[PATCH 6.18 00/49] 6.18.11-rc1 review

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

This is the start of the stable review cycle for the 6.18.11 release.
There are 49 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun, 15 Feb 2026 13:46:52 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.11-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 6.18.11-rc1

Danilo Krummrich <dakr@kernel.org>
    gpio: omap: do not register driver in probe()

Ali Tariq <alitariq45892@gmail.com>
    wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add

Liu Song <liu.song13@zte.com.cn>
    PCI: endpoint: Avoid creating sub-groups asynchronously

Jeongjun Park <aha310510@gmail.com>
    drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free

Darrick J. Wong <djwong@kernel.org>
    xfs: fix UAF in xchk_btree_check_block_owner

Chao Yu <chao@kernel.org>
    erofs: fix UAF issue for file-backed mounts w/ directio option

Gui-Dong Han <hanguidong02@gmail.com>
    bus: fsl-mc: fix use-after-free in driver_override_show()

Anil Gurumurthy <agurumurthy@marvell.com>
    scsi: qla2xxx: Query FW again before proceeding with login

Anil Gurumurthy <agurumurthy@marvell.com>
    scsi: qla2xxx: Free sp in error path to fix system crash

Anil Gurumurthy <agurumurthy@marvell.com>
    scsi: qla2xxx: Delay module unload while fabric scan in progress

Shreyas Deodhar <sdeodhar@marvell.com>
    scsi: qla2xxx: Allow recovery for tape devices

Anil Gurumurthy <agurumurthy@marvell.com>
    scsi: qla2xxx: Validate sp before freeing associated memory

Bitterblue Smith <rtl8821cerfe2@gmail.com>
    wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()

Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@gmail.com>
    hfs: ensure sb->s_fs_info is always cleaned up

Edward Adam Davis <eadavis@qq.com>
    nilfs2: Fix potential block overflow that cause system hang

Bibo Mao <maobibo@loongson.cn>
    crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req

Bibo Mao <maobibo@loongson.cn>
    crypto: virtio - Add spinlock protection with virtqueue notification

Kees Cook <kees@kernel.org>
    crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly

Thorsten Blum <thorsten.blum@linux.dev>
    crypto: octeontx - Fix length check to avoid truncation in ucode_load_store

Thorsten Blum <thorsten.blum@linux.dev>
    crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode

Takashi Iwai <tiwai@suse.de>
    ALSA: hda/conexant: Add quirk for HP ZBook Studio G4

Zenm Chen <zenmchen@gmail.com>
    Bluetooth: btusb: Add USB ID 7392:e611 for Edimax EW-7611UXB

Gui-Dong Han <hanguidong02@gmail.com>
    driver core: enforce device_lock for driver_match_device()

Stefan Metzmacher <metze@samba.org>
    smb: client: let send_done handle a completion without IB_SEND_SIGNALED

Stefan Metzmacher <metze@samba.org>
    smb: client: let smbd_post_send_negotiate_req() use smbd_post_send()

Stefan Metzmacher <metze@samba.org>
    smb: client: fix last send credit problem causing disconnects

Stefan Metzmacher <metze@samba.org>
    smb: client: make use of smbdirect_socket.send_io.bcredits

Stefan Metzmacher <metze@samba.org>
    smb: client: use smbdirect_send_batch processing

Stefan Metzmacher <metze@samba.org>
    smb: client: introduce and use smbd_{alloc, free}_send_io()

Stefan Metzmacher <metze@samba.org>
    smb: client: split out smbd_ib_post_send()

Stefan Metzmacher <metze@samba.org>
    smb: client: port and use the wait_for_credits logic used by server

Stefan Metzmacher <metze@samba.org>
    smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter()

Stefan Metzmacher <metze@samba.org>
    smb: client: remove pointless sc->recv_io.credits.count rollback

Stefan Metzmacher <metze@samba.org>
    smb: client: let smbd_post_send() make use of request->wr

Stefan Metzmacher <metze@samba.org>
    smb: client: let recv_done() queue a refill when the peer is low on credits

Stefan Metzmacher <metze@samba.org>
    smb: client: make use of smbdirect_socket.recv_io.credits.available

Stefan Metzmacher <metze@samba.org>
    smb: server: let send_done handle a completion without IB_SEND_SIGNALED

Stefan Metzmacher <metze@samba.org>
    smb: server: fix last send credit problem causing disconnects

Stefan Metzmacher <metze@samba.org>
    smb: server: make use of smbdirect_socket.send_io.bcredits

Stefan Metzmacher <metze@samba.org>
    smb: server: let recv_done() queue a refill when the peer is low on credits

Stefan Metzmacher <metze@samba.org>
    smb: server: make use of smbdirect_socket.recv_io.credits.available

Stefan Metzmacher <metze@samba.org>
    smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.*

Stefan Metzmacher <metze@samba.org>
    smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available

Henrique Carvalho <henrique.carvalho@suse.com>
    smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: add chann_lock to protect ksmbd_chann_list xarray

Namjae Jeon <linkinjeon@kernel.org>
    ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths

Henrique Carvalho <henrique.carvalho@suse.com>
    smb: client: split cached_fid bitfields to avoid shared-byte RMW races

Li Chen <me@linux.beauty>
    io_uring: allow io-wq workers to exit when unused

Li Chen <me@linux.beauty>
    io_uring/io-wq: add exit-on-idle state


-------------

Diffstat:

 Makefile                                           |   4 +-
 drivers/base/base.h                                |   9 +
 drivers/base/bus.c                                 |   2 +-
 drivers/base/dd.c                                  |   2 +-
 drivers/bluetooth/btusb.c                          |   2 +
 drivers/bus/fsl-mc/fsl-mc-bus.c                    |   6 +-
 drivers/crypto/intel/iaa/iaa_crypto_main.c         |  12 +-
 drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c  |   2 +-
 drivers/crypto/omap-crypto.c                       |   2 +-
 drivers/crypto/virtio/virtio_crypto_core.c         |   5 +
 .../crypto/virtio/virtio_crypto_skcipher_algs.c    |   2 -
 drivers/gpio/gpio-omap.c                           |  22 +-
 drivers/gpu/drm/exynos/exynos_drm_vidi.c           |  38 +-
 drivers/net/wireless/realtek/rtl8xxxu/core.c       |   1 +
 drivers/net/wireless/realtek/rtw88/main.c          |   4 +-
 drivers/pci/endpoint/pci-ep-cfs.c                  |  15 +-
 drivers/scsi/qla2xxx/qla_gs.c                      |  41 +-
 drivers/scsi/qla2xxx/qla_init.c                    |  28 +-
 drivers/scsi/qla2xxx/qla_isr.c                     |  19 +-
 drivers/scsi/qla2xxx/qla_os.c                      |   3 +-
 fs/erofs/fileio.c                                  |   7 +-
 fs/hfs/mdb.c                                       |  35 +-
 fs/hfs/super.c                                     |  10 +-
 fs/nilfs2/sufile.c                                 |   4 +
 fs/smb/client/cached_dir.h                         |   8 +-
 fs/smb/client/smbdirect.c                          | 523 ++++++++++++++++-----
 fs/smb/common/smbdirect/smbdirect_socket.h         |  18 +
 fs/smb/server/mgmt/user_session.c                  |   5 +
 fs/smb/server/mgmt/user_session.h                  |   1 +
 fs/smb/server/server.c                             |   6 +-
 fs/smb/server/smb2pdu.c                            |  12 +-
 fs/smb/server/transport_rdma.c                     | 147 +++++-
 fs/smb/server/transport_tcp.c                      |   3 +-
 fs/xfs/scrub/btree.c                               |   7 +-
 io_uring/io-wq.c                                   |  27 +-
 io_uring/io-wq.h                                   |   1 +
 io_uring/tctx.c                                    |  11 +
 sound/hda/codecs/conexant.c                        |   1 +
 38 files changed, 799 insertions(+), 246 deletions(-)