[PATCH 6.18 00/83] 6.18.23-rc1 review

[Greg Kroah-Hartman]

This is the start of the stable review cycle for the 6.18.23 release.
There are 83 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 15 Apr 2026 15:57:08 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.23-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Linux 6.18.23-rc1

Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
    net: skb: fix cross-cache free of KFENCE-allocated skb head

Pengpeng Hou <pengpeng@xxxxxxxxxxx>
    rxrpc: proc: size address buffers for %pISpc output

Wang Jie <jiewang2024@xxxxxxxxxx>
    rxrpc: only handle RESPONSE during service challenge

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix leak of rxgk context in rxgk_verify_response()

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix integer overflow in rxgk_verify_response()

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix missing error checks for rxkad encryption/decryption failure

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)

Luxiao Xu <rakukuip@xxxxxxxxx>
    rxrpc: fix reference count leak in rxrpc_server_keyring()

Keenan Dong <keenanat2000@xxxxxxxxx>
    rxrpc: fix oversized RESPONSE authenticator length check

Keenan Dong <keenanat2000@xxxxxxxxx>
    rxrpc: fix RESPONSE authenticator parser OOB read

Yuqi Xu <xuyuqiabc@xxxxxxxxx>
    rxrpc: reject undecryptable rxkad response tickets

Douya Le <ldy3087146292@xxxxxxxxx>
    rxrpc: Only put the call ref if one was acquired

Marc Dionne <marc.c.dionne@xxxxxxxxx>
    rxrpc: Fix to request an ack if window is limited

Anderson Nascimento <anderson@xxxxxxxxxxxxxxxxxx>
    rxrpc: Fix key reference count leak from call->key

Alok Tiwari <alok.a.tiwari@xxxxxxxxxx>
    rxrpc: Fix rack timer warning to report unexpected mode

Alok Tiwari <alok.a.tiwari@xxxxxxxxxx>
    rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial

Oleh Konko <security@xxxxxxxxx>
    rxrpc: Fix RxGK token loading to check bounds

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix call removal to use RCU safe deletion

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix anonymous key handling

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix key parsing memleak

David Howells <dhowells@xxxxxxxxxx>
    rxrpc: Fix key quota calculation for multitoken keys

David Carlier <devnexen@xxxxxxxxx>
    net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()

David Carlier <devnexen@xxxxxxxxx>
    net: lan966x: fix page pool leak in error paths

David Carlier <devnexen@xxxxxxxxx>
    net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()

Emil Tantilov <emil.s.tantilov@xxxxxxxxx>
    idpf: set the payload size before calling the async handler

Emil Tantilov <emil.s.tantilov@xxxxxxxxx>
    idpf: improve locking around idpf_vc_xn_push_free()

Emil Tantilov <emil.s.tantilov@xxxxxxxxx>
    idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling

Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>
    mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

Tyllis Xu <livelycarpet87@xxxxxxxxx>
    net: stmmac: fix integer underflow in chain mode

Pengpeng Hou <pengpeng@xxxxxxxxxxx>
    net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure

Johan Hovold <johan@xxxxxxxxxx>
    mmc: vub300: fix use-after-free on disconnect

Johan Hovold <johan@xxxxxxxxxx>
    mmc: vub300: fix NULL-deref on disconnect

SeongJae Park <sj@xxxxxxxxxx>
    mm/damon/stat: deallocate damon_call() failure leaking damon_ctx

SeongJae Park <sj@xxxxxxxxxx>
    mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails

Hao Li <hao.li@xxxxxxxxx>
    mm/memory_hotplug: maintain N_NORMAL_MEMORY during hotplug

Alex Dvoretsky <advoretsky@xxxxxxxxx>
    igb: remove napi_synchronize() in igb_down()

Jacky Bai <ping.bai@xxxxxxx>
    pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled

Michael Guralnik <michaelgur@xxxxxxxxxx>
    net/mlx5: Update the list of the PCI supported devices

Jouni Högander <jouni.hogander@xxxxxxxxx>
    drm/i915/psr: Do not use pipe_src as borders for SU area

Sebastian Brzezinka <sebastian.brzezinka@xxxxxxxxx>
    drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat

Haoze Xie <royenheart@xxxxxxxxx>
    batman-adv: hold claim backbone gateways by reference

David Carlier <devnexen@xxxxxxxxx>
    net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()

Muhammad Alifa Ramdhan <ramdhan@xxxxxxxxxxx>
    net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption

Borislav Petkov (AMD) <bp@xxxxxxxxx>
    EDAC/mc: Fix error path ordering in edac_mc_alloc()

Lukas Wunner <lukas@xxxxxxxxx>
    X.509: Fix out-of-bounds access when parsing extensions

Ruide Cao <caoruide123@xxxxxxxxx>
    batman-adv: reject oversized global TT response buffers

Pengpeng Hou <pengpeng@xxxxxxxxxxx>
    nfc: pn533: allocate rx skb before consuming bytes

Shawn Guo <shawnguo@xxxxxxxxxx>
    arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges

Shawn Guo <shawnguo@xxxxxxxxxx>
    arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity

Marek Vasut <marek.vasut+renesas@xxxxxxxxxxx>
    arm64: dts: renesas: sparrow-hawk: Reserve first 128 MiB of DRAM

Sebastian Krzyszkowiak <sebastian.krzyszkowiak@xxxxxxx>
    arm64: dts: imx8mq-librem5: Bump BUCK1 suspend voltage up to 0.85V

Sebastian Krzyszkowiak <sebastian.krzyszkowiak@xxxxxxx>
    Revert "arm64: dts: imx8mq-librem5: Set the DVS voltages lower"

Heiko Stuebner <heiko@xxxxxxxxx>
    Revert "arm64: dts: rockchip: Further describe the WiFi for the Pinebook Pro"

Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>
    platform/x86/intel-uncore-freq: Handle autonomous UFS status bit

Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>
    platform/x86: ISST: Reset core count to 0

Thomas Fourier <fourier.thomas@xxxxxxxxx>
    wifi: brcmsmac: Fix dma_free_coherent() size

Oleh Konko <security@xxxxxxxxx>
    tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

Qi Tang <tpluszz77@xxxxxxxxx>
    xfrm: hold dev ref until after transport_finish NF_HOOK

Yasuaki Torimaru <yasuakitorimaru@xxxxxxxxx>
    xfrm: clear trailing padding in build_polexpire()

Nathan Chancellor <nathan@xxxxxxxxxx>
    modpost: Declare extra_warn with unused attribute

Matthew Brost <matthew.brost@xxxxxxxxx>
    workqueue: Add pool_workqueue to pending_pwqs list when unplugging multiple inactive works

Michal Wilczynski <m.wilczynski@xxxxxxxxxxx>
    firmware: thead: Fix buffer overflow and use standard endian macros

Tuan Do <tuan@xxxxxxxx>
    netfilter: nft_ct: fix use-after-free in timeout object destroy

Anthony Pighin <anthony.pighin@xxxxxxxxx>
    i2c: imx: zero-initialize dma_slave_config for eDMA

Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    af_unix: Give up GC if MSG_PEEK intervened.

Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    af_unix: Simplify GC state.

Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
    af_unix: Count cyclic SCC.

robbieko <robbieko@xxxxxxxxxxxx>
    btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()

Filipe Manana <fdmanana@xxxxxxxx>
    btrfs: remove pointless out labels from extent-tree.c

Maciej W. Rozycki <macro@xxxxxxxxxxx>
    MIPS: mm: Rewrite TLB uniquification for the hidden bit feature

Maciej W. Rozycki <macro@xxxxxxxxxxx>
    MIPS: mm: Suppress TLB uniquification on EHINV hardware

Maciej W. Rozycki <macro@xxxxxxxxxxx>
    MIPS: Always record SEGBITS in cpu_data.vmbits

Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx>
    Input: uinput - take event lock when submitting FF request "event"

Mikhail Gavrilov <mikhail.v.gavrilov@xxxxxxxxx>
    Input: uinput - fix circular locking dependency with ff-core

Andrea Mayer <andrea.mayer@xxxxxxxxxxx>
    seg6: separate dst_cache for input and output paths in seg6 lwtunnel

Jiayuan Chen <jiayuan.chen@xxxxxxxxx>
    mptcp: fix slab-use-after-free in __inet_lookup_established

Matthieu Baerts (NGI0) <matttbe@xxxxxxxxxx>
    Revert "mptcp: add needs_id for netlink appending addr"

Takashi Iwai <tiwai@xxxxxxx>
    Revert "ALSA: hda/realtek: Add quirk for Gigabyte Technology to fix headphone"

Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    net: rfkill: prevent unlimited numbers of rfkill events from being created

Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    xfrm_user: fix info leak in build_report()

Johan Hovold <johan@xxxxxxxxxx>
    wifi: rt2x00usb: fix devres lifetime

Nathan Rebello <nathan.c.rebello@xxxxxxxxx>
    usb: typec: ucsi: skip connector validation before init


-------------

Diffstat:

 Makefile                                           |   4 +-
 .../arm64/boot/dts/freescale/imx8mq-librem5-r3.dts |   2 +-
 arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi  |  24 +-
 .../boot/dts/hisilicon/hi3798cv200-poplar.dts      |   2 +-
 arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi     |   1 +
 .../boot/dts/renesas/r8a779g3-sparrow-hawk.dts     |  11 +
 .../boot/dts/rockchip/rk3399-pinebook-pro.dts      |  18 --
 arch/mips/include/asm/cpu-features.h               |   1 -
 arch/mips/include/asm/cpu-info.h                   |   2 -
 arch/mips/include/asm/mipsregs.h                   |   2 +
 arch/mips/kernel/cpu-probe.c                       |  13 +-
 arch/mips/kernel/cpu-r3k-probe.c                   |   2 +
 arch/mips/mm/tlb-r4k.c                             | 285 +++++++++++++++++----
 crypto/asymmetric_keys/x509_cert_parser.c          |   8 +-
 drivers/edac/edac_mc.c                             |   6 +-
 drivers/firmware/thead,th1520-aon.c                |   7 +-
 drivers/gpu/drm/i915/display/intel_psr.c           |  30 ++-
 drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c   |  26 +-
 drivers/i2c/busses/i2c-imx.c                       |   2 +-
 drivers/input/misc/uinput.c                        |  35 ++-
 drivers/mmc/host/vub300.c                          |  19 +-
 drivers/net/ethernet/altera/altera_tse_main.c      |   1 +
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c    |  20 +-
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.h    |   5 +-
 drivers/net/ethernet/intel/igb/igb_main.c          |   3 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   1 +
 .../net/ethernet/microchip/lan966x/lan966x_fdma.c  |  28 +-
 drivers/net/ethernet/qualcomm/qca_uart.c           |   2 +-
 drivers/net/ethernet/stmicro/stmmac/chain_mode.c   |  11 +-
 .../net/wireless/broadcom/brcm80211/brcmsmac/dma.c |   2 +-
 drivers/net/wireless/ralink/rt2x00/rt2x00usb.c     |   2 +-
 drivers/nfc/pn533/uart.c                           |  11 +-
 .../x86/intel/speed_select_if/isst_tpmi_core.c     |   2 +
 .../intel/uncore-frequency/uncore-frequency-tpmi.c |   8 +-
 drivers/pmdomain/imx/imx8mp-blk-ctrl.c             |   8 +-
 drivers/usb/typec/ucsi/ucsi.c                      |   3 +-
 fs/btrfs/extent-tree.c                             |  24 +-
 include/linux/firmware/thead/thead,th1520-aon.h    |  74 ------
 include/net/netfilter/nf_conntrack_timeout.h       |   1 +
 include/trace/events/rxrpc.h                       |   4 +-
 kernel/workqueue.c                                 |  14 +-
 mm/damon/stat.c                                    |   7 +
 mm/damon/sysfs.c                                   |   3 +-
 mm/filemap.c                                       |  11 +-
 mm/memory_hotplug.c                                |  20 ++
 net/batman-adv/bridge_loop_avoidance.c             |  27 +-
 net/batman-adv/translation-table.c                 |   9 +-
 net/core/skbuff.c                                  |   5 +-
 net/ipv4/xfrm4_input.c                             |   5 +-
 net/ipv6/seg6_iptunnel.c                           |  34 ++-
 net/ipv6/xfrm6_input.c                             |   5 +-
 net/mptcp/pm_kernel.c                              |  24 +-
 net/mptcp/protocol.c                               |   2 +
 net/mptcp/protocol.h                               |   1 +
 net/mptcp/subflow.c                                |  15 +-
 net/netfilter/nft_ct.c                             |   2 +-
 net/rfkill/core.c                                  |  35 ++-
 net/rxrpc/af_rxrpc.c                               |   6 -
 net/rxrpc/ar-internal.h                            |   2 +-
 net/rxrpc/call_object.c                            |  25 +-
 net/rxrpc/conn_event.c                             |  19 +-
 net/rxrpc/input_rack.c                             |   2 +-
 net/rxrpc/io_thread.c                              |   3 +-
 net/rxrpc/key.c                                    |  40 +--
 net/rxrpc/output.c                                 |   2 +
 net/rxrpc/proc.c                                   |  37 +--
 net/rxrpc/rxgk.c                                   |  19 +-
 net/rxrpc/rxkad.c                                  |  63 +++--
 net/rxrpc/sendmsg.c                                |   2 +-
 net/rxrpc/server_key.c                             |   3 +
 net/tipc/group.c                                   |   6 +-
 net/tls/tls_sw.c                                   |  10 +
 net/unix/af_unix.c                                 |   2 +
 net/unix/af_unix.h                                 |   1 +
 net/unix/garbage.c                                 | 125 +++++----
 net/xfrm/xfrm_input.c                              |  18 +-
 net/xfrm/xfrm_user.c                               |   3 +
 scripts/mod/modpost.c                              |   2 +-
 sound/hda/codecs/realtek/alc662.c                  |   9 -
 79 files changed, 838 insertions(+), 490 deletions(-)