[PATCH 6.18 00/60] 6.18.37-rc1 review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 6.18.37 release.
There are 60 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat, 27 Jun 2026 12:54:50 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.37-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.18.37-rc1

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: do not copy page tables unnecessarily for VM_UFFD_WP

Miklos Szeredi <mszeredi@redhat.com>
    virtiofs: fix UAF on submount umount

Ruslan Valiyev <linuxoid@gmail.com>
    media: vidtv: fix NULL pointer dereference in vidtv_mux_push_si

Gil Portnoy <dddhkts1@gmail.com>
    ksmbd: reject non-VALID session in compound request branch

Georgi Djakov <georgi.djakov@oss.qualcomm.com>
    drivers/base/memory: set mem->altmap after successful device registration

Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
    serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero

Yi Yang <yiyang13@huawei.com>
    vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    crypto: qat - remove unused character device and IOCTLs

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix bit count in bitmap_copy()

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - iterative IRQ handler

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix memory leak in rmi_set_attn_data()

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix num_subpackets overflow in register descriptor

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix type overflow in register counts

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - refactor register descriptor parsing

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: rmi4 - fix register descriptor address calculation

Sam Daly <sam@samdaly.ie>
    iio: adc: ti-ads1298: add bounds check to pga_settings index

Sam Daly <sam@samdaly.ie>
    iio: light: veml6075: add bounds check to veml6075_it_ms index

Faicker Mo <faicker.mo@gmail.com>
    net: net_failover: Fix the deadlock in slave register

Mike Marciniszyn (Meta) <mike.marciniszyn@gmail.com>
    net: export netif_open for self_test usage

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    testing/selftests/mm: add soft-dirty merge self-test

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: propagate VM_SOFTDIRTY on merge

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: set the VM_MAYBE_GUARD flag on guard region install

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: introduce copy-on-fork VMAs and make VM_MAYBE_GUARD one

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: implement sticky VMA flags

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: update vma_modify_flags() to handle residual flags, document

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: add atomic VMA flags and set VM_MAYBE_GUARD as such

Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    mm: introduce VM_MAYBE_GUARD and make visible in /proc/$pid/smaps

Xin Long <lucien.xin@gmail.com>
    sctp: disable BH before calling udp_tunnel_xmit_skb()

Tudor Ambarus <tudor.ambarus@linaro.org>
    firmware: samsung: acpm: Fix cross-thread RX length corruption

Dexuan Cui <decui@microsoft.com>
    Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs

Thorsten Blum <thorsten.blum@linux.dev>
    hv: utils: handle and propagate errors in kvp_register

André Draszik <andre.draszik@linaro.org>
    regulator: core: fix locking in regulator_resolve_supply() error path

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: don't free fd-owned sockets when reaping in the heartbeat

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: clear neighbour pointer in rose_kill_by_device()

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: cancel neighbour timers in rose_neigh_put() before freeing

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: drop CALL_REQUEST in loopback timer when device is not running

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: release netdev ref and destroy orphaned incoming sockets

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: fix netdev double-hold in rose_make_new()

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: disconnect orphaned STATE_2 sockets when device is gone

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: set SOCK_DESTROY in rose_kill_by_device() for prompt cleanup

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: fix notifier unregistered too early in rose_exit()

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: fix netdev double-hold in rose_rx_call_request()

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: guard rose_neigh_put() against NULL in timer expiry

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: clear neighbour pointer after rose_neigh_put() in state machines

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: fix race between loopback timer and module removal

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: hold loopback neighbour reference across timer callback

Bernard Pidoux <bernard.f6bvp@gmail.com>
    rose: fix dev_put() leak in rose_loopback_timer()

Yicong Yang <yang.yicong@picoheart.com>
    ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn()

Mingyu Wang <25181214217@stu.xidian.edu.cn>
    agp/amd64: Fix broken error propagation in agp_amd64_probe()

Weiming Shi <bestswngs@gmail.com>
    net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

Weiming Shi <bestswngs@gmail.com>
    i2c: stub: Reject I2C block transfers with invalid length

Lord Ulf Henrik Holmberg <henrik.holmberg@defensify.se>
    RDMA/bnxt_re: zero shared page before exposing to userspace

Waiman Long <longman@redhat.com>
    debugobjects: Dont call fill_pool() in early boot hardirq context

Helen Koike <koike@igalia.com>
    debugobjects: Do not fill_pool() if pi_blocked_on

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    debugobjects: Use LD_WAIT_CONFIG instead of LD_WAIT_SLEEP

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    debugobjects: Allow to refill the pool before SYSTEM_SCHEDULING

Yang Erkun <yangerkun@huawei.com>
    Revert "NFSD: Defer sub-object cleanup in export put callbacks"

Joanne Koong <joannelkoong@gmail.com>
    fuse: re-lock request before replacing page cache folio

Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
    net: stmmac: fix stm32 (and potentially others) resume regression

Gabriel Krisman Bertazi <krisman@suse.de>
    io_uring/net: Avoid msghdr on op_connect/op_bind async data


-------------

Diffstat:

 Documentation/filesystems/proc.rst                 |   5 +-
 Documentation/userspace-api/ioctl/ioctl-number.rst |   1 -
 Makefile                                           |   4 +-
 drivers/acpi/scan.c                                |  41 +--
 drivers/base/memory.c                              |   3 +-
 drivers/char/agp/amd64-agp.c                       |   2 +-
 drivers/crypto/intel/qat/qat_common/adf_cfg.c      |  10 -
 drivers/crypto/intel/qat/qat_common/adf_cfg.h      |   1 -
 .../crypto/intel/qat/qat_common/adf_cfg_common.h   |  32 --
 drivers/crypto/intel/qat/qat_common/adf_cfg_user.h |  38 --
 .../crypto/intel/qat/qat_common/adf_common_drv.h   |   3 -
 drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c  | 404 +--------------------
 drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c  |  70 ----
 drivers/firmware/samsung/exynos-acpm.c             |  14 +-
 drivers/hv/hv_kvp.c                                |  25 +-
 drivers/hv/vmbus_drv.c                             |  29 +-
 drivers/i2c/i2c-stub.c                             |   5 +
 drivers/iio/adc/ti-ads1298.c                       |   7 +-
 drivers/iio/light/veml6075.c                       |   8 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   2 +-
 drivers/input/rmi4/rmi_driver.c                    | 171 +++++----
 drivers/input/rmi4/rmi_driver.h                    |   4 +-
 drivers/input/rmi4/rmi_f12.c                       |   7 +
 drivers/media/test-drivers/vidtv/vidtv_mux.c       |   8 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c |   8 +-
 drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h |   1 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   3 +-
 drivers/net/net_failover.c                         |  12 +-
 drivers/regulator/core.c                           |  10 +-
 drivers/tty/serial/qcom_geni_serial.c              |   9 +-
 drivers/tty/vt/vc_screen.c                         |   2 +-
 fs/fuse/dev.c                                      |  19 +-
 fs/fuse/file.c                                     |   8 +-
 fs/nfsd/export.c                                   |  67 +---
 fs/nfsd/export.h                                   |   7 +-
 fs/nfsd/nfsctl.c                                   |   8 +-
 fs/proc/task_mmu.c                                 |   1 +
 fs/smb/server/smb2pdu.c                            |   5 +
 include/linux/mm.h                                 | 104 ++++++
 include/net/rose.h                                 |  12 +
 include/trace/events/mmflags.h                     |   1 +
 io_uring/net.c                                     |  36 +-
 io_uring/opdef.c                                   |   4 +-
 lib/debugobjects.c                                 |  58 ++-
 mm/khugepaged.c                                    |  71 ++--
 mm/madvise.c                                       |  24 +-
 mm/memory.c                                        |  16 +-
 mm/mlock.c                                         |   2 +-
 mm/mprotect.c                                      |   2 +-
 mm/mseal.c                                         |   7 +-
 mm/vma.c                                           |  81 +++--
 mm/vma.h                                           | 130 +++++--
 net/core/dev.c                                     |   1 +
 net/core/failover.c                                |   6 +-
 net/rose/af_rose.c                                 |  49 ++-
 net/rose/rose_in.c                                 |   6 +
 net/rose/rose_loopback.c                           |  61 +++-
 net/rose/rose_timer.c                              |  87 ++++-
 net/sctp/ipv6.c                                    |   2 +
 net/sctp/protocol.c                                |   2 +
 tools/testing/selftests/mm/soft-dirty.c            | 127 ++++++-
 tools/testing/vma/vma.c                            |   3 +-
 tools/testing/vma/vma_internal.h                   |  49 +++
 63 files changed, 1023 insertions(+), 972 deletions(-)