Linux 6.18.49

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

I'm announcing the release of the 6.18.49 kernel.

All users of the 6.18 kernel series must upgrade.

The updated 6.18.y git tree can be found at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.18.y
and can be browsed at the normal kernel.org git web browser:
	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Documentation/filesystems/fscrypt.rst               |    4 
 Makefile                                            |    2 
 arch/powerpc/perf/hv-gpci.c                         |   24 +
 arch/riscv/kernel/compat_signal.c                   |    2 
 arch/riscv/kernel/ptrace.c                          |    4 
 arch/s390/kvm/vsie.c                                |    1 
 arch/x86/kernel/cpu/amd.c                           |    1 
 arch/x86/kvm/mmu/page_track.c                       |   32 ++
 arch/x86/kvm/svm/sev.c                              |   76 +++--
 arch/x86/kvm/svm/svm.c                              |    8 
 arch/x86/kvm/svm/svm.h                              |   13 -
 crypto/krb5/krb5_api.c                              |    8 
 drivers/accessibility/speakup/main.c                |    1 
 drivers/crypto/Kconfig                              |    1 
 drivers/crypto/atmel-tdes.c                         |    5 
 drivers/crypto/mxs-dcp.c                            |    2 
 drivers/crypto/qce/aead.c                           |   58 ----
 drivers/crypto/qce/common.c                         |   55 ----
 drivers/crypto/qce/common.h                         |   16 -
 drivers/crypto/qce/regs-v5.h                        |    4 
 drivers/crypto/qce/sha.c                            |   30 --
 drivers/crypto/qce/sha.h                            |    1 
 drivers/crypto/qce/skcipher.c                       |   97 -------
 drivers/crypto/qcom-rng.c                           |  156 +-----------
 drivers/crypto/virtio/virtio_crypto_akcipher_algs.c |    3 
 drivers/fpga/dfl-fme-perf.c                         |    2 
 drivers/gpu/drm/xe/xe_bo.h                          |   14 +
 drivers/gpu/drm/xe/xe_guc_ads.c                     |   92 ++++---
 drivers/gpu/drm/xe/xe_guc_ads_types.h               |    5 
 drivers/hid/hid-asus.c                              |   52 +---
 drivers/hid/hid-ft260.c                             |   41 ++-
 drivers/hid/hid-magicmouse.c                        |   25 +
 drivers/infiniband/sw/rxe/rxe_qp.c                  |   18 +
 drivers/net/gtp.c                                   |   21 +
 drivers/net/veth.c                                  |    3 
 drivers/net/vxlan/vxlan_core.c                      |    9 
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c     |    4 
 drivers/nvme/host/tcp.c                             |    8 
 drivers/target/target_core_fabric_configfs.c        |    8 
 drivers/usb/c67x00/c67x00-sched.c                   |    4 
 drivers/usb/core/devio.c                            |    2 
 drivers/usb/core/hub.c                              |    7 
 drivers/usb/gadget/function/f_tcm.c                 |    2 
 drivers/usb/host/xhci-dbgtty.c                      |   15 -
 drivers/usb/host/xhci-ring.c                        |   20 +
 drivers/usb/misc/usbtest.c                          |    1 
 drivers/usb/serial/option.c                         |   20 +
 drivers/usb/serial/spcp8x5.c                        |   13 -
 fs/fuse/dir.c                                       |    9 
 fs/fuse/file.c                                      |    4 
 fs/smb/server/smb2pdu.c                             |    6 
 fs/smb/server/vfs_cache.c                           |  179 ++++++++++++--
 fs/smb/server/vfs_cache.h                           |    4 
 include/kunit/run-in-irq-context.h                  |   10 
 include/linux/io_uring_types.h                      |    8 
 include/linux/skbuff.h                              |   24 +
 include/target/target_core_fabric.h                 |    2 
 io_uring/eventfd.c                                  |    8 
 io_uring/eventfd.h                                  |    2 
 io_uring/futex.c                                    |   21 +
 io_uring/io_uring.c                                 |    7 
 io_uring/poll.c                                     |   23 -
 io_uring/rsrc.c                                     |   31 --
 io_uring/waitid.c                                   |    2 
 kernel/bpf/offload.c                                |   10 
 mm/swapfile.c                                       |    7 
 net/batman-adv/tvlv.c                               |    5 
 net/bridge/br_multicast.c                           |    4 
 net/ipv4/tcp_ao.c                                   |   19 +
 net/ipv6/ah6.c                                      |   29 +-
 net/ipv6/seg6_local.c                               |    7 
 net/netfilter/nf_tables_api.c                       |   36 +-
 net/netfilter/nft_set_pipapo_avx2.c                 |   17 -
 net/tls/tls_device.c                                |    3 
 net/xfrm/espintcp.c                                 |    9 
 net/xfrm/xfrm_nat_keepalive.c                       |   53 +++-
 net/xfrm/xfrm_user.c                                |    2 
 security/selinux/include/security.h                 |    1 
 security/selinux/ss/avtab.c                         |   35 ++
 security/selinux/ss/avtab.h                         |   13 +
 security/selinux/ss/conditional.c                   |   25 -
 security/selinux/ss/constraint.h                    |    1 
 security/selinux/ss/policydb.c                      |  254 ++++++++++++++++----
 security/selinux/ss/policydb.h                      |   31 +-
 security/selinux/ss/services.c                      |    8 
 sound/soc/codecs/nau8821.c                          |   13 +
 sound/usb/card.c                                    |   14 -
 sound/usb/midi.c                                    |    2 
 88 files changed, 1154 insertions(+), 774 deletions(-)

Aboorva Devarajan (1):
      powerpc/hv-gpci: fix preempt count leak in sysfs show paths

Aleksandr Nogikh (1):
      usb: usbtest: disable dynamic ID support

Antheas Kapenekakis (1):
      HID: asus: simplify RGB init sequence

Asim Viladi Oglu Manizada (1):
      xfrm: ah6: validate routing header segments_left

Baokun Li (2):
      fuse: fix invalidate lock leak on setattr writeback failure
      fuse: fix invalidate lock leak on open O_TRUNC DAX failure

Bartosz Golaszewski (1):
      crypto: qce - Remove unsafe/deprecated algorithms

Bryam Vargas (3):
      selinux: reject a permission value exceeding the class permission count
      selinux: require a class's permission values to cover its permission count
      crypto: virtio - bound the akcipher result length

Caleb Sander Mateos (1):
      io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check

Christian Borntraeger (1):
      KVM: s390: vsie: zero stale crypto bits

Christian Göttsche (2):
      selinux: use u16 for security classes
      selinux: more strict policy parsing

Cristian Ciocaltea (2):
      ASoC: nau8821: Cancel delayed work on component remove
      ASoC: nau8821: Cancel pending work before suspend

DaeMyung Kang (1):
      ksmbd: harden file lifetime during session teardown

Devin Wittmayer (1):
      wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb

Dmitry Bogdanov (1):
      nvme-tcp: fix usage of page_frag_cache

Eric Biggers (6):
      netfilter: nft_set_pipapo_avx2: add missing vzeroupper
      mm/swap: reject swapon() on filesystem-level encrypted files
      kunit: irq: Continue increasing hrtimer interval for longer
      crypto: qcom-rng - Enable clock in hwrng case
      crypto: qcom-rng - Remove crypto_rng interface
      crypto: qcom-rng - Allow zero as a random number

Fourie Zhang (1):
      netfilter: nf_tables: don't queue packet path object notifications

Greg Kroah-Hartman (1):
      Linux 6.18.49

Griffin Kroah-Hartman (3):
      fpga: dfl: fme: add error handling
      usb: core: Add lock to usb_wakeup_notification()
      usb: core: Strengthen error handling in hub_hub_status()

Haoxiang Li (1):
      accessibility: speakup: unregister tty ldisc on later init failures

Hyunwoo Kim (1):
      net/tcp-ao: fix use-after-free of current_key on reconnect to another peer

Ibrahim Hashimov (1):
      RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

Jan Sebastian Götte (1):
      crypto: krb5 - use kfree_sensitive() for derived key buffers

Jann Horn (1):
      HID: asus: fix missing hid_is_usb() check

Jens Axboe (2):
      io_uring/futex: only mark private futex waits as inflight
      io_uring: defer eventfd signaling when queued from a wakeup handler

Jesper Dangaard Brouer (1):
      veth: fix OOB txq access in veth_poll() with asymmetric queue counts

Jia Yao (3):
      drm/xe/guc_ads: allocate UM queues in a separate BO
      drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
      drm/xe/guc_ads: use uncached mapping for UM queue BO

Jiale Yao (1):
      USB: serial: option: fix slab OOB read in interrupt URB callback

Jiayuan Chen (2):
      bpf: Fix use-after-free in offloaded map/prog info fill
      tls: device: fix out-of-bounds write in tls_append_frag()

Jinu Kim (1):
      KVM: x86/mmu: Check write tracking in all address spaces

Johan Hovold (1):
      USB: serial: spcp8x5: drop broken carrier detect support

Jose Villaseñor Montfort (1):
      HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()

Kyle Zeng (3):
      ipv6: seg6: clear IPv4 control block on IPIP decapsulation
      batman-adv: reject unrepresentable multicast TVLV offsets
      vxlan: keep the last remote linked during FDB flush

Lucas De Marchi (2):
      xhci: dbgtty: Fix unregister on tty_register_driver() failure
      xhci: dbgtty: Fix unregister on tty_alloc_driver() failure

Marouane El Moufid (1):
      ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

Md Sadre Alam (1):
      crypto: qce - fix CCM AAD buffer underallocation

Michael Neuling (1):
      riscv: Fix register corruption from uninitialized cregs on error

Michael Zaidman (1):
      HID: ft260: validate i2c input report length

Michal Pecio (1):
      usb: xhci: Handle bogus TRB pointers in Missed Service Error events

Miguel Peñaranda (1):
      usb: usbfs: fix use-after-free of usb_device in usbdev_release()

Norbert Szetei (1):
      net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

Pankaj Gupta (1):
      KVM: SEV: Drop FOLL_WRITE for encrypted region registration

Pavel Begunkov (1):
      io_uring/rsrc: improve regbuf iov validation

Peiyang He (1):
      RDMA/rxe: Fix OOB in free_rd_atomic_resources()

Pratik Vishwakarma (1):
      x86/CPU/AMD: Carve out a Zen5 models range

Qing Ming (2):
      gtp: serialize PDP context updates
      tcp: fix AO info use-after-free in tcp_ao_connect_init()

Raman Varabets (1):
      HID: ft260: fix stack-use-after-return write in I2C read race

Rastislav Szabo (1):
      net/tcp: fix TCP-AO key deletion in VRFs

Sabrina Dubroca (1):
      xfrm: espintcp: fix UAF during close

Sean Christopherson (4):
      KVM: SEV: Track the GPA of the guest-controlled VMSA used for SNP guests
      KVM: SEV: Extract loading of guest-provided VMSA to a separate helper
      KVM: SEV: Mark vCPU RUNNABLE after AP_CREATE, even if VMSA is unusable
      KVM: SEV: Wire up kvm_x86_ops.gmem_xxx() if and only if CONFIG_KVM_AMD_SEV=y

Semih Baskan (1):
      usb: xhci: Handle USB3 port events when there is one roothub

Shuangpeng Bai (2):
      usb: gadget: f_tcm: keep port count until LUN teardown completes
      USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

Stephen Smalley (1):
      selinux: switch two allocations to use kzalloc_objs()

Thorsten Blum (2):
      crypto: atmel-tdes - use scatterlist length before DMA mapping
      crypto: mxs-dcp - fix source scatterlist length access

Wentao Guan (1):
      Revert "selinux: reject a permission value exceeding the class permission count"

Will Porter (1):
      ALSA: usb-audio: Complete cleanup after system-resume errors

Zhiling Zou (1):
      xfrm: drop ESP-in-TCP packets with no ingress device

Zihan Xi (3):
      xfrm: avoid lock inversion in nat keepalive work
      xfrm: fix xfrm_state_construct() auth-trunc leak
      xfrm: bound nat keepalive state collection