merge-upstream/v6.18.35 from branch/tag: upstream/v6.18.35 into branch: cos-6.18

Conflicts:
 net/core/devmem.c

Changelog:
-------------------------------------------------------------

Abdurrahman Hussain (2):
      hwmon: (pmbus/adm1266) serialize sequencer_state debugfs read with pmbus_lock
      hwmon: (pmbus/adm1266) serialize GPIO PMBus accesses with pmbus_lock

Advait Dhamorikar (1):
      iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL

Aldo Conte (1):
      iio: light: cm3323: fix reg_conf not being initialized correctly

Alexander Stein (1):
      gpio: mxc: fix irq_high handling

Alexandra Winter (1):
      net/smc: Do not re-initialize smc hashtables

Alexandre Ghiti (1):
      mm: memcontrol: propagate NMI slab stats to memcg vmstats

Alexandru Hossu (1):
      scsi: target: iscsi: Validate CHAP_R length before base64 decode

Alexis Lothoré (eBPF Foundation) (1):
      x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines

Ali Ganiyev (1):
      ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops

Alice Ryhl (1):
      rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN

Andrei Vagin (1):
      Revert "x86/fpu: Refine and simplify the magic number check during signal return"

Antoniu Miclaus (2):
      iio: gyro: adis16260: fix division by zero in write_raw
      iio: chemical: scd30: fix division by zero in write_raw

Arnd Bergmann (1):
      iommu, debugobjects: avoid gcc-16.1 section mismatch warnings

Ashutosh Desai (1):
      nfc: hci: fix out-of-bounds read in HCP header parsing

Balasubramani Vivekanandan (1):
      drm/xe: Restore IDLEDLY regiter on engine reset

Bartosz Golaszewski (1):
      gpio: adnp: fix flow control regression caused by scoped_guard()

Ben Hutchings (1):
      parport: Fix race between port and client registration

Benoît Monin (1):
      iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

Berkant Koc (2):
      drm/hyperv: validate resolution_count and fix WIN8 fallback
      drm/hyperv: validate VMBus packet size in receive callback

Björn Töpel (1):
      net: Avoid checksumming unreadable skb tail on trim

Breno Leitao (1):
      net/iucv: fix locking in .getsockopt

Carl Lee (1):
      nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems

Chaitanya Sabnis (1):
      i2c: davinci: fix division by zero on missing clock-frequency

Chris Mason (1):
      netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Christian König (1):
      drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx

Christofer Jonason (1):
      iio: adc: xilinx-xadc: Fix sequencer mode in postdisable for dual mux

Chuck Lever (3):
      net/handshake: Use spin_lock_bh for hn_lock
      nvme-tcp: store negative errno in queue->tls_err
      net/handshake: Pass negative errno through handshake_complete()

Cássio Gabriel (4):
      ALSA: pcm: oss: Fix setup list UAF on proc write error
      ASoC: Intel: bytcht_es8316: Fix MCLK leak on init errors
      ASoC: codecs: simple-mux: Fix enum control bounds check
      ALSA: firewire-motu: Protect register DSP event queue positions

Dan Carpenter (3):
      gpio: virtuser: Fix uninitialized data bug in gpio_virtuser_direction_do_write()
      usb: dwc2: Fix use after free in debug code
      usb: typec: tipd: Fix error code in tps6598x_probe()

David Ahern (1):
      xfrm: Check for underflow in xfrm_state_mtu

David Carlier (3):
      iio: adc: npcm: fix unbalanced clk_disable_unprepare()
      iio: gyro: itg3200: fix i2c read into the wrong stack location
      net: devmem: reject dma-buf bind with non-page-aligned size or SG length

David E. Box (2):
      platform/x86/intel/vsec: Refactor base_addr handling
      platform/x86/intel/vsec: Make driver_data info const

David Francis (1):
      drm/amdkfd: Check for pdd drm file first in CRIU restore path

David Howells (2):
      rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg
      rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer

David Jeffery (1):
      scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

Davide Caratti (1):
      net/sched: cls_fw: fix NULL dereference of "old" filters before change()

Dawei Feng (1):
      octeontx2-pf: avoid double free of pool->stack on AQ init failure

Dev Jain (1):
      mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one

Dhabaleshwar Das (1):
      accel/rocket: fix UAF via dangling GEM handle in create_bo

Dipayaan Roy (2):
      net: mana: Add NULL guards in teardown path to prevent panic on attach failure
      net: mana: Skip redundant detach on already-detached port

Dmitriy Zharov (1):
      Input: xpad - add support for ASUS ROG RAIKIRI II

Dmitry Torokhov (3):
      Input: xpad - fix out-of-bounds access for Share button
      Input: elan_i2c - validate firmware size before use
      Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

Doruk Tan Ozturk (1):
      Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync

Eric Dumazet (4):
      ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
      tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
      vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
      tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

Eric Huang (2):
      drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
      drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger

Felix Gu (2):
      iio: light: veml6070: Fix resource leak in probe error path
      iio: buffer: hw-consumer: fix use-after-free in error path

Fernando Fernandez Mancera (1):
      netfilter: nf_tables: fix dst corruption in same register operation

Florian Schmaus (1):
      kunit: fix use-after-free in debugfs when using kunit.filter

Florian Westphal (2):
      netfilter: xt_cpu: prefer raw_smp_processor_id
      netfilter: ebtables: fix OOB read in compat_mtw_from_user

Geoffrey D. Bennett (1):
      ALSA: scarlett2: Fix 2i2 Gen 4 direct monitor gain on firmware 2417

Greg Kroah-Hartman (13):
      Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size
      iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
      iio: imu: adis16550: fix stack leak in trigger handler
      iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
      usb: typec: ucsi: ccg: reject firmware images without a ':' record header
      usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
      usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
      usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO
      usb: typec: altmodes/displayport: validate count before reading Status Update VDO
      usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()
      usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT
      usb: typec: ucsi: validate connector number in ucsi_connector_change()
      Linux 6.18.35

Guangshuo Li (3):
      counter: Fix refcount leak in counter_alloc() error path
      usb: gadget: net2280: Fix double free in probe error path
      usb: gadget: f_hid: fix device reference leak in hidg_alloc()

Guenter Roeck (1):
      hwmon: (pmbus) Add support for guarded PMBus lock

Hamza Mahfooz (1):
      netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

Heitor Alves de Siqueira (4):
      Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
      Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()
      usb: usbtmc: check URB actual_length for interrupt-IN notifications
      usb: usbtmc: reject interrupt endpoints with small wMaxPacketSize

Henri A (1):
      media: rc: igorplugusb: fix control request setup packet

Herbert Xu (1):
      xfrm: ipcomp: Free destination pages on acomp errors

Hongling Zeng (1):
      serial: sh-sci: fix memory region release in error path

Hongtao Lee (1):
      tools/bootconfig: Fix buf leaks in apply_xbc

Horatiu Vultur (1):
      phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X

Hyunwoo Kim (2):
      KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
      KVM: arm64: Reassign nested_mmus array behind mmu_lock

Ian Abbott (2):
      comedi: comedi_test: fix check for valid scan_begin_src in waveform_ai_cmdtest()
      comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()

Ido Schimmel (2):
      bridge: Fix sleep in atomic context in netlink path
      bridge: Fix sleep in atomic context in sysfs path

Ilya Maximets (2):
      net: netlink: fix sending unassigned nsid after assigned one
      net: netlink: don't set nsid on local notifications

Jacques Nilo (3):
      serial: core: introduce guard(uart_port_lock_check_sysrq_irqsave)
      serial: 8250: dispatch SysRq character in serial8250_handle_irq()
      serial: 8250_dw: dispatch SysRq character in dw8250_handle_irq()

Jakub Kicinski (26):
      ethtool: rss: avoid modifying the RSS context response
      ethtool: rss: add missing errno on RSS context delete
      ethtool: rss: fix falsely ignoring indir table updates
      ethtool: rss: fix indir_table and hkey leak on get_rxfh failure
      ethtool: rss: fix hkey leak when indir_size is 0
      ethtool: rss: avoid device context leak on reply-build failure
      ethtool: module: call ethnl_ops_complete() on module flash errors
      ethtool: module: avoid leaking a netdev ref on module flash errors
      ethtool: module: avoid racy updates to dev->ethtool bitfield
      ethtool: module: check fw_flash_in_progress under rtnl_lock
      ethtool: module: fix cleanup if socket used for flashing multiple devices
      ethtool: cmis: require exact CDB reply length
      ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl
      ethtool: cmis: validate start_cmd_payload_size from module
      ethtool: cmis: validate fw->size against start_cmd_payload_size
      ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES
      ethtool: tsconfig: fix reply error handling
      ethtool: linkstate: fix unbalanced ethnl_ops_complete() on PHY lookup error
      ethtool: pse-pd: fix missing ethnl_ops_complete()
      ethtool: tsconfig: fix missing ethnl_ops_complete()
      ethtool: tsinfo: fix uninitialized stats on the by-PHC path
      ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure
      ethtool: strset: fix header attribute index in ethnl_req_get_phydev()
      ethtool: eeprom: add missing ethnl_ops_begin() / _complete() during fallback
      ethtool: eeprom: add more safeties to EEPROM Netlink fallback
      tools: ynl: add scope qualifier for definitions

Jamal Hadi Salim (1):
      net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"

Jan Volckaert (1):
      USB: serial: option: add MeiG SRM813Q

Janusz Krzysztofik (1):
      drm/i915: Fix potential UAF in TTM object purge

Jason A. Donenfeld (1):
      wireguard: send: append trailer after expanding head

Jassi Brar (1):
      mailbox: Fix NULL message support in mbox_send_message()

Jeremy Erazo (1):
      usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

Jeremy Kerr (1):
      net: mctp: ensure our nlmsg responses are initialised

Jiayuan Chen (2):
      ipv6: fix possible infinite loop in rt6_fill_node()
      ipv6: fix possible infinite loop in fib6_select_path()

Jijie Shao (1):
      net: hibmcge: disable Relaxed Ordering to fix RX packet corruption

Jingguo Tan (2):
      vsock/virtio: bind uarg before filling zerocopy skb
      xfrm: esp: restore combined single-frag length gate

Johan Hovold (8):
      USB: serial: safe_serial: fix memory corruption with small endpoint
      USB: serial: omninet: fix memory corruption with small endpoint
      USB: serial: keyspan: fix missing indat transfer sanity check
      USB: serial: mxuport: fix memory corruption with small endpoint
      USB: serial: mct_u232: fix missing interrupt-in transfer sanity check
      USB: serial: cypress_m8: fix memory corruption with small endpoint
      USB: serial: digi_acceleport: fix memory corruption with small endpoints
      USB: serial: mct_u232: fix memory corruption with small endpoint

Jouni Högander (5):
      drm/i915/psr: Add defininitions for INTEL_WA_REGISTER_CAPS DPCD register
      drm/i915/psr: Read Intel DPCD workaround register
      drm/i915/psr: Apply Intel DPCD workaround when SDP on prior line used
      drm/i915/psr: Block DC states on vblank enable when Panel Replay supported
      drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable

Junrui Luo (1):
      macsec: fix replay protection at XPN lower-PN wrap

Justin Iurman (1):
      ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

Kai Aizen (1):
      usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind

Kim Seer Paller (1):
      iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings

Kuniyuki Iwashima (1):
      ip6: vti: Use ip6_tnl.net in vti6_changelink().

Lee Jones (3):
      nfc: llcp: Fix use-after-free in llcp_sock_release()
      nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
      HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

Li Ming (1):
      cxl/test: Update mock dev array before calling platform_device_add()

Linpu Yu (1):
      ipc: limit next_id allocation to the valid ID range

Liu Kai (1):
      HID: remove duplicate hid_warn_ratelimited definition

Luiz Augusto von Dentz (1):
      Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Luka Gejak (1):
      net: hsr: fix potential OOB access in supervision frame handling

Lukas Wunner (1):
      platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery

Maciej W. Rozycki (7):
      serial: zs: Fix swapped RI/DSR modem line transition counting
      serial: dz: Fix bootconsole message clobbering at chip reset
      serial: dz: Fix bootconsole handover lockup
      serial: dz: Convert to use a platform device
      serial: zs: Fix bootconsole handover lockup
      serial: zs: Switch to using channel reset
      serial: zs: Convert to use a platform device

Maoyi Xie (2):
      ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
      xfrm: route MIGRATE notifications to caller's netns

Marc Harvey (2):
      net: team: Remove unused team_mode_op, port_enabled
      net: team: Rename port_disabled team mode op to port_tx_disabled

Marco Scardovi (2):
      gpio: rockchip: convert bank->clk to devm_clk_get_enabled()
      gpio: rockchip: teardown bugs and resource leaks

Matthew Maurer (1):
      rust_binder: Avoid holding lock when dropping delivered_death

Matthieu Baerts (NGI0) (1):
      selftests: mptcp: drop nanoseconds width specifier

Michael Bommarito (14):
      smb: client: validate the whole DACL before rewriting it in cifsacl
      l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname
      xfrm: ah: use skb_to_full_sk in async output callbacks
      usbip: vudc: Fix use after free bug in vudc_remove due to race condition
      usb: gadget: f_fs: copy only received bytes on short ep0 read
      usb: gadget: f_fs: serialize DMABUF cancel against request completion
      thunderbolt: property: Reject u32 wrap in tb_property_entry_valid()
      thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
      scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
      scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32
      scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
      scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
      drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO
      thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

Michael Roth (1):
      KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

Michal Pecio (2):
      usb: core: Fix up Interrupt IN endpoints with bogus wBytesPerInterval
      usb: core: Fix SuperSpeed root hub wMaxPacketSize

Mikulas Patocka (1):
      hpfs: fix a crash if hpfs_map_dnode_bitmap fails

Mingzhe Zou (1):
      bcache: fix uninitialized closure object

Minh Nguyen (1):
      net: skbuff: fix missing zerocopy reference in pskb_carve helpers

Muhammad Bilal (3):
      Bluetooth: HIDP: fix missing length checks in hidp_input_report()
      Bluetooth: ISO: fix UAF in iso_recv_frame
      Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

Myeonghun Pak (1):
      serial: altera_jtaguart: handle uart_add_one_port() failures

Myrrh Periwinkle (2):
      usb: typec: ucsi: Check if power role change actually happened before handling
      usb: typec: ucsi: Don't update power_supply on power role change if not connected

Nathan Chancellor (1):
      Disable -Wattribute-alias for clang-23 and newer

Nicolás Bazaes (1):
      Input: synaptics - add LEN2058 to SMBus passlist for ThinkPad E490

Oliver Hartkopp (1):
      bonding: refuse to enslave CAN devices

Oliver Neukum (1):
      media: rc: ttusbir: fix inverted error logic

Paolo Abeni (4):
      mptcp: handle first subflow closing consistently
      mptcp: borrow forward memory from subflow
      mptcp: cleanup fallback dummy mapping generation
      mptcp: reset rcv wnd on disconnect

Pavel Begunkov (1):
      net: skbuff: fix pskb_carve leaking zcopy pages

Pavitra Jha (1):
      Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

Pengpeng Hou (1):
      iio: chemical: mhz19b: reject oversized serial replies

Peter Chen (2):
      usb: cdns3: plat: fix leaked usb2_phy initialization on usb3_phy acquisition failure
      usb: cdns3: plat: fix unbalanced pm_runtime_forbid() call permanently leaks the runtime PM usage counter across bind/unbind cycles

Peter Oberparleiter (1):
      s390/cio: Restore GFP_DMA for CHSC allocation

Prasanna S (1):
      serial: qcom-geni: fix UART_RX_PAR_EN bit position

Prathamesh Deshpande (1):
      net/mlx5: HWS: Reject unsupported remove-header action

Pratyush Yadav (Google) (1):
      memfd: deny writeable mappings when implying SEAL_WRITE

Qbeliw Tanaka (1):
      Input: xpad - add "Nova 2 Lite" from GameSir

Qi Tang (1):
      ipv6: validate extension header length before copying to cmsg

Qiang Ma (1):
      KVM: arm64: PMU: Preserve AArch32 counter low bits

Qing Wang (1):
      mm/slub: hold cpus_read_lock around flush_rcu_sheaves_on_cache()

Radhey Shyam Pandey (1):
      usb: dwc3: xilinx: fix error handling in zynqmp init error paths

Radu Sabau (1):
      iio: adc: ad4695: Fix call ordering in offload buffer postenable

Rafael J. Wysocki (2):
      cpufreq: intel_pstate: Add and use hybrid_get_cpu_type()
      cpufreq: intel_pstate: Use correct scaling factor on Raptor Lake-E

Rahul Chandelkar (1):
      ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Robert Marko (1):
      net: phy: micrel: fix LAN8814 QSGMII soft reset

Rodrigo Alencar (4):
      iio: dac: ad5686: fix ref bit initialization for single-channel parts
      iio: dac: ad5686: fix input raw value check
      iio: dac: ad5686: acquire lock when doing powerdown control
      iio: dac: ad5686: fix powerdown control on dual-channel devices

Salah Triki (4):
      iio: dac: max5821: fix return value check in powerdown sync
      iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
      iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
      iio: temperature: tsys01: fix broken PROM checksum validation

Sam Burkels (1):
      usb: storage: Add quirks for PNY Elite Portable SSD

Sanjay Chitroda (1):
      iio: ssp_sensors: cancel delayed work_refresh on remove

Santhosh Kumar K (1):
      spi: spi-mem: avoid mutating op template in spi_mem_supports_op()

Sean Christopherson (8):
      KVM: SVM: Flush the current TLB when transitioning from xAVIC => x2AVIC
      KVM: SEV: Ignore Port I/O requests of length '0'
      KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests
      KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0
      KVM: SEV: Compute the correct max length of the in-GHCB scratch area
      KVM: SEV: Check PSC request indices against the actual size of the buffer
      KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer
      KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc()

Sean Shen (1):
      ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

Sean Young (1):
      media: rc: fix race between unregister and urb/irq callbacks

Sebastian Reichel (1):
      usb: typec: tcpm: improve handling of DISCOVER_MODES failures

SeongJae Park (1):
      mm/damon/sysfs-schemes: delete tried region in regions_rmdirs()

Seungjin Bae (1):
      usb: gadget: dummy_hcd: Reject hub port requests for non-existent ports

Shaomin Chen (1):
      xfrm: iptfs: reset runtime state when cloning SAs

Shardul Bankar (1):
      mptcp: do not drop partial packets

Shitalkumar Gandhi (1):
      serial: fsl_lpuart: fix rx buffer and DMA map leaks in start_rx_dma

Shuai Zhang (3):
      Bluetooth: btusb: Allow firmware re-download when version matches
      Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading
      Bluetooth: hci_qca: Convert timeout from jiffies to ms

Siwei Zhang (2):
      Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
      Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

Srinivas Kandagatla (3):
      ASoC: qcom: q6asm-dai: fix error handling in prepare and set_params
      ASoC: qcom: q6asm-dai: close stream only when running
      ASoC: qcom: q6asm-dai: do not set stream state in event and trigger callbacks

Stepan Ionichev (1):
      auxdisplay: line-display: fix OOB read on zero-length message_store()

Stephen J. Fuhry (1):
      USB: quirks: add NO_LPM for Lenovo ThinkPad USB-C Dock Gen2 hub controllers

Steve French (1):
      smb: client: fix uninitialized variable in smb2_writev_callback

Svyatoslav Ryhel (1):
      iio: Fix iio_multiply_value use in iio_read_channel_processed_scale

Thomas Fourier (1):
      Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()

Timur Kristóf (1):
      drm/amd/pm/si: Disregard vblank time when no displays are connected

Tom Lendacky (1):
      x86/mm: Disable broadcast TLB flush when PCID is disabled

Tudor Ambarus (1):
      tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

Usama Arif (1):
      xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

Uwe Kleine-König (2):
      serdev: Provide a bustype shutdown function
      Bluetooth: hci_qca: Migrate to serdev specific shutdown function

Victor Nogueria (1):
      net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

Viken Dadhaniya (1):
      serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ

Wanquan Zhong (1):
      USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL

Wei-Cheng Chen (1):
      xhci: tegra: Fix ghost USB device on dual-role port unplug

Weiming Shi (3):
      tun: free page on short-frame rejection in tun_xdp_one()
      tun: free page on build_skb failure in tun_xdp_one()
      net: team: fix NULL pointer dereference in team_xmit during mode change

Wentao Guan (1):
      USB: cdc-acm: Fix bit overlap and move quirk definitions to header

Wentao Liang (1):
      usb: musb: omap2430: Fix use-after-free in omap2430_probe()

Xiaolei Wang (1):
      misc: rp1: Send IACK on IRQ activate to fix kdump/kexec

Xu Yang (1):
      usb: chipidea: core: convert ci_role_switch to local variable

Yongchao Wu (1):
      usb: cdns3: gadget: fix request skipping after clearing halt

Yuqi Xu (1):
      bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

Zeng Heng (1):
      arm64: tlb: Flush walk cache when unsharing PMD tables

Zhang Cen (2):
      USB: serial: belkin_sa: validate interrupt status length
      USB: serial: cypress_m8: validate interrupt packet headers

Zhang Heng (1):
      ALSA: hda/realtek: Fix speaker output on ASUS ROG Strix G615LP

Zhao Dongdong (1):
      Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

Zhaoyang Yu (1):
      tty: serial: pch_uart: add check for dma_alloc_coherent()

Zhengchuan Liang (2):
      ipv6: exthdrs: refresh nh after handling HAO option
      xfrm: input: hold netns during deferred transport reinjection

Zhenghang Xiao (3):
      Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success
      sctp: fix race between sctp_wait_for_connect and peeloff
      drm/gem: fix race between change_handle and handle_delete

Ziyi Guo (1):
      drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

Ziyu Zhang (1):
      vsock: keep poll shutdown state consistent

hlleng (1):
      HID: quirks: Add ALWAYS_POLL quirk for SIGMACHIP USB mouse

BUG=b/522164828
TEST=tryjob, validation and K8s e2e
RELEASE_NOTE=Updated the Linux kernel to v6.18.35.

Change-Id: I22b2ae572d18d1a8dd8e8f9c2375f712f0d35797
Signed-off-by: Kevin Berry <kpberry@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/159207
Reviewed-by: Derek Taylor <ddtaylor@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Mina Almasry <almasrymina@google.com>