1d9cd8c1c15f Linux 6.18.22-xanmod1
1cfd3a296c3c Merge tag 'v6.18.22' into 6.18
f2b09e8b594c Linux 6.18.22
5e7b2cc8fae9 sched_ext: Fix stale direct dispatch state in ddsp_dsq_id
d5776a31c165 sched_ext: Refactor do_enqueue_task() local and global DSQ paths
9e36ceb5ca43 mm/memory: fix PMD/PUD checks in follow_pfnmap_start()
cef18bb87a6c mm: replace READ_ONCE() with standard page table accessors
a836054ea810 scsi: target: tcm_loop: Drain commands in target_reset handler
ce54802fe6bb scsi: target: file: Use kzalloc_flex for aio_cmd
a98b78116a27 net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
5f4061f8225d net: mana: fix use-after-free in add_adev() error path
24ce568f7553 drm/amd/display: Fix DCE LVDS handling
ba9be472a438 drm/amd/pm: disable OD_FAN_CURVE if temp or pwm range invalid for smu v13
5bbadf60b121 wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free
e367143b520a kallsyms: prevent module removal when printing module name and buildid
10bbeed03e1d kallsyms: cleanup code for appending the module buildid
c1d72e846cb4 kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid()
ab5f05ae96fc kallsyms: clean up @namebuf initialization in kallsyms_lookup_buildid()
8e5eb1d6e6a3 usb: gadget: f_uac1_legacy: validate control request size
5d1bb391ceee usb: gadget: f_hid: move list and spinlock inits from bind to alloc
18ada801899f usb: gadget: f_rndis: Fix net_device lifecycle with device_move
9cbc4f109bb2 usb: gadget: f_subset: Fix net_device lifecycle with device_move
4ccdccff8feb usb: gadget: f_eem: Fix net_device lifecycle with device_move
4e34f3f491fd usb: gadget: f_ecm: Fix net_device lifecycle with device_move
446f1842cda9 usb: gadget: f_rndis: Protect RNDIS options with mutex
3d436670b474 usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
1aa9356881ee usb: gadget: uvc: fix NULL pointer dereference during unbind race
a36e5e800b9c usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
6ad77458637b usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
63dc317dfcd3 ice: Fix memory leak in ice_set_ringparam()
7d581e253469 HID: appletb-kbd: add .resume method in PM
f4e608fe12b7 usb: typec: ucsi: validate connector number in ucsi_notify_common()
cc300853b9eb usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
5687a0977606 USB: dummy-hcd: Fix interrupt synchronization error
efbd9441f1e7 USB: dummy-hcd: Fix locking/synchronization error
cd9c6fcd1cf1 thunderbolt: Fix property read in nhi_wake_supported()
15f0c2d9eebc usb: typec: thunderbolt: Set enter_vdo during initialization
acea446ba4f4 misc: fastrpc: check qcom_scm_assign_mem() return in rpmsg_probe
3a164f640953 misc: fastrpc: possible double-free of cctx->remote_heap
c4c7219e9331 thermal: core: Fix thermal zone device registration error path
2dbe93f344f1 thermal: core: Address thermal zone removal races with resume
f0cf9c7b7c28 gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
70b6e2e01503 gpio: mxc: map Both Edge pad wakeup to Rising Edge
72c43eb2e334 sched_ext: Fix is_bpf_migration_disabled() false negative on non-PREEMPT_RCU
d2703b4f8fb7 cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
65a5847e1a6c virtio_net: clamp rss_max_key_size to NETDEV_RSS_KEY_LEN
5dff799c6771 net: ethernet: mtk_ppe: avoid NULL deref when gmac0 is disabled
8351d18989c8 net: ftgmac100: fix ring allocation unwind on open failure
eddfce70a6f3 vxlan: validate ND option lengths in vxlan_na_create
3aea268b6d5c crypto: tegra - Add missing CRYPTO_ALG_ASYNC
6562290225c1 counter: rz-mtu3-cnt: do not use struct rz_mtu3_channel's dev member
e07237df8538 counter: rz-mtu3-cnt: prevent counter from being toggled multiple times
bbb6c37c7a48 vt: resize saved unicode buffer on alt screen exit after resize
891d790fdb5c vt: discard stale unicode buffer on alt screen exit after resize
554d005d5161 gpib: Fix fluke driver s390 compile issue
68ca0eea0af0 netfilter: ipset: drop logically empty buckets in mtype_del
784ed4abded1 nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
0c94b84b6ef5 nvmem: imx: assign nvmem_cell_info::raw_len
5a8f2e95f9a1 s390/cpum_sf: Cap sampling rate to prevent lsctl exception
586222c37d40 s390/zcrypt: Fix memory leak with CCA cards used as accelerator
a11f022db7d8 spi: cadence-qspi: Fix exec_mem_op error handling
f5526abe978f dt-bindings: connector: add pd-disable dependency
d266498da90d firmware: microchip: fail auto-update probe if no flash found
eae19cab4420 comedi: me4000: Fix potential overrun of firmware buffer
a47ae40339c1 comedi: me_daq: Fix potential overrun of firmware buffer
43c68a2c7cc3 comedi: ni_atmio16d: Fix invalid clean-up after failed attach
b89c02622771 comedi: Reinit dev->spinlock between attachments to low-level drivers
34c8b3a91bdf comedi: dt2815: add hardware detection to prevent crash
e92f5ee73065 cdc-acm: new quirk for EPSON HMD
837392a38445 bridge: br_nd_send: validate ND option lengths
5da684c24e8b ASoC: qcom: sc7280: make use of common helpers
f43f77499ec8 io_uring: protect remaining lockless ctx->rings accesses with RCU
09f78265a93d usb: core: use dedicated spinlock for offload state
5a85599ca4d2 usb: cdns3: gadget: fix state inconsistency on gadget init failure
390536cc6af4 usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
701903fcac4a usb: core: phy: avoid double use of 'usb3-phy'
61937f686290 usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
6288b46e5ac6 usb: ehci-brcm: fix sleep during atomic
34af2da733f4 usb: host: xhci-sideband: delegate offload_usage tracking to class drivers
65ff09f48b0e usb: misc: usbio: Fix URB memory leak on submit failure
977b632db51d usb: usbtmc: Flush anchored URBs in usbtmc_release
38c28fe25611 usb: ulpi: fix double free in ulpi_register_interface() error path
882bdb01ff12 usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
21f942879f86 gpib: lpvo_usb: fix memory leak on disconnect
ffacfe07177d mei: me: reduce the scope on unexpected reset
fefd0bceac15 iio: gyro: mpu3050: Fix out-of-sequence free_irq()
cc3de12a5612 iio: gyro: mpu3050: Move iio_device_register() to correct location
3a8e68d65a44 iio: gyro: mpu3050: Fix irq resource leak
ac1233397f4c iio: gyro: mpu3050: Fix incorrect free_irq() variable
7f14b52a81f9 iio: imu: st_lsm6dsx: Set FIFO ODR for accelerometer and gyroscope only
d6e078c63409 iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()
04d8f0a785dc iio: light: veml6070: fix veml6070_read() return value
0ad74c370e8d iio: light: vcnl4035: fix scan buffer on big-endian
b0e1fec0a0d0 iio: imu: adis16550: fix swapped gyro/accel filter functions
2ed3d9bc86b6 iio: dac: ad5770r: fix error return in ad5770r_read_raw()
d7161e8b6211 iio: accel: adxl313: add missing error check in predisable
b6d6f6e2e329 iio: accel: adxl380: fix FIFO watermark bit 8 always written as 0
6c4591e71668 iio: accel: fix ADXL355 temperature signature value
85981790ea35 iio: adc: aspeed: clear reference voltage bits before configuring vref
5f482fd456bc iio: adc: ade9000: move mutex init before IRQ registration
87180f65f90d iio: adc: ade9000: fix wrong register in CALIBBIAS case for active power
3707af316f86 iio: adc: ade9000: fix wrong return type in streaming push
25e04a8291f4 iio: adc: ti-ads7950: do not clobber gpio state in ti_ads7950_get()
6afa581aed0f iio: adc: ti-ads7950: normalize return value of gpio_get
d0a6b8d186da Input: xpad - add support for Razer Wolverine V3 Pro
86620132e9c4 Input: xpad - add support for BETOP BTP-KP50B/C controller's wireless mode
00f0cc75356b Input: bcm5974 - recover from failed mode switch
beba26c55f4e Input: i8042 - add TUXEDO InfinityBook Max 16 Gen10 AMD to i8042 quirk table
33e646804070 Input: synaptics-rmi4 - fix a locking bug in an error path
8ea8dc0d62e3 USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
42e4fbeb853a USB: serial: option: add support for Rolling Wireless RW135R-GL
70fd81b9c4bf USB: serial: io_edgeport: add support for Blackbox IC135A
2b8ae82d85d7 drm/amdgpu/pm: drop SMU driver if version not matched messages
77c918eaa4c9 drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
3543005a42d7 drm/amdgpu: validate doorbell_offset in user queue creation
1e130cf9cd17 drm/amdgpu: Fix wait after reset sequence in S4
d0fd0bea8475 drm/i915/dp: Use crtc_state->enhanced_framing properly on ivb/hsw CPU eDP
86e926b10888 drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode
df4979eef358 drm/ast: dp501: Fix initialization of SCU2C
5a17678b7419 iio: adc: ti-ads1119: Replace IRQF_ONESHOT with IRQF_NO_THREAD
30e2275b3469 iio: adc: ti-ads1119: Reinit completion before wait_for_completion_timeout()
64bc0219e4d8 iio: adc: ti-ads1119: Fix unbalanced pm reference count in ds1119_single_conversion()
014c6d27878d iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
054ea2f12beb iio: adc: ti-adc161s626: fix buffer read on big-endian
d9bf25ef3d30 iio: orientation: hid-sensor-rotation: add timestamp hack to not break userspace
7d14b49de8fc iio: orientation: hid-sensor-rotation: fix quaternion alignment
2b655a917644 iio: add IIO_DECLARE_QUATERNION() macro
cae26eff1b56 gpib: fix use-after-free in IO ioctl handlers
115a4c8df909 drm/amdgpu: fix the idr allocation flags
1e3e98596c27 x86/kexec: Disable KCOV instrumentation after load_segments()
16062d6830a7 mips: mm: Allocate tlb_vpn array atomically
243d55bd3f08 hwmon: (occ) Fix division by zero in occ_show_power_1()
1010390094fa MIPS: Fix the GCC version check for `__multi3' workaround
247e1e7e25c8 MIPS: SiByte: Bring back cache initialisation
075ea208c648 ksmbd: fix OOB write in QUERY_INFO for compound requests
aba0aea35401 Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync
fa14e0e19820 Bluetooth: SMP: force responder MITM requirements before building the pairing response
061ee71ac6b0 Bluetooth: SMP: derive legacy responder STK authentication from MITM state
c314b405dcc4 io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs()
2e8194b4fdee ALSA: hda/realtek: add quirk for HP Victus 15-fb0xxx
682b5fd11568 ALSA: hda/realtek: Add quirk for ASUS ROG Strix SCAR 15
57698f184e1a ALSA: ctxfi: Fix missing SPDIFI1 index handling
3afa2e67f352 ALSA: caiaq: fix stack out-of-bounds read in init_card
1933249263c3 lib/crypto: chacha: Zeroize permuted_state before it leaves scope
b49bf41b4114 sched_ext: Fix inconsistent NUMA node lookup in scx_select_cpu_dfl()
10c13c111d0d drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
ce47541f5c40 USB: serial: option: add MeiG Smart SRM825WN
dd90880eb5ec wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
d8388614de61 wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
20e2418b9836 rust_binder: use AssertSync for BINDER_VM_OPS
f0e441be08a2 drm/ioc32: stop speculation on the drm_compat_ioctl path
1200f4240c07 ACPI: RIMT: Add dependency between iommu and devices
50392cdfe95e riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set
e1425ff578c4 riscv: kgdb: fix several debug register assignment bugs
e435a30ca6fe perf/x86: Fix potential bad container_of in intel_pmu_hw_config
87573883c30f sched/fair: Fix zero_vruntime tracking fix
a99f94e4f28a mips: ralink: update CPU clock index
d6fbc5750f38 hwmon: (asus-ec-sensors) Fix T_Sensor for PRIME X670E-PRO WIFI
d16f8716c927 drm/sysfb: Fix efidrm error handling and memory type mismatch
6205de166dfb hwmon: (occ) Fix missing newline in occ_show_extended()
ee4c064e37d4 spi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback
fdbfa1bf2c75 hwmon: (tps53679) Fix device ID comparison and printing in tps53676_identify()
9e962e68a9d2 drm/xe/pxp: Clear restart flag in pxp_start after jumping back
5633454e28d3 drm/xe/pxp: Remove incorrect handling of impossible state during suspend
ec4530967192 drm/xe/pxp: Clean up termination status on failure
e8298e0cc68d spi: stm32-ospi: Fix reset control leak on probe error
b4ec54c974c6 spi: stm32-ospi: Fix resource leak in remove() callback
3a8b66a84f05 dt-bindings: gpio: fix microchip #interrupt-cells
dfe3a785ae7f hwmon: (ltc4286) Add missing MODULE_IMPORT_NS("PMBUS")
13b0cb996365 hwmon: (pxe1610) Check return value of page-select write in probe
79b7e588399b hwmon: (tps53679) Fix array access with zero-length block read
040a1e7e0e2f io_uring/rsrc: reject zero-length fixed buffer import
f403094d9075 accel/qaic: Handle DBC deactivation if the owner went away
33b54c7793cf gpiolib: clear requested flag if line is invalid
606f88c162b2 gpio: rename gpio_chip_hwgpio() to gpiod_hwgpio()
9e5495d216bf iio: imu: bno055: fix BNO055_SCAN_CH_COUNT off by one
89c3a4ba6030 Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"
dc9a060d76c1 bpf: Reject sleepable kprobe_multi programs at attach time
63276547debc bpf: reject direct access to nullable PTR_TO_BUF pointers
7c15dabcbc9e eth: fbnic: Increase FBNIC_QUEUE_SIZE_MIN to 64
9ed81d692758 ipv6: avoid overflows in ip6_datagram_send_ctl()
1fe371a34e80 net: hsr: fix VLAN add unwind on slave errors
a208c3e12329 net/sched: cls_flow: fix NULL pointer dereference on shared blocks
3cb055df9e86 net/sched: cls_fw: fix NULL pointer dereference on shared blocks
8c92969c197b net/x25: Fix overflow when accumulating packets
fa1dbc93530b net/x25: Fix potential double free of skb
311efb3cfc92 bnxt_en: Restore default stat ctxs for ULP when resource is available
e27153b2bd6e net/mlx5: Fix switchdev mode rollback in case of failure
276b3efb2b48 net/mlx5: Avoid "No data available" when FW version queries fail
c53cf44588a9 net/mlx5: lag: Check for LAG device before creating debugfs
5392a5174df4 net: macb: properly unregister fixed rate clocks
16ab4c0e2b15 net: macb: fix clk handling on PCI glue driver removal
3a2999704ac3 net/sched: sch_netem: fix out-of-bounds access in packet corruption
18861f87a043 bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
23e07c340c44 rds: ib: reject FRMR registration before IB connection is established
edb5898cfa91 Bluetooth: MGMT: validate mesh send advertising payload length
1d0bdbfe3e91 Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
7d568fede8ea Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
50fb64defa72 Bluetooth: MGMT: validate LTK enc_size on load
3ec3a1588876 Bluetooth: hci_h4: Fix race during initialization
98c8d3bfdaa6 Bluetooth: SCO: fix race conditions in sco_sock_connect()
d4d1a4eed6f6 Bluetooth: hci_sync: call destroy in hci_cmd_sync_run if immediate
42a47f4b1b76 netfilter: nf_tables: reject immediate NF_QUEUE verdict
dc3e27dd7d76 netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
187b6ec5229e netfilter: ctnetlink: ignore explicit helper on new expectations
a0684ccc1ddd netfilter: nf_conntrack_expect: store netns and zone in expectation
b53294bff19e netfilter: nf_conntrack_expect: use expect->helper
54cb3500e8af netfilter: nf_conntrack_expect: honor expectation helper field
929f7a9a7aad netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
620f3d14c1ef netfilter: nf_conntrack_helper: pass helper to expect cleanup
a54bbbcd3c62 netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
f419bdc20589 netfilter: x_tables: ensure names are nul-terminated
88a8f56e6276 netfilter: nfnetlink_log: account for netlink header size
504c9456699d netfilter: flowtable: strictly check for maximum number of actions
908dd5faf816 ALSA: usb-audio: Exclude Scarlett 2i2 1st Gen (8016) from SKIP_IFACE_SETUP
87a8287e7624 net: stmmac: skip VLAN restore when VLAN hash ops are missing
58b58b9ba89c mptcp: fix soft lockup in mptcp_recvmsg()
8d38f222795d mptcp: add eat_recv_skb helper
414726b69921 net: ipv6: flowlabel: defer exclusive option free until RCU teardown
8aebe1806939 bpf: Fix regsafe() for pointers to packet
917303fda0f1 ASoC: Intel: boards: fix unmet dependency on PINCTRL
2a0323a91310 net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets
f3cf32dc1ebb net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
ad2f60de5045 NFC: pn533: bound the UART receive buffer
d4cc7e4c80b1 net: bonding: fix use-after-free in bond_xmit_broadcast()
153d5520c3f9 crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
fafe0fa2995a crypto: algif_aead - Revert to operating out-of-place
c8d53b70166d bnxt_en: set backing store type from query type
906997ea3766 net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
cc91202fc20a net: use skb_header_pointer() for TCPv4 GSO frag_off check
846cd4a5ffdc net: introduce mangleid_features
ae585d9ac863 net: airoha: Add missing cleanup bits in airoha_qdma_cleanup_rx_queue()
3cd4efb5df72 ipv6: prevent possible UaF in addrconf_permanent_addr()
2321b0d47a11 ASoC: ep93xx: Fix unchecked clk_prepare_enable() and add rollback on failure
19f90e0061b6 ALSA: usb-audio: Exclude Scarlett Solo 1st Gen from SKIP_IFACE_SETUP
15db5c44f79c net: enetc: do not allow VF to configure the RSS key
85b4fb46a898 net: enetc: check whether the RSS algorithm is Toeplitz
3b4df3d43ae4 net: sfp: Fix Ubiquiti U-Fiber Instant SFP module on mvneta
17c1b9807b8a net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
9c55e41c73af bridge: br_nd_send: linearize skb before parsing ND options
117f9453dd7c eth: fbnic: Account for page fragments when updating BDQ tail
590f622669b9 ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
a2edbb639397 ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
7e55845bd897 tg3: Fix race for querying speed/duplex
184d2e9db27c net/ipv6: ioam6: prevent schema length wraparound in trace fill
b485eef3d97b net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
f2664bc4f0f3 net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak
77c5f0a105d0 net: enetc: reset PIR and CIR if they are not equal when initializing TX ring
98bef6f424a3 net: fec: fix the PTP periodic output sysfs interface
53219f87bd22 netdevsim: fix build if SKB_EXTENSIONS=n
7267e4c75f9f net: mana: Fix RX skb truesize accounting
00cbdec17c15 crypto: af-alg - fix NULL pointer dereference in scatterwalk
83622e52431e crypto: deflate - fix spurious -ENOSPC
aa545df01133 crypto: caam - fix overflow on long hmac keys
68feed135a0c crypto: caam - fix DMA corruption on long hmac keys
91478edb8cbc wifi: ath11k: Pass the correct value of each TID during a stop AMPDU session
52dc79062f23 wifi: iwlwifi: mld: correctly set wifi generation data
2f84d5e9c1c5 wifi: iwlwifi: disable EHT if the device doesn't allow it
9d713f4f8bb0 wifi: iwlwifi: cfg: add new device names
c0b3fa5e0eae wifi: iwlwifi: mvm: don't send a 6E related command when not supported
624af5c3baa2 wifi: iwlwifi: mld: Fix MLO scan timing
ee555d539975 wifi: iwlwifi: fix remaining kernel-doc warnings
fdbc00b8b2ee dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning
4d47b812f925 spi: geni-qcom: Check DMA interrupts early in ISR
f4e35576da43 smb: client: fix generic/694 due to wrong ->i_blocks
850de3d87f47 btrfs: reject root items with drop_progress and zero drop_level
86d7c80e1cff i2c: tegra: Don't mark devices with pins as IRQ safe
cf930a651eef btrfs: reserve enough transaction items for qgroup ioctls
7f66fdbc077f HID: multitouch: Check to ensure report responses match the request
8f7103464973 HID: core: Mitigate potential OOB by removing bogus memset()
b846fb0a73e9 HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure
34b12ab75ae2 objtool: Fix Clang jump table detection
7e0576dcf245 tg3: replace placeholder MAC address with device property
8b3484011a83 btrfs: don't take device_list_mutex when querying zone info
abc10f85a396 atm: lec: fix use-after-free in sock_def_readable()
c8dc23c97680 HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
be81f17151fc wifi: mac80211: check tdls flag in ieee80211_tdls_oper
6c4e67e6ba25 HID: logitech-hidpp: Enable MX Master 4 over bluetooth
1c41248cef83 arm64/scs: Fix handling of advance_loc4