Linux Kernel 6.18.44

The 120 most recent commits in this release — the full changelog is longer:

• Linux 6.18.44
• drm/tegra: fbdev: Do not assign to struct drm_fb_helper.info
• drm/fb-helper: Fix a locking bug in an error path
• usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
• can: isotp: fix timer drain order, wakeup handling and tx_gen ordering
• can: use skb hash instead of private variable in headroom
• drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
• drm/xe: Add page reclamation info to device info
• drm/xe: Stub out new pagefault layer
• drm/xe: Use SVM range helpers in PT layer
• drm/i915/vrr: require valid min/max vfreq for VRR
• drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
• drm/xe: Wait on external BO kernel fences in exec IOCTL
• drm/exec: Remove the index parameter from drm_exec_for_each_locked_obj[_reverse]
• drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC
• drm/xe/vm: Prevent binding of purged buffer objects
• drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo
• drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support
• drm/xe/pat: Add helper to query compression enable status
• drm/amd/display: Exit idle optimizations before programming
• drm/amd/display: check GRPH_FLIP status before sending event
• drm/xe/guc: Fix buffer overflow in steered register list allocation
• drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions
• drm/amdgpu: Fix context pstate override handling
• drm/tegra: fbdev: Remove offset into framebuffer memory
• drm/fb-helper: Allocate and release fb_info in single place
• userfaultfd: prevent registration of special VMAs
• wifi: brcmfmac: drain bus_reset work on device removal
• media: uapi: rkisp: Correct name version enum
• media: qcom: camss: Fix RDI streaming for CSID 340
• media: qcom: camss: csid-340: Fix unused variables
• media: chips-media: wave5: Support CBP profile
• usb: typec: ucsi: Fix race condition and ordering in port unregistration
• usb: typec: ucsi: split connector lock classes
• net/handshake: Drain pending requests at net namespace exit
• net/handshake: Close the submit-side sock_hold race
• net/handshake: hand off the pinned file reference to accept_doit
• net/handshake: Take a long-lived file reference at submit
• net/handshake: Fix null-ptr-deref in handshake_complete()
• net/handshake: convert handshake_nl_accept_doit() to FD_PREPARE()
• file: ensure cleanup
• file: add FD_{ADD,PREPARE}()
• mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
• fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
• mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
• drm/xe/rtp: Ensure locking/ref counting for OA whitelists
• drm/xe/oa: (De-)whitelist OA registers on OA stream open/release
• drm/xe/rtp: (De-)whitelist OA registers for all hwe's for a gt
• drm/xe/rtp: Toggle 'deny' bit to (de-)whitelist OA regs
• drm/xe/rtp: Save OA nonpriv registers to register save/restore lists
• drm/xe/rtp: Generalize whitelist_apply_to_hwe
• drm/xe/rtp: Keep track of non-OA nonpriv slots
• drm/xe/rtp: Maintain OA whitelists separately
• drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
• drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting
• HID: logitech-dj: Fix maxfield check in DJ short report validation
• spi: spi-cadence: enable SPI_CONTROLLER_MUST_TX
• drm/vmwgfx: validate external BO copy bounds for both stride paths
• drm/vmwgfx: use check_add_overflow for shader size+offset bound
• drm/vmwgfx: enforce cursor size limits for MOB cursors
• drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
• drm/vmwgfx: bound DMA command body size against suffix pointer
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
• drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
• drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
• drm/vmwgfx: clamp dirty-page range with min, not max
• drm/vmwgfx: reject DX_BIND_QUERY without a DX context
• drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
• drm/amdkfd: hold event_mutex while checkpointing CRIU events
• drm/amdkfd: Handle invalid event type in CRIU event restore
• drm/amdkfd: fix uint32_t overflow in EOP ring buffer size alignment
• drm/amdkfd: fix QID bit leak in pqm_create_queue()
• drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE
• drm/amd/display: use proper context for logging
• drm/amd/display: Increase HDMI AV mute wait from 2 to 3 frames
• drm/amd/pm: fix torn gpu metrics reads
• drm/amdgpu: cap GTT size to physical RAM on APUs
• drm/amdgpu: restore UMD profile pstate after runtime resume
• drm/amdgpu: move debug_vm handling to amdgpu_cs_parser_fini
• drm/mediatek: ovl_adaptor: balance component registrations
• drm/panthor: validate firmware interface structure sizes
• drm/panthor: reject firmware sections with oversized data
• drm/bridge: display-connector: Fix I2C adapter resource leak
• drm/vc4: Zero the tile state data array before each BIN job
• drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
• drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs
• can: ctucanfd: mark error-active controller status valid
• can: ctucanfd: handle bus error interrupts
• can: ctucanfd: unmap BAR0 using base address
• can: ctucanfd: use self-test mode for PRESUME_ACK
• can: ctucanfd: add missing MODULE_DEVICE_TABLE()
• can: peak_usb: validate uCAN receive record lengths
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error
• can: peak_usb: add bounds check for USB channel index
• can: softing: fw_parse(): validate firmware record spans
• can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents
• can: kvaser_usb: kvaser_usb_hydra_get_busparams(): fix memory leak in kvaser_usb_hydra_get_busparams()
• can: j1939: use netdevice_tracker for j1939_{priv,session,ecu} tracking
• can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer
• can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure
• can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure
• can: ems_usb: validate CPC message lengths
• can: c_can: c_can_chip_config(): keep controller in init mode until bittiming is configured
• i2c: imx: Cancel hrtimer before clearing slave pointer
• i2c: imx: Fix slave registration race and error handling
• i2c: imx: mark I2C adapter when hardware is powered down
• i2c: iproc: reset bus after timeout if START_BUSY is stuck
• i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock
• i2c: qcom-cci: drop custom suspend/resume and rely on runtime PM helpers
• i2c: spacemit: request IRQ after controller initialization
• ice: fix memory leak in ice_lbtest_prepare_rings()
• ice: fix VF interrupts cleanup
• ice: wait for reset completion in ice_resume()
• net: openvswitch: fix skb leak on flow key update failure during ct
• net: openvswitch: fix skb leak on flow key update failure during recirculation
• net: openvswitch: fix potential UAF on meter attach failure
• phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
• phy: zynqmp: use read-modify-write for SERDES scrambler bypass
• phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
• s390/zcrypt: Validate length for CCA ECC private key requests