e1e49f488a1c Linux 6.18.45-xanmod1
474774fc02c5 Merge tag 'v6.18.45' into 6.18
bf3be28f6721 Linux 6.18.45
1eb0dc458b6e netfilter: flowtable: ensure sufficient headroom in xmit path
99ec511f258e netfilter: always set route tuple out ifindex
9977321835c7 thunderbolt: Fix bandwidth group reservation indexing
40d2ffb74094 thunderbolt: Bound the DROM dual link port number before indexing sw->ports
ca33df36aa01 sctp: clear new_transport when removing a peer
07daf4f97501 sctp: fix use-after-free of cached ASCONF chunk
2b3b5eec8b2c sctp: keep chunk->transport in step with the list it is queued on
3bd46d33e3fd scsi: scsi_debug: Negate wrapped memcmp() result
a14e4ef1d90c bpf, sockmap: Fix sk_redir use-after-free in send verdict
3c6d4ffa0c6d fsverity: Fix silent truncation in bpf_get_fsverity_digest()
2a5cfcad1d56 fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions
4917e3ebcab5 mm/filemap: __filemap_add_folio() restore index before retrying
dd21c96a71e8 ima: Instantiate file_truncate and path_truncate hooks
102fb2dacf45 sched/psi: Create the psimon kthread outside of cgroup_mutex
8037c5b2b2a4 sched/psi: Shut down rtpoll_timer in psi_cgroup_free()
653e888a24c8 fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()
4eb15c465337 ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
3b2231e358d2 ipv6: fix Route Information option length validation
7f740664aec1 mm/ptdump: always stabilise against page table freeing using init_mm
5b926fb04cb9 ring-buffer: Use current_context for safe per-CPU buffer swap
2e37f2bf1114 ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
5fd91dd4a143 ptp: ocp: Fix board ID over-read
8d34019d1413 Revert "thermal/drivers/hwmon: Cleanup coding style a bit"
5635211b4496 eventfs: Fix use-after-free in eventfs_remove_rec()
66bc868a33cf KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page
47976eaaf0a4 KVM: SVM: Serialize accesses to the owner and mirror list with separate lock
1ffacbadc145 smb: client: Fix use-after-free in cifs_try_adding_channels()
c3f2347a4775 tipc: read le->link under the node lock in tipc_node_link_down()
3fc5044796dd tls: don't leave a full plaintext sk_msg ring unpushed
68787940274e tls: rx: restore msg_iter before TLS 1.3 optimistic retry
f1e21108e3dd vhost: reset the vring metadata cache on vring reconfiguration
cdf745b7a777 veth: fix skb length accounting after XDP frag adjustment
38c7763fdc53 vsock/virtio: avoid refilling the RX queue after teardown
bd43a7ec668b vsock/virtio: read virtqueues under worker locks
46bb297ad776 vxlan: do not arm the ageing timer on a device that is down
fab820f1691a xdp: reject clones that overrun skb_shared_info tailroom
e708fc1566eb x86/mce: Set up the polling timer before CMCI discovery
846b92e26c8a x86/CPU: Add a tlbi= cmdline switch
69298af46f39 arm64: remove redundant concurrent ptdump UAF mitigation
fe79571f4043 dibs: initialise dibs->lock in dibs_dev_alloc()
a2e326c52c4b Revert "drm/amdgpu: fix aperture mapping leak"
24e95a24f151 binfmt_misc: don't warn when the mount is completed from another user namespace
be161fa31e3e ovl: don't warn when the mount is completed from another user namespace
92f00f1d4d20 net/sched: act_gact, act_police: range check the fallback control action
b47bb899e04b net/sched: act_ct: fix sk_buff leak when the header checks reject a packet
782cc40b7ade net: atlantic: free RX pages of consumed but not refilled buffers
b13202d401e1 net: atlantic: free stranded TX buffers on ring deinit
0424186d570a netfilter: nf_conntrack: defer invalid log until after unlock
c58d34fe8b7e netfilter: bridge: release template ct on non-IP path
e9bfe12b1d04 net: devmem: prevent net-iov / page mixing
4bc522b33438 net/x25: fix use-after-free of the socket by its timers
ece6426b6124 net/dibs: Correct freeing of dmb_clientid_arr
680fbd794218 ipv6: prevent in6_dev_get() from resurrecting inet6_dev
0b7d54cedea5 net: smc: fix splice entry lifetime imbalance in smc_rx_splice
b65c11bc6221 net: phy: mediatek: fix TX blink masks using the RX bits
105d04edbec8 mm/huge_memory: fix huge_zero_pfn race
152a00440dc6 tracing: Fix NULL pointer dereference in module event cache removal
62978cf63479 ring-buffer: Prevent subbuf order change when resizing is disabled
bc9db0d879c6 fbdev: bitblit: bound-check glyph index in bit_cursor()
ed49684e69f8 tracing: Fix race between update_event_fields and, event_define_fields
a979a642402d perf/core: Fix group leader use-after-free after sibling detach
5884851a096d drm/v3d: Serialize the scheduler timeout handlers
7779249561d1 ALSA: us144mkii: re-anchor capture URBs on resubmission
a6b79dff1cc1 ALSA: hda/tas2781: fix ACPI reference handling
bb30e35c36ed ALSA: FCP: fix OOB write in fcp_meter_ctl_get()
f75d6f61f0d9 ALSA: usx2y: bound the hwdep mmap fault offset
d217d723c5e4 ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
976da5475472 mm/damon: adjust isolated pages stat for DAMOS_MIGRATE_{HOT,COLD}
e16b8d640ec9 samples/damon/mtier: error out for zero quota goal target values
460181e4bb47 mm/damon/ops-common: putback folios on invalid migrate nid
6dd7a06894d6 ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
688c71bed685 misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
af6345159abc misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
9bf22a7d950c misc: fastrpc: Remove buffer from list prior to unmap operation
c5a03c2cadd2 misc: fastrpc: fix channel ctx ref leak when session alloc fails
cd02b9386315 misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
8b3e4ed9c35d staging: rtl8723bs: validate monitor transmit frame lengths
a28a4b0592e4 staging: rtl8723bs: fix missing shared-key auth challenge length check
e5b7610008f4 staging: rtl8723bs: fix OOB read in WMM_param_handler()
e167a38a8a8f staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()
5974cb66681e serial: amba-pl011: synchronize DMA teardown
759ead98a39f serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
2a0ee25f75cd serial: amba-pl011: fix indefinite RS485 post-send delay
3ce24bc4d115 serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
ae05d9e50b6b serial: 8250_dma: Clear stale RX state on shutdown
1c31e2377f4c serial: qcom-geni: fix TX DMA buffer flush
dd6946a70ddb rust_binder: do not query current thread for all ioctls
9dbe1d011189 nvmem: layouts: Add fixed-layout driver
da59844f561d nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
104c2e8b8e38 mei: pull kvfree out of spinlock
63996ffc594d ipv4: fix use-after-free in fib_nhc_update_mtu()
a59edda6eda1 ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops
94166072975a selftests/bpf: Adapt sockmap update error handling
edee58a9c460 selftests/bpf: Ensure UDP sockets are bound
dc0c462fa838 Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV
373d425f7638 Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan
8545f4ef9eae netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate
7b8c53263f88 futex: Prevent robust futex exit race some more
cf8a9672fc25 iommu/vt-d: Gather the unmapped range before freeing its page tables
643b410bdfa4 dt-bindings: crypto: qcom,ice: Fix missing power-domain and iface clk
8d817ef1aa4e KVM: s390: pci: Fix aisb calculation
cf895cd72e40 blk-mq: reinsert cached request to the list
97e2d08de282 blk-mq: pop cached request if it is usable
59b07ccca4c0 Revert "drm/amd/display: Fix backlight max_brightness to match exported range"
5912cf1822fb net: bridge: mrp: fix uninitialised bytes on the wire
47a119ec8a7e netfilter: ebt_nflog: pin the NFLOG backend
a0e76de6a2f2 igc: fix netdev not re-attached after resume if interface is down
e6cd416a899e mac802154: fix netdev use-after-free in beacon worker
9f904dd3e455 inet: frags: publish queues before arming timer
dbb30dc943a9 net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header
99ae2239069e net: octeontx2-pf: Fix UB in shift operation
a4b14a4df29d net/sched: reject overly deep qdisc hierarchies
23716dd9d8d4 net: openvswitch: reallocate update replies for mismatched IDs
5f30f9c302ce net: fix skb length accounting after generic XDP frag adjustment
2c7b5eb87b2b packet: synchronize pressure clearing with ring reconfiguration
971aa7d99242 net/packet: reset the MAC header on the packet-socket transmit path
27e068d1b35d packet: use consistent hard_header_len in TX_RING send path
5bb10753d428 packet: use consistent hard_header_len in non-ring send paths
75eec935444d ipvs: clear IPv4 options after rebasing tunnel ICMP errors
0f88fe0552be ipvs: properly update the overload flag on dest edit
59b90c17bec5 ipvs: add totalconns for dest
e7f34f29b330 ipvs: stop estimator after disabled calc phase
27f392406159 ima: fix out-of-bounds read in xattr_verify()
c5bf8cd148cf mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
bd3c4108a56d Input: evdev - fix information leak in evdev_pass_values()
b664592e9ba8 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
a1c31e026c93 vt: add permission check for KDSKBMETA ioctl
2c7496124e94 net: usb: ipheth: fix carrier_work UAF on disconnect
58733b1dd46b net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()
d328fdc607fa usb: gadget: f_ncm: Use unsigned int for ndp_index
2dfefdd498ab usb: cdnsp: fix incorrect endian conversions for APB timeout register
6e4c09bea8e9 thunderbolt: icm: Preserve USB4 proxy data-valid bit
2f73a065791d usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
ebfd1e82ab0a usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
04b71290fb41 usb: quirks: Add ShanWan gamepad to quirk list
1740fd2aaa8f usb: core: Add quirk for 255-bytes initial config read
0a235379825e ALSA: usb-audio: fix OOB write on Type II inbound URBs
4034ef247a9d Input: evdev - sanitize event type index when fetching event masks
8b444b126cd8 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()
fad7cecb5c2c net: fec: do not release NULL pages when RX buffer allocation fails
c768fb2e43c8 hwmon: (ltc4282) Fix parsing adi,current-limit-sense-microvolt
de58b90a4d14 hwmon: (ltc4282) Clamp negative current limits
124bd4b00619 hwmon: (ltc4282) Avoid overflow in maximum power calculation
678a76c8fd33 hwmon: (ads7828) Fix external VREF regulator handling
5ee1f603a64b hwmon: (corsair-psu) fix possible out-of-bounds access on missing string termination
29fe74c9aa69 watchdog: at91sam9_wdt: prevent timer rearm during teardown
6d1d3ca6c8f4 tls: don't abort the connection on signal-interrupted sends
18d704bdd809 sctp: clear control chunk transport if it is being removed
9f77c1ab3821 net/atm: fix slab-out-of-bounds read in vcc_setsockopt()
fc3021284050 s390/ism: Fix UAF of sba and ieq during ism_dev_exit()
8fa684db8709 bnge: Fix resource leak in bnge_init_nic() error path
a837deeaa37c ata: pata_sl82c105: fix bridge revision use-after-free
4dd71cb0d23d net: thunderbolt: Tear down DMA paths before stopping the rings
78e5ebcd1c10 net/smc: fix TOCTOU race between smc_listen_out() and listener close
c8f256dc8492 net: remove WARN_ON_ONCE() from sk_mc_loop()
363e048a9d0a net: prestera: validate firmware header length
02226af69362 net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length
12afa450a6a6 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
25d40cf9dab1 netfilter: flowtable: consolidate xmit path
a66e869cf0c9 tcp: fix TFO max_qlen accounting across reuseport migration
6c24ec01fb76 sctp: fix addip_serial increment on ASCONF_ACK allocation failure
1e8f24b1e3fe bnxt_en: Fix PTP PPS setting bug
aab3b5f4d8ec bnxt_en: Disable EOP for TPA on all chips to prevent data corruption
6a2e50924e57 bnxt_en: Refresh VNIC default ring on queue restart if needed
f1a4e95e296b bnxt_en: Determine and store default RX ring in vnic structure
965c45be24e1 bnxt_en: Move RSS table fill outside __bnxt_hwrm_vnic_set_rss()
88664c48d7d1 net/mlx5e: fix BQL reset on SQ re-activation
beb47092fe8f bnge: use int for bnge_fix_rings_count() return value
4901b23b5ca7 net: stmmac: resume PHY before hardware setup when opening the interface
99b7bcee0158 selftests/ftrace: refactor eprobes test to fix argument checks
a7a00ecf5424 hwmon: (pmbus/lm25066) Fix PMBus coefficient calculations
2e5ea8272cea hwmon: (nzxt-smart2) Check return value of init_device() in probe
9fccf43f0531 drm/xe/uc: Apply RCS/CCS yield policy to SR-IOV VFs
d6222af7274f net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
a8139285c892 net/openvswitch: check Ethernet header length in key_extract()
a06e4611d455 vhost-scsi: reject feature changes after endpoint
2417a498cf3f vhost-scsi: Validate T10 PI scatterlist counts
cd2f1d9fe8a5 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
64d322c28857 udp: fix potential use-after-free in tunnel segmentation
5fd121971912 xsk: validate metadata when processing requests
1a1534cc3b41 xsk: move xsk_tx_metadata_request() to xdp_sock_drv.h
af511afa1d29 xsk: validate launch-time metadata size
0ba2e1eb07a8 xsk: clear metadata pointer when no timestamp is requested
5ec4f525373b xsk: pass TX metadata pointer by reference
642c6e73fce1 xsk: require at least 16 bytes of TX metadata
b0b7202f751b bnxt: fix memory leak in bnxt_queue_mem_alloc error cases
ad9ffc61fafe eth: bnxt: support qcfg provided rx page size
cd5485a702ef eth: bnxt: store rx buffer size per queue
9c1406e2ecd2 net: pass queue rx page size from memory provider
b3fecb888e94 net: add bare bone queue configs
96197286b0ac net: reduce indent of struct netdev_queue_mgmt_ops members
34debe05685d bnxt_en: Do not set EOP on RX AGG BDs on 5760X chips
5ba1a458c5e2 tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss()
821f6416e697 hwmon: (pmbus) Fix type confusion in notification logic
11720d869be1 hwmon: (pmbus_core) Use guard() for mutex protection
cde8931a2539 vdpa/mlx5: Fix buffer length in create_direct_keys()
a1c236b385d8 vhost/vdpa: reject overflowing PA map page counts on 32-bit
cefcbbe20846 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
846ce792b6dd counter: microchip-tcb-capture: Fix DT channel validation
80094352bd40 net/mlx5: fw_tracer, return NULL on create error
7b02c6d2a3cd devlink: fix net namespace reference leak in reload
1efcc7114009 net: hisilicon: hix5hd2_gmac: remove redundant NAPI delete
0e7a8cf8895b net/sched: cls_route: fix fastmap use-after-free on filter
10cb31b2b74c net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()
d8a6f7993520 bpf: Propagate untrusted pointer state in commuted arithmetic
c2da73a1f715 bpf: split check_reg_sane_offset() in two parts
db6382ed3361 bpf: Preserve pointer state for commuted arithmetic
24a8f2c29aeb btrfs: fix memory leak in btrfs_do_encoded_write()
26e968526eb5 watchdog: bd96801_wdt: Fix timeout for enabled WDG
b3ff48c4ea8b ipvs: return the csum validation for forward hook
a69a4b3fff58 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
1e8a5467a7a7 netfilter: ipset: switch ext_size to atomic64_t
970e9494f44a pds_core: cancel pending PCI reset work on AER recovery
ef8e37ac448d pds_core: keep the health thread stopped during reset
ff9e7d5e3500 net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock
e506e704b747 enic: fix tx_hang_reset use-after-free on device removal
2faf75a8a065 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
35ddcc856b5b Revert "net: thunderbolt: Enable end-to-end flow control also in transmit"
d512823059af net: hns3: fix speed configuration residue after driver reload
8701a643db23 drm/bridge: ps8640: propagate AUX transfer register errors
d47212d86690 ovpn: fix incorrect use of rcu_access_pointer()
54dd83f24b91 ovpn: ensure TCP vars are initialized first
f34949d63cbb ovpn: disable IPv4 redirects on MP interfaces
e774f7d8fc73 ovpn: hash floated peer by transport identity only
9a776388ef8d ovpn: zero-initialize sockaddr before learning a floated endpoint
61fb3cca40ff ovpn: ensure socket is owned by ovpn before deref sk_user_data
157164812a0c ovpn: rehash peer in by_transp_addr table on CMD_PEER_SET
d20c18108898 ovpn: skip rehash for peers already removed from by_id
9e5e88fbfc87 ARM: dts: BCM5301X: fix PCIe controller 2 second interrupt
92b9d92a35a0 ovpn: add missing rtnl_link_ops->get_size callback
d740dea9e255 pinctrl: qcom: ipq806x: mark pci reset as a GPIO pin function
23c94a468efe pinctrl: qcom: ipq806x: mark gpio as a GPIO pin function
913d2295b772 selftests/sched_ext: Handle sleeping task affinity changes in numa test
ce0212d230bd ARM: npcm: Fix OF node refcount leaks in SMP setup
ccf6738adcaf xfs: handle NULL b_addr in xfs_buf_free
d90599a42f6c arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timer
d71dfffa512e NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
bd45b89d7346 arm64: dts: qcom: sdm850-lenovo-yoga-c630: lower PSCI cluster idle
df9d22383d7c arm64: dts: qcom: purwa: Fix GPU IOMMU property
7a6e90afb696 arm64: dts: qcom: rename x1p42100 to purwa
1e2b408c1a76 arm64: dts: qcom: Rework X1-based Asus Zenbook A14's displays
387edbe4706b arm64: dts: qcom: rename x1e80100 to hamoa
d089f32d34f8 drm/amd/display: Check for tg ops in dce110_set_avmute
8aba384bfc8a drm/amd/display: Add AV mute wait frames to dce110_set_avmute
50359c42e0eb selftests/bpf: Fail unbound UDP on sockmap update
62fefb817bb3 sched/fair: Revert 6d71a9c61604 ("sched/fair: Fix EEVDF entity placement bug causing scheduling lag")
4043e196dc88 sched/fair: Separate se->vlag from se->vprot
9a3eef676cd8 mount: honour SB_NOUSER in the new mount API
79a45d44323b KVM: s390: pci: Fix resource leak on IRQ registration failure