Linux Kernel 6.18.42

The 120 most recent commits in this release — the full changelog is longer:

• Linux 6.18.42
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
• gpu: Fix uninitialized buddy for built-in drivers
• net: stmmac: fix dwmac4 transmit performance regression
• net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query
• usb: gadget: f_tcm: synchronize delayed set_alt with teardown
• rust: device: avoid trailing ; in printing macros
• rust: allow suspicious_runtime_symbol_definitions lint for Rust >= 1.98
• mm/damon/core: disallow overlapping input ranges for damon_set_regions()
• mm/damon/core: validate ranges in damon_set_regions()
• i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization
• i3c: mipi-i3c-hci: Fix Hot-Join NACK
• pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
• pmdomain: imx93-blk-ctrl: convert to devm_* only
• net: ipa: fix SMEM state handle leaks in SMP2P init
• ata: libata-core: Reject an invalid concurrent positioning ranges count
• bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()
• bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
• octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF
• octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
• net: mana: Optimize irq affinity for low vcpu configs
• net: mana: Validate the packet length reported by the NIC
• fs/resctrl: Fix use-after-free during unmount
• fs/resctrl: Move RMID initialization to first mount
• fs/resctrl: Move allocation/free of closid_num_dirty_rmid[]
• x86,fs/resctrl: Rename some L3 specific functions
• x86,fs/resctrl: Rename struct rdt_mon_domain and rdt_hw_mon_domain
• fs/resctrl: Split L3 dependent parts out of __mon_event_count()
• mmc: vub300: fix use-after-free on probe failure
• mmc: vub300: rename probe error labels
• dm: avoid leaking the caller's thread keyring via the table device file
• cred: add kernel_cred() helper
• accel/amdxdna: reject command submission on devices without a submit op
• ovl: use linked upper dentry in copy-up tmpfile
• dmaengine: dw-edma-pcie: Reject devices without driver data
• dmaengine: dw-edma: Fix confusing cleanup.h syntax
• mtd: maps: vmu-flash: fix fault in unaligned fixup
• kho: make sure scratch size is always aligned by CMA_MIN_ALIGNMENT_BYTES
• mm/sparse-vmemmap: fix vmemmap accounting underflow
• remoteproc: xlnx: Check remote core state
• cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
• cxl/pci: Remove CXL VH handling in CONFIG_PCIEAER_CXL conditional blocks from core/pci.c
• cxl/pci: Remove unnecessary CXL RCH handling helper functions
• cxl/pci: Remove unnecessary CXL Endpoint handling helper functions
• SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
• SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists
• sunrpc: allocate a separate bvec array for socket sends
• NFSD: pass nfsd_file to nfsd_iter_read()
• pinctrl: renesas: rzg2l: Use -ENOTSUPP instead of -EOPNOTSUPP
• gpu/buddy: bail out of try_harder when alignment cannot be honoured
• drm: drop lib from header search path.
• gpu: Move DRM buddy allocator one level up (part two)
• netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
• netfilter: nf_conntrack_sip: remove net variable shadowing
• netfilter: nft_fib: reject fib expression on the netdev egress hook
• netfilter: nf_tables: remove register tracking infrastructure
• arm64: dts: qcom: hamoa: Fix OPP tables for all DisplayPort controllers
• arm64: dts: qcom: correct RBR opp entry
• VDUSE: avoid leaking information to userspace
• vduse: take out allocations from vduse_dev_alloc_coherent
• vduse: remove unused vaddr parameter of vduse_domain_free_coherent
• vduse: return internal vq group struct as map token
• xfs: don't replace the wrong part of the cow fork
• fuse-uring: fix race between registration and connection abortion
• audit: fix recursive locking deadlock in audit_dupe_exe()
• audit: use 'unsigned int' instead of 'unsigned'
• audit: widen ino fields to u64
• landlock: Account all audit data allocations to user space
• landlock: Fix formatting
• drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources
• fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
• ksmbd: validate ACE size against SID sub-authorities
• ksmbd: bound DACL dedup walk to copied ACEs
• ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL
• ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl
• net: qrtr: ns: Raise node count limit to 512
• ublk: wait on ublk_dev_ready() instead of ub->completion
• drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR
• dm-verity: fix buffer overflow in FEC calculation
• dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS
• dm-verity-fec: fix reading parity bytes split across blocks (take 3)
• dm-verity-fec: fix the size of dm_verity_fec_io::erasures
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
• drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx
• drm/amd/pm: fix smu13 power limit range calculation
• drm/amdgpu: fix aperture mapping leak
• drm/amdgpu: invoke pm_genpd_remove() before freeing genpd
• drm/amdgpu: fix resource leak on ACP reset timeout
• drm/amdgpu: fix division by zero with invalid uvd dimensions
• drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
• drm/amdgpu/vcn4: avoid rereading IB param length
• drm/amdgpu/vce: fix integer overflow in image size
• drm/amdgpu/soc24: reset dGPU if suspend got aborted
• drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()
• drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection
• drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection
• drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx8: drop unecessary BUG_ON()
• drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()
• drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()
• drm/amd/pm: make pp_features read-only when scpm is enabled
• drm/amd/pm: fix amdgpu_pm_info power display units
• watchdog: s32g_wdt: remove incorrect options in watchdog_info struct
• vxlan: mdb: Fix source list corruption on a failed replace
• vsock/virtio: collapse receive queue under memory pressure
• tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
• tcp: challenge ACK for non-exact RST in SYN-RECEIVED
• tcp: initialize standalone TCP-AO response padding
• rtase: Workaround for TX hang caused by hardware packet parsing
• pppoe: reload header pointer after dev_hard_header()
• ovpn: hold peer before scheduling keepalive work
• ovpn: fix peer refcount leak in TCP error paths
• openvswitch: fix GSO userspace truncation underflow
• mctp: serial: handle zero-length frames to prevent rx buffer overflow
• mac802154: llsec: reject frames shorter than the authentication tag
• mac802154: hold an interface reference across the scan worker
• ila: reload IPv6 header after pskb_may_pull in checksum adjust
• ice: use READ_ONCE() to access cached PHC time