TX timestamps handling
gregkh/linux@3472c22c067a igc: fix missing update of skb->tail in igc_xmit_frame()
gregkh/linux@89b2b1c64d09 ACPICA: Update the format of Arg3 of DSM
gregkh/linux@d3e32a612c63 net: usb: aqc111: Do not perform PM inside suspend callback
gregkh/linux@4c9af67f99aa clsact: Fix use-after-free in init/destroy rollback asymmetry
gregkh/linux@a5bd5a271031 net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
gregkh/linux@403f94ddcb36 net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
gregkh/linux@d538b371da1e net: airoha: Remove airoha_dev_stop() in airoha_remove()
gregkh/linux@e9c66d3e7d85 net/sched: teql: Fix double-free in teql_master_xmit
gregkh/linux@fd7579f0a2c8 net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
gregkh/linux@4172a7901cf4 bonding: prevent potential infinite loop in bond_header_parse()
gregkh/linux@bb081fd37f83 PM: runtime: Fix a race condition related to device removal
gregkh/linux@34c979e29bf6 sched: idle: Consolidate the handling of two special cases
gregkh/linux@afdb1533eb9c net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
gregkh/linux@6995dcc1a93d net: bcmgenet: increase WoL poll timeout
gregkh/linux@683be1d1670e crypto: ccp - Fix leaking the same page twice
gregkh/linux@9d00fe7d6d7c netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
gregkh/linux@f1aa81396d77 netfilter: xt_time: use unsigned int for monthday bit shift
gregkh/linux@cb549925875f netfilter: xt_CT: drop pending enqueued packets on template removal
gregkh/linux@f29a055e4f59 netfilter: nft_ct: drop pending enqueued packets on removal
gregkh/linux@31641c682db7 nf_tables: nft_dynset: fix possible stateful expression memleak in error path
gregkh/linux@6bce72daeccc netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
gregkh/linux@865dba58958c netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
gregkh/linux@04c8907ce4e3 netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
gregkh/linux@e01a597707c8 mpls: add missing unregister_netdevice_notifier to mpls_init
gregkh/linux@0c3e8bff808f net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
gregkh/linux@d8f35767bacb bridge: cfm: Fix race condition in peer_mep deletion
gregkh/linux@1e1b7a7496a2 Bluetooth: qca: fix ROM version reading on WCN3998 chips
gregkh/linux@da3000cbe485 Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
gregkh/linux@f8b6ed2f06d3 Bluetooth: HIDP: Fix possible UAF
gregkh/linux@b5c5e96f3b0a Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
gregkh/linux@84d041cfefab Bluetooth: hci_sync: Fix hci_le_create_conn_sync
gregkh/linux@874e73969d48 Bluetooth: ISO: Fix defer tests being unstable
gregkh/linux@fce04c8b54e4 Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
gregkh/linux@37021b16b270 Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
gregkh/linux@734aa845f274 Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
gregkh/linux@70d9bd9a2e68 firmware: arm_scmi: Fix NULL dereference on notify error path
gregkh/linux@d282757b0f6d firmware: arm_scpi: Fix device_node reference leak in probe path
gregkh/linux@3983811cab77 firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap()
gregkh/linux@ad01256fa62d arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2
gregkh/linux@2a53d63ac78c arm64: dts: renesas: r9a09g087: Fix CPG register region sizes
gregkh/linux@dfe08c4dde87 arm64: dts: renesas: r9a09g077: Fix CPG register region sizes
gregkh/linux@fa59e9cfbed9 arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
gregkh/linux@74893eb6d360 arm64: dts: renesas: r9a09g057: Add RTC node
gregkh/linux@2e5902c28fbd arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator
gregkh/linux@edf76d957690 arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator
gregkh/linux@a1b7a843f12a wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
gregkh/linux@5ba05436f15d wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
gregkh/linux@31d4ceb785d9 wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times
gregkh/linux@f6a620a9d6a6 wifi: mac80211: remove keys after disabling beaconing
gregkh/linux@c2f6107728ea tee: shm: Remove refcounting of kernel pages
gregkh/linux@294e0c8bc350 soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources()
gregkh/linux@85dbbf7dc88b soc: fsl: qbman: fix race condition in qman_destroy_fq
gregkh/linux@2315d328faa8 soc: rockchip: grf: Add missing of_node_put() when returning
gregkh/linux@640452dbc118 cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
gregkh/linux@606fcf901c13 cache: starfive: fix device node leak in starlink_cache_init()
gregkh/linux@e3dd5cffba07 soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()
gregkh/linux@8f9e054f605a btrfs: tree-checker: fix misleading root drop_level error message
gregkh/linux@1cf30c73602c btrfs: log new dentries when logging parent dir of a conflicting inode
gregkh/linux@9691c50fd5dd drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
gregkh/linux@8d0d94f8ba5b Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
gregkh/linux@1e9e2640d870 drm/xe: Open-code GGTT MMIO access protection
gregkh/linux@8613cca4f5f4 drm/xe/oa: Allow reading after disabling OA stream
gregkh/linux@954dae0d94fb drm/xe/guc: Ensure CT state transitions via STOP before DISABLED
gregkh/linux@0b35d11fbbcf drm/i915/dmc: Fix an unlikely NULL pointer deference at probe
gregkh/linux@5ce4a38e6c24 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
gregkh/linux@73908f65f5cc drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
gregkh/linux@c18eef45af03 drm/radeon: apply state adjust rules to some additional HAINAN vairants
gregkh/linux@772f3653eef5 drm/imagination: Synchronize interrupts before suspending the GPU
gregkh/linux@9497b1f30943 drm/imagination: Fix deadlock in soft reset sequence
gregkh/linux@7687403d6580 drm/amdgpu/mmhub4.1.0: add bounds checking for cid
gregkh/linux@72365be44cc7 drm/amdgpu/mmhub3.0: add bounds checking for cid
gregkh/linux@4b9e5676db81 drm/amdgpu/mmhub3.0.2: add bounds checking for cid
gregkh/linux@56f0473d3c63 drm/amdgpu/mmhub3.0.1: add bounds checking for cid
gregkh/linux@603db8a36517 drm/amdgpu/mmhub2.3: add bounds checking for cid
gregkh/linux@2c4eea0eba19 drm/amdgpu/mmhub2.0: add bounds checking for cid
gregkh/linux@3256b95b2d3c drm/amdgpu/gmc9.0: add bounds checking for cid
gregkh/linux@e25fff4a9eac drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP{START, END}
gregkh/linux@074d06d3724c drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
gregkh/linux@3b02923b046a serial: uartlite: fix PM runtime usage count underflow on probe
gregkh/linux@efe85a557186 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
gregkh/linux@a773f019c0b0 serial: 8250_dw: Ensure BUSY is deasserted
gregkh/linux@0e16f461f2b1 serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
gregkh/linux@5dfd8c76c0a4 serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm
gregkh/linux@2d21617bce4f serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling
gregkh/linux@9bb497252a42 serial: 8250: Add serial8250_handle_irq_locked()
gregkh/linux@3b1d813de41e serial: 8250_dw: Avoid unnecessary LCR writes
gregkh/linux@e6cc0536d154 serial: 8250: Protect LCR write in shutdown
gregkh/linux@4afc12dae748 serial: 8250: always disable IRQ during THRE test
gregkh/linux@5f6b17562f03 serial: 8250: Fix TX deadlock when using DMA
gregkh/linux@5e5b209b2d93 serial: 8250_pci: add support for the AX99100
gregkh/linux@c4efef65a46f vt: save/restore unicode screen buffer for alternate screen
gregkh/linux@19e46bf37943 io_uring/kbuf: propagate BUF_MORE through early buffer commit path
gregkh/linux@f98405afd2a7 io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
gregkh/linux@0f4ce79b8db7 io_uring/poll: fix multishot recv missing EOF on wakeup race
gregkh/linux@ee312bb1052e iommu/vt-d: Only handle IOPF for SVA when PRI is supported
gregkh/linux@300e7cfdc92b iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
gregkh/linux@c4054ad2d8bf mtd: Avoid boot crash in RedBoot partition table parser
gregkh/linux@215f6d6845a3 mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
gregkh/linux@978f50a3d7da mtd: rawnand: pl353: make sure optimal timings are applied
gregkh/linux@378b295f6710 spi: fix statistics allocation
gregkh/linux@80f3e8cd2b4a spi: fix use-after-free on controller registration failure
gregkh/linux@18605b1b936b pmdomain: bcm: bcm2835-power: Increase ASB control timeout
gregkh/linux@5ed633b212bd mmc: sdhci: fix timing selection for 1-bit bus width
gregkh/linux@c8d5757ab6d6 mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
gregkh/linux@1343f110663d ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()
gregkh/linux@2229b4cf9730 ata: libata-core: disable LPM on ADATA SU680 SSD
gregkh/linux@08b2b65c63bb mm/huge_memory: fix a folio_split() race condition with folio_try_get()
gregkh/linux@edb6c2118293 ipmi:msghandler: Handle error returns from the SMI sender
gregkh/linux@1e363c11cd2f ipmi: Consolidate the run to completion checking for xmit msgs lock
gregkh/linux@522acaae34aa sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
gregkh/linux@c1b8245c0a38 sched_ext: Simplify breather mechanism with scx_aborting flag
gregkh/linux@c44198f25fdf sched_ext: Fix starvation of scx_enable() under fair-class saturation
gregkh/linux@2f3dea284c76 nsfs: tighten permission checks for ns iteration ioctls
gregkh/linux@05edc78eb469 drm/xe/sync: Fix user fence leak on alloc failure
gregkh/linux@528aaa37d3c3 fgraph: Fix thresh_return nosleeptime double-adjust
gregkh/linux@407cc37c21d5 ksmbd: Don't log keys in SMB3 signing and encryption key generation
gregkh/linux@58f5d34f88e8 net: macb: Shuffle the tx ring before enabling tx
gregkh/linux@0cbc0d719ecc net: macb: sort #includes
gregkh/linux@8a7d29b8bda1 drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
gregkh/linux@1aa7745b97fd drm/i915/vrr: Move HAS_VRR() check into intel_vrr_set_transcoder_timings()
gregkh/linux@c3aa7b837920 drm/xe: Fix memory leak in xe_vm_madvise_ioctl
gregkh/linux@f655467a9973 cifs: open files should not hold ref on superblock
gregkh/linux@6f502049a96b crypto: atmel-sha204a - Fix OOM ->tfm_count leak
gregkh/linux@2d7238eec40a netconsole: fix sysdata_release_enabled_show checking wrong flag
gregkh/linux@f13fe6794726 ublk: fix NULL pointer dereference in ublk_ctrl_set_size()
gregkh/linux@bea2848ba20e LoongArch: Check return values for set_memory_{rw,rox}
gregkh/linux@fc9d6999ebfa net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
gregkh/linux@4e1436e0b13c net: macb: Introduce gem_init_rx_ring()
gregkh/linux@4ab7c9fa0a47 drm/i915/psr: Write DSC parameters on Selective Update in ET mode
gregkh/linux@a5cdbbc77147 drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters
gregkh/linux@291d19d586a5 drm/i915/dsc: Add Selective Update register definitions
gregkh/linux@3d80ebe6d1b7 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
gregkh/linux@9feb2d1bf86d ksmbd: unset conn->binding on failed binding request
gregkh/linux@9ee803bfdba0 smb: client: fix krb5 mount with username option
gregkh/linux@e7ff754e339e Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
gregkh/linux@5a1ea296f858 Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
gregkh/linux@1768244b85dd crypto: padlock-sha - Disable for Zhaoxin processor
gregkh/linux@5a86d4e920d9 mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
gregkh/linux@0e35db29fc5a batman-adv: avoid OGM aggregation when skb tailroom is insufficient
gregkh/linux@f5ed9e50c087 parisc: Flush correct cache in cacheflush() syscall
gregkh/linux@19aa416eed9e bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler
gregkh/linux@1f4714065b2b net: macb: fix use-after-free access to PTP clock
gregkh/linux@4de9ed2ea22d NFC: nxp-nci: allow GPIOs to sleep
gregkh/linux@8dd23bb5c6f5 LoongArch: No need to flush icache if text copy failed
gregkh/linux@250aae6a5738 LoongArch: Give more information if kmem access failed
gregkh/linux@6e096db800db mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared THP
gregkh/linux@f3caaee0f9e4 mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()
gregkh/linux@99888a4f340c mm/rmap: fix incorrect pte restoration for lazyfree folios
gregkh/linux@4897bd307ba8 crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying
gregkh/linux@a226e5b49e5f nvdimm/bus: Fix potential use after free in asynchronous initialization
gregkh/linux@be5c35960e5e sunrpc: fix cache_request leak in cache_release
gregkh/linux@73c5b5aea1c4 HID: bpf: prevent buffer overflow in hid_hw_request
gregkh/linux@6487774a576d selftests/hid: fix compilation when bpf_wq and hid_device are not exported
gregkh/linux@0f0e2a54a31a nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
gregkh/linux@db4a9f99b12a NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
gregkh/linux@2829e80d29b6 NFSD: Defer sub-object cleanup in export put callbacks