Linux Kernel 6.18.46

The 120 most recent commits in this release — the full changelog is longer:

• Linux 6.18.46
• ALSA: hda/realtek: Enable headset mic on F+ FLAPTOP r
• firewire: ohci: initialize page array to use alloc_pages_bulk() correctly
• drm/vmwgfx: Set surface-framebuffer GEM objects
• erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
• spi: virtio: mark device ready before registering the controller
• drm/log: Fix infinite loop when scale is too large for display
• drm/client: Remove drm_client_framebuffer_delete()
• drm/client: Deprecate struct drm_client_buffer.gem
• drm/client: Inline drm_client_buffer_addfb() and _rmfb()
• drm/client: Move dumb-buffer handling to drm_client_framebuffer_create()
• drm/client: Remove pitch from struct drm_client_buffer
• drm/log: Fix out-of-bounds read on empty message length
• drm/xe/oa: Fix sync entry leak on OA config emit failure
• firewire: ohci: fix NULL pointer dereference in ar_context_release
• firewire: ohci: split page allocation from dma mapping
• net/sched: cls_bpf: reject dev-bound programs bound to a different device
• accel/amdxdna: Skip unmapped range in aie2_populate_range()
• net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
• regmap: sdw-mbq: don't call an unset readable_reg callback
• m68k: Define NR_CPUS to 1
• net/sched: cls_u32: skip hash tables in u32_bind_class()
• net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
• af_packet: Don't send zero-byte data in tpacket_snd().
• regmap: sdw-mbq: Fix swap of timeout and retry times
• ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
• net/tls: Fail tls_sw_splice_read() after a failed async decrypt
• net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
• net: tap: fix wrong transport_header when sending VLAN-tagged frame
• net: packet: fix wrong transport_header when sending VLAN-tagged frame
• net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path
• tcp: fix icsk_ack.ato bitfield overflow
• veth: fix queue index used to wake the peer txq in veth_poll
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
• eth: bnxt: keep the aRFS rmap updated when TPH is enabled
• eth: bnxt: cancel IRQ notifier before freeing affinity mask
• netfilter: ipset: let destroy callbacks adjust ext mem size
• netfilter: ipset: fix list type element drift bug
• netfilter: flowtable: publish GC-visible tuple last
• netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
• netfilter: ipset: fix refcount race between list:set GC and swap
• ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
• gpio: ml-ioh: share the register lock across channels
• perf: Reject exited events as group leaders
• riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions
• ovpn: finish crypto callback cleanup before peer release
• ovpn: fix NULL dereference when killing missing key
• crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req()
• crypto: ccm - Set rfc4309 maxauthsize from child
• arm64: tegra: Add EL2 virtual timer interrupt for Tegra194
• NTB: ntb_netdev: Preserve RX queue depth on allocation failure
• net: ntb_netdev: Introduce per-queue context
• ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup
• drm/amd/pm: fix pptable use-after-free
• drm/amd/pm: adjust the visibility of pp_table sysfs node
• mm/page_table_check: skip special zero mappings
• ring-buffer: Prevent resizing of persistent ring buffer
• ring-buffer: Store bpage pointers into subbuf_ids
• ring-buffer: Add helper functions for allocations
• sched_ext: Take cgroup_lock() first in scx_cgroup_lock()
• sched_ext: Reorganize enable/disable path for multi-scheduler support
• sched_ext: Update p->scx.disallow warning in scx_init_task()
• futex: Fix race in futex_pivot_pending() during private hash resize
• can: rcar_canfd: change the initializing flow for clocks and resets
• can: rcar_canfd: Extract rcar_canfd_global_{,de}init()
• can: rcar_canfd: Use devm_clk_get_optional() for RAM clk
• can: rcar_canfd: Invert global vs. channel teardown
• can: rcar_canfd: Invert reset assert order
• binfmt_misc: don't leak the user namespace when the mount fails
• ata: libata-scsi: terminate deferred commands on time out
• ASoC: tas2562: Validate values for volume writes
• KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs
• userfaultfd: wait on source PMD during UFFDIO_MOVE
• mm: replace pmd_to_swp_entry() with softleaf_from_pmd()
• fs/proc/task_mmu: refactor pagemap_pmd_range()
• btrfs: zoned: fix missing chunk metadata reservation
• btrfs: remove fs_info argument from btrfs_zoned_activate_one_bg()
• ksmbd: validate minimum PDU size for transform requests
• smb/server: fix minimum SMB2 PDU size
• smb/server: fix minimum SMB1 PDU size
• ksmbd: rename smb2_get_msg to smb_get_msg
• ksmbd: Fix to handle removal of rfc1002 header from smb_hdr
• smb/server: rename include guard in smb_common.h
• smb: move get_rfc1002_len() to common/smbglob.h
• net/sched: serialize qdisc_rtab_list against concurrent get/put
• libceph: fix two unsafe bare decodes in decode_lockers()
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
• libceph: Amend checking to fix make W=1 build breakage
• ceph: fix hanging __ceph_get_caps() with stale mds_wanted
• ceph: avoid fs reclaim while using current->journal_info
• xfs: check v5 superblock features early
• xfs: check xfarray iteration errors when committing unlinked inode lists
• xfs: don't ignore runtime errors in xrep_iunlink_reload_next
• xfs: don't swallow dquot recovery verification errors
• xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
• xfs: avoid UAF on sc->tempip in xrep_tempfile_create
• xfs: don't return EFSCORRUPTED when scrubbing corrupt parent pointers
• xfs: fix another iunlink infinite loop bug in online fsck
• xfs: fix allocated inodes that show up in the unlinked list
• xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
• xfs: don't zap the attr fork on repair when there are queued pptr updates
• xfs: fix ilock leak on error in xfs_dq_get_next_id
• xfs: load next_agino from the correct xfarray in xrep_iunlink_relink_prev
• xfs: nlink scrub must take IOLOCK before determining ILOCK state
• xfs: pass runtime errors from xrep_iunlink_mark_ondisk_rec up to callers
• xfs: set the prev pointer when reinserting an inode on the unlinked list
• xfs: don't double-lock when deleting a self-referential directory
• xfs: only check mergeability of bnobt records
• xfs: zero i_nlink before repair puts inode on unlinked list
• xfs: fix transaction block reservation in xrep_rtbitmap
• xfs: check cowextsize in xrep_inode_cowextsize
• xfs: clear zapped attr fork state when bmap repair finds no attr fork
• xfs: mark nonzero sb_gquotino as corrupt on metadir filesystems
• xfs: bounds-check buffer log item's dirty bitmap
• xfs: fix off-by-one in rtrefcount btree root level validation
• xfs: propagate errors from xfs_rtginode_load
• drm/amdgpu: disallow multiple FENCE chunks in one submit
• drm/amdgpu: Fix UVD decode image min size calculation
• drm/amdgpu: Fix UVD dpb min size calculation for H264