40410158d77d Linux 6.18.20-xanmod1
a60ab72620d3 Merge tag 'v6.18.20' into 6.18
dd26ea937ef5 Linux 6.18.20
a52e3970f971 xen/privcmd: add boot control for restricted usage in domU
389bae9a4409 xen/privcmd: restrict usage in unprivileged domU
f909f22f5cec hwmon: (max6639) Fix pulses-per-revolution implementation
96955cf9f5ba arm64: realm: Fix PTE_NS_SHARED for 52bit PA support
ef6e6484747e tools/bootconfig: fix fd leak in load_xbc_file() on fstat failure
d03e8c281fd3 lib/bootconfig: check xbc_init_node() return in override path
3ab1d7c8b6b7 fs/tests: exec: Remove bad test vector
cf4b224ffb9a drm/i915/gt: Check set_default_submission() before deferencing
a5828c14a9e3 ksmbd: fix use-after-free in durable v2 replay of active file handles
7f7468fd2a75 ksmbd: fix use-after-free of share_conf in compound request
2cb24caacee2 drm/bridge: dw-hdmi-qp: fix multi-channel audio output
c51a5319bf65 drm/amd: fix dcn 2.01 check
430334e9e4e8 drm/amd/display: Fix DisplayID not-found handling in parse_edid_displayid_vrr()
58abeb7b9562 iommu/sva: Fix crash in iommu_sva_unbind_device()
3f300a41a366 drm/vmwgfx: Don't overwrite KMS surface dirty tracker
bec21d97c968 spi: amlogic-spisg: Fix memory leak in aml_spisg_probe()
f15e0706e366 spi: amlogic: spifc-a4: Remove redundant clock cleanup
a9e119d027fd mtd: rawnand: brcmnand: skip DMA during panic write
5fd5c078af23 mtd: rawnand: serialize lock/unlock against other NAND operations
f8b5b833728b binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4
75668e58244e tracing: Fix trace_marker copy link list updates
79f0faf81d3b x86/platform/uv: Handle deconfigured sockets
38539f55f61a tracing: Fix failure to read user space from system call trace events
b6925774dd15 ring-buffer: Fix to update per-subbuf entries of persistent ring buffer
886fa8691539 perf/x86: Move event pointer setup earlier in x86_pmu_enable()
ed1f5c1d43c3 perf/x86/intel: Add missing branch counters constraint apply
560ec8f99852 irqchip/riscv-rpmi-sysmsi: Fix mailbox channel leak in rpmi_sysmsi_probe()
aa9faa6486cf i2c: pxa: defer reset on Armada 3700 when recovery is used
bf8a9c92cdd1 i2c: fsi: Fix a potential leak in fsi_i2c_probe()
a9778298f470 i2c: cp2615: fix serial string NULL-deref at probe
7003794316b1 USB: serial: f81232: fix incomplete serial port generation
58b91c5cb685 hwmon: (pmbus/isl68137) Fix unchecked return value and use sysfs_emit()
81f61e3e1ca2 hwmon: (pmbus/mp2869) Check pmbus_read_byte_data() before using its return value
48fed6459080 hwmon: (pmbus/mp2975) Add error check for pmbus_read_word_data() return value
4418f3186b22 hwmon: (pmbus/ina233) Add error check for pmbus_read_word_data() return value
beab26de7bca MPTCP: fix lock class name family in pm_nl_create_listen_socket
d938dd5a0ad7 icmp: fix NULL pointer dereference in icmp_tag_validation()
6ab68b4adf74 net: dsa: bcm_sf2: fix missing clk_disable_unprepare() in error paths
719f6784f918 net: shaper: protect from late creation of hierarchy
581eee0890a8 net: shaper: protect late read accesses to the hierarchy
7df2b50cae1a net: mvpp2: guard flow control update with global_tx_fc in buffer switching
3932620c04c2 nfnetlink_osf: validate individual option lengths in fingerprints
c8092edb9a11 netfilter: nf_tables: release flowtable after rcu grace period on error
c25e0dec366a netfilter: bpf: defer hook memory release until rcu readers are done
017d674cf693 net: bonding: fix NULL deref in bond_debug_rlb_hash_show
003343985f26 udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
96c9c25b7468 net/mlx5e: Fix race condition during IPSec ESN update
2c6a5be0aee5 net/mlx5e: Prevent concurrent access to IPSec ASO context
ea52e95be463 net/mlx5: qos: Restrict RTNL area to avoid a lock cycle
c852ebfe4334 net: macb: fix uninitialized rx_fs_lock
63e192b8956a netdevsim: drop PSP ext ref on forward failure
98473309a36a ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
06e769dddcbe wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
46c670ff1ff4 wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
44699c6cdfce wifi: mac80211: fix NULL deref in mesh_matches_local()
5f284b12cc12 libie: prevent memleak in fwlog code
cff11b1c03e6 iavf: fix VLAN filter lost on add/delete race
31521c124e64 igc: fix page fault in XDP TX timestamps handling
3472c22c067a igc: fix missing update of skb->tail in igc_xmit_frame()
89b2b1c64d09 ACPICA: Update the format of Arg3 of _DSM
d3e32a612c63 net: usb: aqc111: Do not perform PM inside suspend callback
4c9af67f99aa clsact: Fix use-after-free in init/destroy rollback asymmetry
a5bd5a271031 net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check
403f94ddcb36 net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check
d538b371da1e net: airoha: Remove airoha_dev_stop() in airoha_remove()
e9c66d3e7d85 net/sched: teql: Fix double-free in teql_master_xmit
fd7579f0a2c8 net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
4172a7901cf4 bonding: prevent potential infinite loop in bond_header_parse()
bb081fd37f83 PM: runtime: Fix a race condition related to device removal
34c979e29bf6 sched: idle: Consolidate the handling of two special cases
afdb1533eb9c net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown
6995dcc1a93d net: bcmgenet: increase WoL poll timeout
683be1d1670e crypto: ccp - Fix leaking the same page twice
9d00fe7d6d7c netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
f1aa81396d77 netfilter: xt_time: use unsigned int for monthday bit shift
cb549925875f netfilter: xt_CT: drop pending enqueued packets on template removal
f29a055e4f59 netfilter: nft_ct: drop pending enqueued packets on removal
31641c682db7 nf_tables: nft_dynset: fix possible stateful expression memleak in error path
6bce72daeccc netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
865dba58958c netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
04c8907ce4e3 netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
e01a597707c8 mpls: add missing unregister_netdevice_notifier to mpls_init
0c3e8bff808f net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
d8f35767bacb bridge: cfm: Fix race condition in peer_mep deletion
1e1b7a7496a2 Bluetooth: qca: fix ROM version reading on WCN3998 chips
da3000cbe485 Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
f8b6ed2f06d3 Bluetooth: HIDP: Fix possible UAF
b5c5e96f3b0a Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
84d041cfefab Bluetooth: hci_sync: Fix hci_le_create_conn_sync
874e73969d48 Bluetooth: ISO: Fix defer tests being unstable
fce04c8b54e4 Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
37021b16b270 Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
734aa845f274 Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
70d9bd9a2e68 firmware: arm_scmi: Fix NULL dereference on notify error path
d282757b0f6d firmware: arm_scpi: Fix device_node reference leak in probe path
3983811cab77 firmware: arm_ffa: Remove vm_id argument in ffa_rxtx_unmap()
ad01256fa62d arm64: dts: renesas: rzg3s-smarc-som: Set bypass for Versa3 PLL2
2a53d63ac78c arm64: dts: renesas: r9a09g087: Fix CPG register region sizes
dfe08c4dde87 arm64: dts: renesas: r9a09g077: Fix CPG register region sizes
fa59e9cfbed9 arm64: dts: renesas: r9a09g057: Remove wdt{0,2,3} nodes
74893eb6d360 arm64: dts: renesas: r9a09g057: Add RTC node
2e5902c28fbd arm64: dts: renesas: rzv2-evk-cn15-sd: Add ramp delay for SD0 regulator
edf76d957690 arm64: dts: renesas: rzt2h-n2h-evk: Add ramp delay for SD0 card regulator
a1b7a843f12a wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
5ba05436f15d wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
31d4ceb785d9 wifi: mac80211: use jiffies_delta_to_msecs() for sta_info inactive times
f6a620a9d6a6 wifi: mac80211: remove keys after disabling beaconing
c2f6107728ea tee: shm: Remove refcounting of kernel pages
294e0c8bc350 soc: fsl: cpm1: qmc: Fix error check for devm_ioremap_resource() in qmc_qe_init_resources()
85dbbf7dc88b soc: fsl: qbman: fix race condition in qman_destroy_fq
2315d328faa8 soc: rockchip: grf: Add missing of_node_put() when returning
640452dbc118 cache: ax45mp: Fix device node reference leak in ax45mp_cache_init()
606fcf901c13 cache: starfive: fix device node leak in starlink_cache_init()
e3dd5cffba07 soc: microchip: mpfs: Fix memory leak in mpfs_sys_controller_probe()
8f9e054f605a btrfs: tree-checker: fix misleading root drop_level error message
1cf30c73602c btrfs: log new dentries when logging parent dir of a conflicting inode
9691c50fd5dd drm/i915/psr: Compute PSR entry_setup_frames into intel_crtc_state
8d0d94f8ba5b Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
1e9e2640d870 drm/xe: Open-code GGTT MMIO access protection
8613cca4f5f4 drm/xe/oa: Allow reading after disabling OA stream
954dae0d94fb drm/xe/guc: Ensure CT state transitions via STOP before DISABLED
0b35d11fbbcf drm/i915/dmc: Fix an unlikely NULL pointer deference at probe
5ce4a38e6c24 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
73908f65f5cc drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
c18eef45af03 drm/radeon: apply state adjust rules to some additional HAINAN vairants
772f3653eef5 drm/imagination: Synchronize interrupts before suspending the GPU
9497b1f30943 drm/imagination: Fix deadlock in soft reset sequence
7687403d6580 drm/amdgpu/mmhub4.1.0: add bounds checking for cid
72365be44cc7 drm/amdgpu/mmhub3.0: add bounds checking for cid
4b9e5676db81 drm/amdgpu/mmhub3.0.2: add bounds checking for cid
56f0473d3c63 drm/amdgpu/mmhub3.0.1: add bounds checking for cid
603db8a36517 drm/amdgpu/mmhub2.3: add bounds checking for cid
2c4eea0eba19 drm/amdgpu/mmhub2.0: add bounds checking for cid
3256b95b2d3c drm/amdgpu/gmc9.0: add bounds checking for cid
e25fff4a9eac drm/amd/display: Wrap dcn32_override_min_req_memclk() in DC_FP_{START, END}
074d06d3724c drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
3b02923b046a serial: uartlite: fix PM runtime usage count underflow on probe
efe85a557186 serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
a773f019c0b0 serial: 8250_dw: Ensure BUSY is deasserted
0e16f461f2b1 serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
5dfd8c76c0a4 serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm
2d21617bce4f serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling
9bb497252a42 serial: 8250: Add serial8250_handle_irq_locked()
3b1d813de41e serial: 8250_dw: Avoid unnecessary LCR writes
e6cc0536d154 serial: 8250: Protect LCR write in shutdown
4afc12dae748 serial: 8250: always disable IRQ during THRE test
5f6b17562f03 serial: 8250: Fix TX deadlock when using DMA
5e5b209b2d93 serial: 8250_pci: add support for the AX99100
c4efef65a46f vt: save/restore unicode screen buffer for alternate screen
19e46bf37943 io_uring/kbuf: propagate BUF_MORE through early buffer commit path
f98405afd2a7 io_uring/kbuf: fix missing BUF_MORE for incremental buffers at EOF
0f4ce79b8db7 io_uring/poll: fix multishot recv missing EOF on wakeup race
ee312bb1052e iommu/vt-d: Only handle IOPF for SVA when PRI is supported
300e7cfdc92b iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
c4054ad2d8bf mtd: Avoid boot crash in RedBoot partition table parser
215f6d6845a3 mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in cadence_nand_init()
978f50a3d7da mtd: rawnand: pl353: make sure optimal timings are applied
378b295f6710 spi: fix statistics allocation
80f3e8cd2b4a spi: fix use-after-free on controller registration failure
18605b1b936b pmdomain: bcm: bcm2835-power: Increase ASB control timeout
5ed633b212bd mmc: sdhci: fix timing selection for 1-bit bus width
c8d5757ab6d6 mmc: sdhci-pci-gli: fix GL9750 DMA write corruption
1343f110663d ata: libata-scsi: report correct sense field pointer in ata_scsiop_maint_in()
2229b4cf9730 ata: libata-core: disable LPM on ADATA SU680 SSD
08b2b65c63bb mm/huge_memory: fix a folio_split() race condition with folio_try_get()
edb6c2118293 ipmi:msghandler: Handle error returns from the SMI sender
1e363c11cd2f ipmi: Consolidate the run to completion checking for xmit msgs lock
522acaae34aa sched_ext: Disable preemption between scx_claim_exit() and kicking helper work
c1b8245c0a38 sched_ext: Simplify breather mechanism with scx_aborting flag
c44198f25fdf sched_ext: Fix starvation of scx_enable() under fair-class saturation
2f3dea284c76 nsfs: tighten permission checks for ns iteration ioctls
05edc78eb469 drm/xe/sync: Fix user fence leak on alloc failure
528aaa37d3c3 fgraph: Fix thresh_return nosleeptime double-adjust
407cc37c21d5 ksmbd: Don't log keys in SMB3 signing and encryption key generation
58f5d34f88e8 net: macb: Shuffle the tx ring before enabling tx
0cbc0d719ecc net: macb: sort #includes
8a7d29b8bda1 drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
1aa7745b97fd drm/i915/vrr: Move HAS_VRR() check into intel_vrr_set_transcoder_timings()
c3aa7b837920 drm/xe: Fix memory leak in xe_vm_madvise_ioctl
f655467a9973 cifs: open files should not hold ref on superblock
6f502049a96b crypto: atmel-sha204a - Fix OOM ->tfm_count leak
2d7238eec40a netconsole: fix sysdata_release_enabled_show checking wrong flag
f13fe6794726 ublk: fix NULL pointer dereference in ublk_ctrl_set_size()
bea2848ba20e LoongArch: Check return values for set_memory_{rw,rox}
fc9d6999ebfa net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
4e1436e0b13c net: macb: Introduce gem_init_rx_ring()
4ab7c9fa0a47 drm/i915/psr: Write DSC parameters on Selective Update in ET mode
a5cdbbc77147 drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters
291d19d586a5 drm/i915/dsc: Add Selective Update register definitions
3d80ebe6d1b7 ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
9feb2d1bf86d ksmbd: unset conn->binding on failed binding request
9ee803bfdba0 smb: client: fix krb5 mount with username option
e7ff754e339e Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
5a1ea296f858 Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
1768244b85dd crypto: padlock-sha - Disable for Zhaoxin processor
5a86d4e920d9 mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations
0e35db29fc5a batman-adv: avoid OGM aggregation when skb tailroom is insufficient
f5ed9e50c087 parisc: Flush correct cache in cacheflush() syscall
19aa416eed9e bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler
1f4714065b2b net: macb: fix use-after-free access to PTP clock
4de9ed2ea22d NFC: nxp-nci: allow GPIOs to sleep
8dd23bb5c6f5 LoongArch: No need to flush icache if text copy failed
250aae6a5738 LoongArch: Give more information if kmem access failed
6e096db800db mm/huge_memory: fix early failure try_to_migrate() when split huge pmd for shared THP
f3caaee0f9e4 mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()
99888a4f340c mm/rmap: fix incorrect pte restoration for lazyfree folios
4897bd307ba8 crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying
a226e5b49e5f nvdimm/bus: Fix potential use after free in asynchronous initialization
be5c35960e5e sunrpc: fix cache_request leak in cache_release
73c5b5aea1c4 HID: bpf: prevent buffer overflow in hid_hw_request
6487774a576d selftests/hid: fix compilation when bpf_wq and hid_device are not exported
0f0e2a54a31a nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
db4a9f99b12a NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd
2829e80d29b6 NFSD: Defer sub-object cleanup in export put callbacks