UPDATE: 6.18.44

[fepitre-bot]

Update to 6.18.44

Details

Changes since previous version:
gregkh/linux@bfe7f9993467 x86/bugs: Make Safe-RET robust against interrupt injection
gregkh/linux@7b923c78b50d Linux 6.18.43
gregkh/linux@285641eb82f0 netfilter: nf_conntrack_expect: restore helper propagation via expectation
gregkh/linux@d36086cd1826 kunit: tool: skip stty when stdin is not a tty
gregkh/linux@9bb3714e0998 kunit: tool: Terminate kernel under test on SIGINT
gregkh/linux@85b94a74a0b8 netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge()
gregkh/linux@a5cdd2407dd8 net: mpls: initialize rtm_tos in mpls_getroute()
gregkh/linux@e8362523fd1b drm/gpusvm: publish dpagemap early to avoid device mapping leak on error
gregkh/linux@302eb8765132 ALSA: hda/realtek: add quirk for HP Dragonfly Folio G3 2-in-1
gregkh/linux@df0f33293c0a HID: logitech-dj: Standardise hid_report_enum variable nomenclature
gregkh/linux@bc3bba4656ad HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
gregkh/linux@98f57011e6cd HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
gregkh/linux@3e957c9b160c lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
gregkh/linux@d01e88d421a6 mm/slab: prevent unbounded recursion in free path with new kmalloc type
gregkh/linux@54a62153c765 thunderbolt: Prevent XDomain delayed work use-after-free on disconnect
gregkh/linux@3e55d2809547 pinctrl: qcom: Unconditionally mark gpio as wakeup enable
gregkh/linux@2ef9bb422dd6 pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
gregkh/linux@9086b488f273 dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
gregkh/linux@0679c0c189d2 dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
gregkh/linux@3808bab5d95a iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
gregkh/linux@094145989b31 gpio: sloppy-logic-analyzer: Fix memory leak in gpio_la_poll_probe()
gregkh/linux@99dc2c143dfc selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE
gregkh/linux@8229a5388854 selftests/seccomp: Fix pointer type mismatch build error
gregkh/linux@a0f288ebe6d8 ata: sata_mv: accept 1 or 2 resources in platform probe
gregkh/linux@9355f526c821 ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
gregkh/linux@3fd94b9ffe99 phy: qcom: m31-eusb2: Fix return value of init call
gregkh/linux@3cbfb9b886dc ASoC: max98095: fix missing IS_ERR() before PTR_ERR() on mclk lookup
gregkh/linux@f5edba9bc69d ASoC: max98090: fix missing IS_ERR() before PTR_ERR() on mclk lookup
gregkh/linux@cfa7e2734877 of: reserved_mem: prevent OOB when too many dynamic regions are defined
gregkh/linux@762561c43859 btrfs: fix leaking BTRFS_FS_STATE_REMOUNTING flag
gregkh/linux@deddd28fd83c btrfs: zoned: fix deadlock between metadata writeback and transaction commit
gregkh/linux@4d4ef6627304 btrfs: zoned: reset meta_write_pointer on zone reset
gregkh/linux@dff474e723ed btrfs: raid56: fix an incorrect csum skip during scrub
gregkh/linux@86fb88ac8c91 phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
gregkh/linux@ec81ecd2ac09 phy: zynqmp: fix runtime PM leak on probe allocation failure
gregkh/linux@f74554e67ccf netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
gregkh/linux@6e70eba930a2 drm/mediatek: Check CRTC state before freeing
gregkh/linux@82cdbb6155a2 arch/x86: mshyperv: Discover Confidential VMBus availability
gregkh/linux@74d20e3cf88e Drivers: hv: Rename fields for SynIC message and event pages
gregkh/linux@d397787dbc4b Drivers: hv: Allocate the paravisor SynIC pages when required
gregkh/linux@b215cb70e14c Drivers: hv: vmbus: Replace lockdep_hardirq_threaded() with lockdep annotation
gregkh/linux@a920ead0bc2f mshv: Fix duplicate GSI detection for GSI 0
gregkh/linux@db1c4a8e9080 mshv: Fix sleeping under spinlock in mshv_portid_alloc
gregkh/linux@31d491f9da94 KVM: arm64: Reject guest_memfd memslots when the VM has MTE
gregkh/linux@6469ad300508 KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
gregkh/linux@e9417d21a22a keys: fix out-of-bounds read in keyring_get_key_chunk()
gregkh/linux@3d9f16c0b643 keys: make keyring key-chunk byte order agree with keyring_diff_objects()
gregkh/linux@adf1a3ba27ad assoc_array: trim the final shortcut word using the current chunk end
gregkh/linux@63ba12b664a2 netfilter: nf_tables: make nft_object rhltable per table
gregkh/linux@d186f77d18bd netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH
gregkh/linux@00eb23829fd0 ipvs: fix the checksum validations
gregkh/linux@ce96c40a049b ipvs: fix places with wrong packet offsets
gregkh/linux@e6f4b4b40db8 ipvs: do not mangle ICMP replies for non-first fragments
gregkh/linux@16b553c46e34 netfilter: nft_payload: fix mask build for partial field offload
gregkh/linux@4147866087fb ASoC: SDCA: Ensure that Control Range is large enough for header
gregkh/linux@f6787fdffcae rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled
gregkh/linux@b1d480fce05f rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()
gregkh/linux@5c170577049f af_unix: fix listen() succeeding on sockets in the wrong state
gregkh/linux@0372a5219112 selftests: af_unix: Add tests for ECONNRESET and EOF semantics
gregkh/linux@643ec3e24a49 selftest: af_unix: Create its own .gitignore.
gregkh/linux@814c5b159003 selftests/net/af_unix: test listen() rejects wrong socket states
gregkh/linux@05e283466b86 xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
gregkh/linux@411554cb868b xsk: use a smaller new lock for shared pool case
gregkh/linux@ceb00cb87a22 xsk: drain continuation descs after overflow in xsk_build_skb()
gregkh/linux@8e0996418590 pinctrl-amd: Don't clear S4 wake bits at probe
gregkh/linux@3ef209ca0b4b scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
gregkh/linux@72815741715b scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
gregkh/linux@9e24b47ef81d scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
gregkh/linux@b2851429afc5 smb: client: fix buffer leaks in SMB1 read and write
gregkh/linux@fcc3d77fef02 ASoC: tas2781: Use correct calibration data for SINEGAIN2 register
gregkh/linux@d3337eefab62 spi: spi-cadence: supports transmission with bits_per_word of 16 and 32
gregkh/linux@e28d478c003d spi: spi-cadence: Move TX FIFO full busy-wait into FIFO
gregkh/linux@a42d727dae57 hwmon: (nct6775-core) Fix number of temperature registers for NCT6116
gregkh/linux@8da94361f9ae hwmon: (ina2xx) Make it easier to add more devices
gregkh/linux@fdfde077e025 hwmon: (ina2xx) Add support for INA234
gregkh/linux@e627f4ad9eea hwmon: (ina2xx) Shift INA234 shunt and current registers
gregkh/linux@b60e8486c04d hwmon: (ina2xx) Fix various overflow issues
gregkh/linux@08aee6d45eef hwmon: (ltc4282) Fix reading the minimum alarm voltage
gregkh/linux@c498adfd4c3e hwmon: (sht3x) Fix unaligned accesses
gregkh/linux@075fce376cf8 hwmon: (lm90) Only report alarms if driver is ready
gregkh/linux@2332d35aaf20 hwmon: (nzxt-smart2) DMA-align output buffer
gregkh/linux@5ec5f00fc606 net: do not send ICMP/NDISC Redirects when peer allocation fails
gregkh/linux@1b722740ac5c hwmon: (nct6775-core) Prevent access to unsupported weight registers
gregkh/linux@2e0c6761c055 net: bridge: mrp: fix Option TLV length in MRP_Test frames
gregkh/linux@ae20a8a4de06 forcedeth: fix UAF of txrx_stats in nv_remove
gregkh/linux@28548ecc2b45 hwmon: (adt7470) Fix fans stuck in manual mode on I2C errors
gregkh/linux@3e06ff0c79ea hwmon: (adt7470) Fix cache updated before hardware write on I2C error
gregkh/linux@82d65f7ef11e hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread
gregkh/linux@d5d4034bb6f6 hwmon: (adt7470) Fix temperature alarm logic in hwmon_temp_read()
gregkh/linux@1d6b54dbe885 hwmon: (adt7470) Fix swapped PWM3 and PWM4 auto mode masks
gregkh/linux@ddd689bd7226 hwmon: (adt7470) Use cached PWM frequency value
gregkh/linux@96ad57d31763 hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read
gregkh/linux@5a6b0ccb8b01 hwmon: (adt7470) Fix PWM auto temp state array and bounds check
gregkh/linux@db986098f308 rtase: fix double free of multi-frag skb on DMA map failure
gregkh/linux@3d24f2e5641b powerpc/boot: Fix simpleboot CPU node lookup check
gregkh/linux@b407b98cf665 powerpc/boot: Fix treeboot-currituck CPU node lookup check
gregkh/linux@acbf711a2066 powerpc/boot: Fix treeboot-akebono CPU node lookup check
gregkh/linux@f82a2ded3d7a net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister()
gregkh/linux@b558e07708d8 wifi: mac80211: validate individual TWT params before driver setup
gregkh/linux@627826ef4208 netfs: clear PG_private_2 on copy-to-cache append failure
gregkh/linux@291ebecdf315 netfs: handle single writeback rolling buffer allocation failure
gregkh/linux@2c148a31ca01 netfs: release readahead folios on iterator preparation failure
gregkh/linux@276f1f180f55 net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
gregkh/linux@ae7120102e1b hwmon: (pmbus) Fix return value from pmbus_update_byte_data()
gregkh/linux@d44081c61dc9 idpf: adjust TxQ ring count minimum
gregkh/linux@6ebbf198e76c idpf: Fix mailbox IRQ name leak on request failure
gregkh/linux@4e1f45de5b31 ice: suppress DPLL errors during reset recovery
gregkh/linux@63c0f396a18b Bluetooth: ISO: clear iso_data always when detaching conn from hcon
gregkh/linux@58e3c5289ad2 Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp
gregkh/linux@72d5bb1d77d7 Bluetooth: ISO: lock sk in iso_sock_getname
gregkh/linux@f1f167991a68 Bluetooth: HCI: Add initial support for PAST
gregkh/linux@3120664aa333 Bluetooth: ISO: Fix data-race on iso_pi(sk) in socket and HCI event paths
gregkh/linux@e8e9cff6d80e Bluetooth: ISO: lock sk in iso_connect_ind
gregkh/linux@1fc2132950c2 Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos
gregkh/linux@dfce8d30fc5b Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis()
gregkh/linux@cde36776cfe6 Bluetooth: ISO: Fix not updating BIS sender source address
gregkh/linux@09a69828ae59 Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release
gregkh/linux@4e9b5e8669b3 Bluetooth: ISO: hold sk properly in iso_conn_ready
gregkh/linux@e76a0ae6542a Bluetooth: ISO: fix leaking sk after socket release
gregkh/linux@82e982f54f96 Bluetooth: ISO: avoid deadlocks in iso_sock_timeout
gregkh/linux@e941799c31f6 Bluetooth: ISO: ensure no dangling hcon references in iso_conn
gregkh/linux@3b921533e8aa Bluetooth: ISO: fix refcounting of iso_conn
gregkh/linux@c618a9a5b08e Bluetooth: btintel: Validate length before parsing diagnostics TLV
gregkh/linux@de17305393ec Bluetooth: hci_sync: make hci_cmd_sync_run_once return -EEXIST if exists
gregkh/linux@e8f9fef362ba Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
gregkh/linux@5576afebf726 Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
gregkh/linux@5ea70ad040c1 x86/boot: Add volatile, clobbers and zero-length test in memcmp()
gregkh/linux@613aaeeaf8cb net: phylink: put link_gpio if phylink_create fails
gregkh/linux@bdd8a1297ef1 scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
gregkh/linux@e50420448999 scsi: ufs: core: Cancel RTC work in active-active suspend
gregkh/linux@c249cfe1d8df scsi: ufs: core: Avoid IRQ thread wakeup during active UIC command
gregkh/linux@ff333def3147 scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
gregkh/linux@54c6fb24c602 scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
gregkh/linux@69a258a5a322 scsi: target: Clear cmd_cnt when initial counter enrollment fails
gregkh/linux@42b87cfd9666 net: sxgbe: free TX rings on RX allocation failure
gregkh/linux@b4f8c33593f2 net: sxgbe: check descriptor ring allocation failures
gregkh/linux@50edffd0854f can: isotp: check register_netdevice_notifier() error in module init
gregkh/linux@84b5aa55de7c drm/i915/dp: Ignore the sink's DSC max FRL rate without a PCON DSC encoder
gregkh/linux@fc97dcb42fb4 fprobe: Fix module reference count leak on error in register_fprobe()
gregkh/linux@9b604041f100 tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
gregkh/linux@a20a0010eb64 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
gregkh/linux@01bd01b61ad9 riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
gregkh/linux@b297559dc2f2 accel/qaic: use sizeof(*trans_hdr) for transaction length check
gregkh/linux@54e07a158f7a riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
gregkh/linux@fd9586881d47 net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
gregkh/linux@1e0dfb7e7a5d net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
gregkh/linux@6bf322ab0741 ptp: netc: fix potential interrupt storm caused by incorrect unbind order
gregkh/linux@b90916156b47 net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
gregkh/linux@5a73e8c632c3 octeontx2-pf: Set correct sequence for carrier off and tx queue stop
gregkh/linux@caeaaf23f7c3 sched/deadline: Use revised wakeup rule only for running dl_server
gregkh/linux@51c52e493346 spi: spi-nxp-fspi: add per-SoC SDR/DTR clock rate limits for all supported SoCs
gregkh/linux@e51becb8f337 qede: sync udp_tunnel ports outside qede_lock in the recovery path
gregkh/linux@cebba11df714 drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status
gregkh/linux@213b4568f6e5 ksmbd: return success for deferred final close
gregkh/linux@9be4a66f019e ksmbd: fix use-after-free in __close_file_table_ids()
gregkh/linux@cfc686a1174a iomap: add a separate bio_set for iomap_split_ioend
gregkh/linux@72a90ce4918b mshv: Fix race in mshv_irqfd_deassign
gregkh/linux@fc362bfcb060 mshv: adjust interrupt control structure for ARM64
gregkh/linux@f50f5d3972da mshv: Fix level-triggered check on uninitialized data
gregkh/linux@062aa5dcc49a mshv: Order pt_vp_array publish against irqfd assertion path
gregkh/linux@294b464b2be7 iommufd/viommu: Release the igroup lock on the vdevice_size error path
gregkh/linux@ee2212b48232 iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
gregkh/linux@564ac339c0f8 iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace
gregkh/linux@6da8f37419dd iommu/iommufd: Fix IOPF group ownership UAF
gregkh/linux@93d934668047 pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
gregkh/linux@ad0ad3c228b6 pinctrl: devicetree: don't free uninitialized dev_name on error path
gregkh/linux@5aaa06dfc10f erofs: cap LZMA stream pool size
gregkh/linux@96b0aa79b0e1 pinctrl: bm1880: add missing select GENERIC_PINCONF
gregkh/linux@2205263b1e01 fortify: Disable -Wstringop-overread in tests
gregkh/linux@2be94d6b2078 mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
gregkh/linux@9668ffe0e2a5 mm/util: don't read __page_2 for order-1 folios in snapshot_page()
gregkh/linux@c091462e46f7 selftest: fix headers in fclog.c
gregkh/linux@7d3e1d3a0dce fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
gregkh/linux@32134cf9211b mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
gregkh/linux@126a70bf1a08 mm/hugetlb: fix list corruption in allocate_file_region_entries()
gregkh/linux@e0fa737783b5 mm/vmstat: fold stranded per-cpu node stats when a node comes online
gregkh/linux@3b2e08e0ede7 tracing/probes: Reject $arg0 in meta argument expansion
gregkh/linux@e768ea3a422d tracing/fprobe: Roll back on enable_trace_fprobe() failure
gregkh/linux@5acc92947baa KVM: VMX: add memory clobber to asm for VMX instructions
gregkh/linux@7668c58dcf46 KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
gregkh/linux@6837f0ae85fd KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
gregkh/linux@70871b121f81 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages
gregkh/linux@1abf9ce39a86 KVM: s390: pci: Fix missing error codes and memory unaccounting
gregkh/linux@e137d082325b KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
gregkh/linux@b878ba7e2814 KVM: s390: pci: Validate AIBV and AISB before pinning guest pages
gregkh/linux@c0837aeace96 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister
gregkh/linux@17b412468c7a sctp: validate Adaptation Indication parameter length
gregkh/linux@185c784c9809 audit: fix potential integer overflow in audit_log_n_string()
gregkh/linux@cae0dfed5d30 audit: fix potential use-after-free in audit_del_rule()
gregkh/linux@f14d41dbc2fd Bluetooth: btusb: Fix short read errors in btusb_qca_send_vendor_req()
gregkh/linux@6936b367ee6d Bluetooth: btmtk: Fix short read errors in btmtk_usb_uhw_reg_read()
gregkh/linux@814f82f432dc Bluetooth: mgmt: fix pending command UAF in EIR updates
gregkh/linux@a33bc07b4730 Bluetooth: SCO: give the socket its own sco_conn reference
gregkh/linux@c569def320aa Bluetooth: mgmt: fix UAF in pair command cancellation
gregkh/linux@eb1d8318764d Bluetooth: hci_sync: Fix advertising data UAFs
gregkh/linux@2ebf63aa557a Bluetooth: HIDP: reject frames without a transaction header
gregkh/linux@27cc0e603355 Bluetooth: HIDP: validate numbered report payloads
gregkh/linux@5c7fdcbecbab bpf: lwt: Fix dst reference leak on reroute failure
gregkh/linux@b53face003b4 afs: Fix afs_fs_fetch_data() to set call->async
gregkh/linux@d703f022a28a afs: Fix afs_fs_fetch_data() to subtract transferred from len
gregkh/linux@c0d3b81f703b afs: Fix UAF when sending a message
gregkh/linux@11e2953d9f4c ALSA: 6fire: Fix UAF at error handling during probe
gregkh/linux@7484669d1fba ALSA: hda/realtek: Add quirk for TongFang X6SP45xU
gregkh/linux@4969533a1b95 ALSA: lx6464es: fix period byte count for 16-bit streams
gregkh/linux@2940cc3cf43c ALSA: pcm: wake linked drain waiters on unlink
gregkh/linux@5260e195c53e ALSA: seq: Fix division by zero in initialize_timer()
gregkh/linux@a26a2e52736f ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes
gregkh/linux@032746c2dd9a ALSA: ump: fix double free of out_cvts on rawmidi error
gregkh/linux@6df5b3288160 ASoC: fsl_asrc: fix m2m_init error path to use goto instead of bare return
gregkh/linux@cac7d2066b2f ASoC: fsl_easrc: fix m2m_init error path to use goto instead of bare return
gregkh/linux@35d5f1852e39 ASoC: tas2562: fix DVC coefficient write order
gregkh/linux@0a02b0c87807 ASoC: tas2562: fix broken entries in the volume lookup table
gregkh/linux@9562ddbc6ed8 ata: libata-eh: Increase STANDBY IMMEDIATE timeout
gregkh/linux@79f8720029f2 ata: libata-sata: fix ata_scsi_lpm_supported() iteration
gregkh/linux@cc014ebf8031 ALSA: usb-audio: fix use-after-free in ump_to_endpoint()
gregkh/linux@7ba01e0d3539 ALSA: usb-audio: fix stack info leak in RME Digiface status
gregkh/linux@b5305a0d0bb8 ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output()
gregkh/linux@04595233e560 ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set
gregkh/linux@2db4535d6af7 ALSA: usb-audio: Clamp frame size in implicit-feedback mode
gregkh/linux@b0bdca3a49cf dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
gregkh/linux@b10bb77e91e9 e1000: fix memory leak in e1000_probe()
gregkh/linux@845a9cdd9b03 igbvf: Fix leak in TX DMA error cleanup
gregkh/linux@3b5aee6fcbf6 igc: remove napi_synchronize() in igc_down()
gregkh/linux@b5ee5b266f83 ipvs: do not propagate one-packet flag to synced conns
gregkh/linux@a60b5da05e31 ksmbd: reject repeated SMB2 NEGOTIATE requests
gregkh/linux@2060764e0f46 mshv: fix hv_input_get_system_property struct
gregkh/linux@f807a63d0d95 net/smc: fix socket use-after-free during link group termination
gregkh/linux@4ae701848e4b netfilter: ipset: do not update comments from kernel-side hash adds
gregkh/linux@88752b811f72 of/address: Fix NULL bus dereference in of_pci_range_parser_one()
gregkh/linux@bed792737b5f tipc: avoid use-after-free in poll trace queue dumps
gregkh/linux@c9dcfe6b8b71 wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
gregkh/linux@fdc1d702bf30 binfmt_misc: restore write access when removing an entry
gregkh/linux@255a758697da binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
gregkh/linux@840bb9c49c3e binfmt_misc: reject a flag character as the field delimiter
gregkh/linux@4dad8ca637d4 binfmt_misc: don't let an 'F' entry pin its own instance
gregkh/linux@63b361f22886 io_uring/net: initialize mshot_len for send
gregkh/linux@b11907c905fa mm/page_reporting: use system_freezable_wq to fix UAF during suspend
gregkh/linux@332a546b4ee5 mm: memcg: initialize *locked in memcg1_oom_prepare() stub
gregkh/linux@0309ebbc5700 net: bridge: stop fast-leave after deleting a port group
gregkh/linux@dc3ab0422066 net: ipv6: clear suppressed fib6 rule result
gregkh/linux@4ef801b838d8 net: pktgen: fix proc entry use-after-free
gregkh/linux@e4b98f9778df powerpc/ps3: Fix map failure path in dma_ioc0_map_pages()
gregkh/linux@180ff4c81faf um: vector: fix use-after-free in vector_mmsg_rx()
gregkh/linux@3bd35a5e272a uprobes: Fix NULL pointer dereference in hprobe_expire()
gregkh/linux@b24ba0bbffe3 veth: convert frag_list skbs before running XDP
gregkh/linux@1235e017aa11 vxlan: re-fetch eth header after route_shortcircuit()
gregkh/linux@adeed09eeb3b vxlan: unclone skb head before modifying eth header in route_shortcircuit()
gregkh/linux@ff89415d34c3 vxlan: use neigh_ha_snapshot() in route_shortcircuit()
gregkh/linux@94dee751aad6 vxlan: use pskb_network_may_pull() for transmit path header pulls
gregkh/linux@ee799977d794 vxlan: use pskb_network_may_pull() in route_shortcircuit()
gregkh/linux@205feb72e5be ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
gregkh/linux@cbb5ed3be9ca tracing: Check return value of register_event() in trace_module_add_events()
gregkh/linux@c26a6477e149 tracing/filters: Fix false positive match in regex_match_full()
gregkh/linux@581e5166f078 spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
gregkh/linux@2e047b4171de spi: qcom-qspi: Correct max DMA length to avoid 64K boundary failure
gregkh/linux@a0bc578641d7 selftests/mm: fix potential wild pointer access of getline due to missing init
gregkh/linux@5b4d4d5a29f9 selftests/clone3: fix wild pointer access of getline due to missing init
gregkh/linux@2047ed09bf13 scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
gregkh/linux@a0d1693923f4 sctp: reject stale cookies with mismatched verification tags
gregkh/linux@4ba5bf7ed50f sctp: prevent peer transport count overflow
gregkh/linux@30ae66374637 hwmon: (npcm750-pwm-fan): stop fan timer on device detach
gregkh/linux@7a91d07939e0 hwmon: (pmbus/core) notify on the hwmon device, not the i2c client
gregkh/linux@1883a09a37fe i2c: amd-mp2: Unregister callback on adapter add failure
gregkh/linux@2e4bc8422cde gpio: pca953x: fix cache_only and IRQ state on restore_context() failure
gregkh/linux@466ab0c41d5f gpio: pch: use raw_spinlock_t for the register lock
gregkh/linux@efbcecdecefc cifs: add fscache_resize_cookie() to cifs_setsize()
gregkh/linux@437b38a08c0a cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
gregkh/linux@63d6c855b27d cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
gregkh/linux@6d89f33a6467 power: supply: bq25890: fix the -10 C NTC lookup entry
gregkh/linux@b039f13e095d power: supply: max17040: handle missing status supplier
gregkh/linux@ef1aa7cfb8c6 s390/pci: Fix s390_pci_mmio_write syscall error return without MIO
gregkh/linux@bd63c7879eaa s390/qeth: Check CAP_NET_ADMIN for private ioctls
gregkh/linux@86cdfd061509 s390/dasd: Fix potential NULL pointer dereference
gregkh/linux@e16e0fc54120 s390/dasd: Fix undersized format-check buffer
gregkh/linux@672b12940e3f s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
gregkh/linux@a57fd7fcdb63 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
gregkh/linux@fbb0410986e8 s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
gregkh/linux@ad93a1f1a456 s390/zcrypt: Validate length for CCA AES cipher key requests
gregkh/linux@013a4484f061 s390/zcrypt: Validate length for CCA ECC private key requests
gregkh/linux@4211450f0fec phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
gregkh/linux@79a312664118 phy: zynqmp: use read-modify-write for SERDES scrambler bypass
gregkh/linux@74b30e7ef461 phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
gregkh/linux@90623c949962 net: openvswitch: fix potential UAF on meter attach failure
gregkh/linux@9c7246cc509f net: openvswitch: fix skb leak on flow key update failure during recirculation
gregkh/linux@e0ba8eaef2a0 net: openvswitch: fix skb leak on flow key update failure during ct
gregkh/linux@7e8789f5b5d8 ice: wait for reset completion in ice_resume()
gregkh/linux@326c89ea2685 ice: fix VF interrupts cleanup
gregkh/linux@6a5cc2b4e6fa ice: fix memory leak in ice_lbtest_prepare_rings()
gregkh/linux@d9b5419df065 i2c: spacemit: request IRQ after controller initialization
gregkh/linux@40dd71744599 i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
gregkh/linux@19b783335d62 i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
gregkh/linux@82233ff0e36d i2c: iproc: reset bus after timeout if START_BUSY is stuck
gregkh/linux@7a5db225ab5a i2c: imx: mark I2C adapter when hardware is powered down
gregkh/linux@12a4f0950a15 i2c: imx: Fix slave registration race and error handling
gregkh/linux@affd62f5719a i2c: imx: Cancel hrtimer before clearing slave pointer
gregkh/linux@26cf99713a96 can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
gregkh/linux@0b23144c59c1 can: ems_usb: validate CPC message lengths
gregkh/linux@c311f17c261f can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
gregkh/linux@996eb21acdc9 can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
gregkh/linux@8604a3b81b9d can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
gregkh/linux@54258ea8d61f can: j1939: use netdevice_tracker for j1939{priv,session,ecu} tracking
gregkh/linux@2e90b2b40607 can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
gregkh/linux@185cb1fa3814 can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
gregkh/linux@2ee477e541a6 can: softing: fw_parse(): validate firmware record spans
gregkh/linux@1acab790b7ce can: peak_usb: add bounds check for USB channel index
gregkh/linux@92d0de80ca22 can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
gregkh/linux@2427ef427bdd can: peak_usb: validate uCAN receive record lengths
gregkh/linux@aa5e790bf185 can: ctucanfd: add missing MODULE_DEVICE_TABLE()
gregkh/linux@cae2880f8ffa can: ctucanfd: use self-test mode for PRESUME_ACK
gregkh/linux@46fc5aecde5c can: ctucanfd: unmap BAR0 using base address
gregkh/linux@7d1619f56a75 can: ctucanfd: handle bus error interrupts
gregkh/linux@e8b797940536 can: ctucanfd: mark error-active controller status valid
gregkh/linux@58d2bb394e88 drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
gregkh/linux@6cd5acf6f87c drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
gregkh/linux@57667eb7548f drm/vc4: Zero the tile state data array before each BIN job
gregkh/linux@da898bb6faf3 drm/bridge: display-connector: Fix I2C adapter resource leak
gregkh/linux@2a761b9be586 drm/panthor: reject firmware sections with oversized data
gregkh/linux@c835f2b0b716 drm/panthor: validate firmware interface structure sizes
gregkh/linux@0f1ff05c58e1 drm/mediatek: ovl_adaptor: balance component registrations
gregkh/linux@18d21c9d04b0 drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
gregkh/linux@d330ac90d85f drm/amdgpu: restore UMD profile pstate after runtime resume
gregkh/linux@45ba7f091abf drm/amdgpu: cap GTT size to physical RAM on APUs
gregkh/linux@1860818feb4d drm/amd/pm: fix torn gpu metrics reads
gregkh/linux@3c2ae9509717 drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
gregkh/linux@02647d983407 drm/amd/display: use proper context for logging
gregkh/linux@9e52212aff8e drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
gregkh/linux@5f0f2ddeac73 drm/amdkfd: fix QID bit leak in pqm_create_queue()
gregkh/linux@6dc0b4b39ed4 drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
gregkh/linux@6189ceca5ce7 drm/amdkfd: Handle invalid event type in CRIU event restore
gregkh/linux@6a52f48157fa drm/amdkfd: hold event_mutex while checkpointing CRIU events
gregkh/linux@282f261cb035 drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
gregkh/linux@e479240a1e07 drm/vmwgfx: reject DX_BIND_QUERY without a DX context
gregkh/linux@10460699c312 drm/vmwgfx: clamp dirty-page range with min, not max
gregkh/linux@b79e82ea1823 drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
gregkh/linux@a8434b145b1e drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
gregkh/linux@dc0be7662b7b drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
gregkh/linux@7e40e6120fb2 drm/vmwgfx: bound DMA command body size against suffix pointer
gregkh/linux@96efee36453b drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
gregkh/linux@1eb4f796695b drm/vmwgfx: enforce cursor size limits for MOB cursors
gregkh/linux@cfd163169af3 drm/vmwgfx: use check_add_overflow for shader size+offset bound
gregkh/linux@042ca3877955 drm/vmwgfx: validate external BO copy bounds for both stride paths
gregkh/linux@6be3dbe45b28 spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
gregkh/linux@2b70bebc7094 HID: logitech-dj: Fix maxfield check in DJ short report validation
gregkh/linux@542d3b9fa8ec drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
gregkh/linux@7982678fa21e drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
gregkh/linux@f73e97080deb drm/xe/rtp: Maintain OA whitelists separately
gregkh/linux@cc716d3ac560 drm/xe/rtp: Keep track of non-OA nonpriv slots
gregkh/linux@4bb92418e749 drm/xe/rtp: Generalize whitelist_apply_to_hwe
gregkh/linux@c2cfee9bf8d4 drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
gregkh/linux@d43abc858f08 drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
gregkh/linux@f5966d900662 drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
gregkh/linux@9783d8662b56 drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
gregkh/linux@fc0c76b0450f drm/xe/rtp: Ensure locking/ref counting for OA whitelists
gregkh/linux@2b9a07002c2f mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
gregkh/linux@be11b4bf498a fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
gregkh/linux@10065fb89165 mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
gregkh/linux@10827847c40c file: add FD{ADD,PREPARE}()
gregkh/linux@f00dd592abe7 file: ensure cleanup
gregkh/linux@97e745b4ea05 net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()
gregkh/linux@5ddfc47e1228 net/handshake: Fix null-ptr-deref in handshake_complete()
gregkh/linux@b913801ad9b9 net/handshake: Take a long-lived file reference at submit
gregkh/linux@68eba6519cbd net/handshake: hand off the pinned file reference to accept_doit
gregkh/linux@6e7b52bd1394 net/handshake: Close the submit-side sock_hold race
gregkh/linux@2bf24a7e190a net/handshake: Drain pending requests at net namespace exit
gregkh/linux@58d9caa64f9c usb: typec: ucsi: split connector lock classes
gregkh/linux@3f7b3728dd90 usb: typec: ucsi: Fix race condition and ordering in port unregistration
gregkh/linux@276420a86e75 media: chips-media: wave5: Support CBP profile
gregkh/linux@f730ee0ef8fa media: qcom: camss: csid-340: Fix unused variables
gregkh/linux@5c6d5d2484ca media: qcom: camss: Fix RDI streaming for CSID 340
gregkh/linux@d6f322d68abf media: uapi: rkisp: Correct name version enum
gregkh/linux@02d378828af8 wifi: brcmfmac: drain bus_reset work on device removal
gregkh/linux@165613191ad9 userfaultfd: prevent registration of special VMAs
gregkh/linux@3f5807745798 drm/fb-helper: Allocate and release fb_info in single place
gregkh/linux@4d49ca777cf1 drm/tegra: fbdev: Remove offset into framebuffer memory
gregkh/linux@e06c39cc1c48 drm/amdgpu: Fix context pstate override handling
gregkh/linux@30b2d0843a41 drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
gregkh/linux@b485bfb45555 drm/xe/guc: Fix buffer overflow in steered register list allocation
gregkh/linux@dbbe08d73b8b drm/amd/display: check GRPH_FLIP status before sending event
gregkh/linux@3cb42a973f88 drm/amd/display: Exit idle optimizations before programming
gregkh/linux@005b9b443160 drm/xe/pat: Add helper to query compression enable status
gregkh/linux@0015b054b06d drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support
gregkh/linux@1ba553ee0b52 drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo
gregkh/linux@8fa8b0a46372 drm/xe/vm: Prevent binding of purged buffer objects
gregkh/linux@d256dac008d1 drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
gregkh/linux@b8ad916ba4e1 drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
gregkh/linux@21976fe52584 drm/xe: Wait on external BO kernel fences in exec IOCTL
gregkh/linux@894d4a739566 drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
gregkh/linux@df1582c0a101 drm/i915/vrr: require valid min/max vfreq for VRR
gregkh/linux@184de3d31f72 drm/xe: Use SVM range helpers in PT layer
gregkh/linux@6107b64cfcce drm/xe: Stub out new pagefault layer
gregkh/linux@b1a71151317c drm/xe: Add page reclamation info to device info
gregkh/linux@157b1e3384d7 drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
gregkh/linux@0902f06a6c0b can: use skb hash instead of private variable in headroom
gregkh/linux@10be509fa8fd can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
gregkh/linux@7bc7af179916 usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
gregkh/linux@e7731507270c drm/fb-helper: Fix a locking bug in an error path
gregkh/linux@358b5dcf1fd7 drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
gregkh/linux@1efe5d048a39 Linux 6.18.44