Pull tracing fixes from Steven Rostedt:

 - Fix timerlat with use of FORTIFY_SOURCE

   FORTIFY_SOURCE was added to the stack tracer where it compares the
   entry->caller array to having entry->size elements.

   timerlat has the following:

      memcpy(&entry->caller, fstack->calls, size);
      entry->size = size;

   Which triggers FORTIFY_SOURCE as the caller is populated before the
   entry->size is initialized.

   Swap the order to satisfy FORTIFY_SOURCE logic.

 - Add down_write(trace_event_sem) when adding trace events in modules

   Trace events being added to the ftrace_events array are protected by
   the trace_event_sem semaphore. But when loading modules that have
   trace events, the addition of the events are not protected by the
   semaphore and loading two modules that have events at the same time
   can corrupt the list.

   Also add a lockdep_assert_held(trace_event_sem) to
   _trace_add_event_dirs() to confirm it is held when iterating the
   list.

* tag 'trace-v6.16-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: Add down_write(trace_event_sem) when adding trace event
  tracing/osnoise: Fix crash in timerlat_dump_stack()

Pull i2c fixes from Wolfram Sang:
 "omap:
   - add missing error check
   - fix PM disable in probe error path

  stm32:
   - unmap DMA buffer on transfer failure
   - use correct device when mapping and unmapping during transfers"

* tag 'i2c-for-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: stm32f7: unmap DMA mapped buffer
  i2c: stm32: fix the device used for the DMA map
  i2c: omap: Fix an error handling path in omap_i2c_probe()
  i2c: omap: Handle omap_i2c_init() errors in omap_i2c_probe()

Pull x86 bug fix from Thomas Gleixner:
 "A single fix for a GCC wreckage, which emits a KCSAN instrumentation
  call in __sev_es_nmi_complete() despite the function being annotated
  with 'noinstr'.

  As all functions in that source file are noinstr, exclude the whole
  file from KCSAN in the Makefile to cure it"

* tag 'x86-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/sev: Work around broken noinstr on GCC

Pull locking fix from Thomas Gleixner:
 "A single fix for the futex selftest code to make 32-bit user space
  work correctly on 64-bit kernels.

  sys_futex_wait() expects a struct __kernel_timespec for the timeout,
  but the selftest uses struct timespec, which is the original 32-bit
  non 2038 compliant variant.

  Fix it up by converting the callsite supplied timespec to a
  __kernel_timespec and hand that into the syscall"

* tag 'locking-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  selftests/futex: Convert 32-bit timespec to 64-bit version for 32-bit compatibility mode

Pull scheduler fix from Thomas Gleixner:
 "A single fix for the scheduler.

  A recent commit changed the runqueue counter nr_uninterruptible to an
  unsigned int. Due to the fact that the counters are not updated on
  migration of a uninterruptble task to a different CPU, these counters
  can exceed INT_MAX.

  The counter is cast to long in the load average calculation, which
  means that the cast expands into negative space resulting in bogus
  load average values.

  Convert it back to unsigned long to fix this.

* tag 'sched-urgent-2025-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched: Change nr_uninterruptible type to unsigned long

Merge tag 'hyperv-fixes-signed-20250718' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

Pull hyperv fixes from Wei Liu:

 - Select use CONFIG_SYSFB only if EFI is enabled (Michael Kelley)

 - An assorted set of fixes to remove warnings for missing export.h
   header inclusion (Naman Jain)

 - An assorted set of fixes for when Linux run as the root partition
   for Microsoft Hypervisor (Mukesh Rathor, Nuno Das Neves, Stanislav
   Kinsburskii)

 - Fix the check for HYPERVISOR_CALLBACK_VECTOR (Naman Jain)

 - Fix fcopy tool to handle irregularities with size of ring buffer
   (Naman Jain)

 - Fix incorrect file path conversion in fcopy tool (Yasumasa Suenaga)

* tag 'hyperv-fixes-signed-20250718' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  tools/hv: fcopy: Fix irregularities with size of ring buffer
  PCI: hv: Use the correct hypercall for unmasking interrupts on nested
  x86/hyperv: Expose hv_map_msi_interrupt()
  Drivers: hv: Use nested hypercall for post message and signal event
  x86/hyperv: Clean up hv_map/unmap_interrupt() return values
  x86/hyperv: Fix usage of cpu_online_mask to get valid cpu
  PCI: hv: Don't load the driver for baremetal root partition
  net: mana: Fix warnings for missing export.h header inclusion
  PCI: hv: Fix warnings for missing export.h header inclusion
  clocksource: hyper-v: Fix warnings for missing export.h header inclusion
  x86/hyperv: Fix warnings for missing export.h header inclusion
  Drivers: hv: Fix warnings for missing export.h header inclusion
  Drivers: hv: Fix the check for HYPERVISOR_CALLBACK_VECTOR
  tools/hv: fcopy: Fix incorrect file path conversion
  Drivers: hv: Select CONFIG_SYSFB only if EFI is enabled

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some USB and Thunderbolt driver fixes for reported problems
  for 6.16-rc6.  Included in here are:

   - Thunderbolt fixes for some much-reported issues

   - dwc2 driver fixes

   - dwc3 driver fixes

   - new usb-serial driver device ids

   - gadgetfs configfs fix

   - musb driver fix

   - USB hub driver fix

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'usb-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: hub: Don't try to recover devices lost during warm reset.
  usb: dwc2: gadget: Fix enter to hibernation for UTMI+ PHY
  usb: dwc3: qcom: Don't leave BCR asserted
  USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition
  USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI
  usb: gadget: configfs: Fix OOB read on empty string write
  usb: musb: fix gadget state on disconnect
  USB: serial: option: add Foxconn T99W640
  thunderbolt: Fix bit masking in tb_dp_port_set_hops()
  thunderbolt: Fix wake on connect at runtime

Pull serial driver fixes from Greg KH:
 "Here are two serial driver fixes for 6.16-rc6 that do:

   - fix for the serial core OF resource leak

   - pch_uart driver fix for a "incorrect variable" issue

  Both of these have been in linux-next for over a week with no reported
  problems"

* tag 'tty-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  pch_uart: Fix dma_sync_sg_for_device() nents value
  serial: core: fix OF node leak

Pull staging driver fixes from Greg KH:
 "Here are some small driver fixes for the vchiq_arm staging driver:

   - reverts of previous changes that turned out to caused problems.

   - change to prevent a resource leak

  All of these have been in linux-next this week with no reported
  problems"

* tag 'staging-6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: vchiq_arm: Make vchiq_shutdown never fail
  Revert "staging: vchiq_arm: Create keep-alive thread during probe"
  Revert "staging: vchiq_arm: Improve initial VCHIQ connect"

Pull char / misc / IIO fixes from Greg KH:
 "Here are some char/misc/iio and other driver fixes for 6.16-rc7.
  Included in here are:

   - IIO driver fixes for reported problems

   - Interconnect driver fixes for reported problems

   - nvmem driver fixes

   - bunch of comedi driver fixes for long-term bugs

   - Kconfig dependancy fixes for mux drivers

   - other small driver fixes for reported problems.

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'char-misc-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (35 commits)
  nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  misc: amd-sbi: Explicitly clear in/out arg "mb_in_out"
  misc: amd-sbi: Address copy_to/from_user() warning reported in smatch
  misc: amd-sbi: Address potential integer overflow issue reported in smatch
  comedi: comedi_test: Fix possible deletion of uninitialized timers
  comedi: Fix initialization of data for instructions that write to subdevice
  comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  comedi: das6402: Fix bit shift out of bounds
  comedi: aio_iiro_16: Fix bit shift out of bounds
  comedi: pcl812: Fix bit shift out of bounds
  comedi: das16m1: Fix bit shift out of bounds
  comedi: Fix some signed shift left operations
  comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  nvmem: imx-ocotp: fix MAC address byte length
  MAINTAINERS: add miscdevice Rust abstractions
  mux: mmio: Fix missing CONFIG_REGMAP_MMIO
  iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode
  iio: adc: ad7380: fix adi,gain-milli property parsing
  iio: adc: ad7949: use spi_is_bpw_supported()
  iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  ...

Pull spi fix from Mark Brown:
 "A fix adding missing validation that 8 bit I/O mode is actually
  supported for the specific device when attempting to use it.

  Anything that runs into this should already have been having problems,
  enforcing this should just make things safer and more obvious"

* tag 'spi-fix-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: Add check for 8-bit transfer with 8 IO mode support

Pull regmap fix from Mark Brown:
 "A fix for a memory leak when we get an error during regmap init for a
  bus that uses free_on_exit to clean up device specific data"

* tag 'regmap-fix-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: fix potential memory leak of regmap_bus

Pull input fix from Dmitry Torokhov:

 - just a small fixup to the xpad driver correcting the recent addition
   of the Acer NGR200 controller

* tag 'input-for-v6.16-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: xpad - set correct controller type for Acer NGR200

The controller should have been set as XTYPE_XBOX360 and not XTYPE_XBOX.
Also the entry is in the wrong place. Fix it.

Reported-by: Vicki Pfau <vi@endrift.com>
Signed-off-by: Nilton Perim Neto <niltonperimneto@gmail.com>
Link: https://lore.kernel.org/r/20250708033126.26216-2-niltonperimneto@gmail.com


Fixes: 22c69d78 ("Input: xpad - support Acer NGR 200 Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Pull EFI fix from Ard Biesheuvel:

 - Fix potential memory leak reported by kmemleak

* tag 'efi-fixes-for-v6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths

When a module is loaded, it adds trace events defined by the module. It
may also need to modify the modules trace printk formats to replace enum
names with their values.

If two modules are loaded at the same time, the adding of the event to the
ftrace_events list can corrupt the walking of the list in the code that is
modifying the printk format strings and crash the kernel.

The addition of the event should take the trace_event_sem for write while
it adds the new event.

Also add a lockdep_assert_held() on that semaphore in
__trace_add_event_dirs() as it iterates the list.

Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Link: https://lore.kernel.org/20250718223158.799bfc0c@batman.local.home


Reported-by: Fusheng Huang(黄富生) <Fusheng.Huang@luxshare-ict.com>
Closes: https://lore.kernel.org/all/20250717105007.46ccd18f@batman.local.home/


Fixes: 110bf2b7 ("tracing: add protection around module events unload")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Merge tag 'sched_ext-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:

 - Fix handling of migration disabled tasks in default idle selection

 - update_locked_rq() called __this_cpu_write() spuriously with NULL
   when @rq was not locked. As the writes were spurious, it didn't break
   anything directly. However, the function could be called in a
   preemptible leading to a context warning in __this_cpu_write(). Skip
   the spurious NULL writes.

 - Selftest fix on UP

* tag 'sched_ext-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: idle: Handle migration-disabled tasks in idle selection
  sched/ext: Prevent update_locked_rq() calls with NULL rq
  selftests/sched_ext: Fix exit selftest hang on UP

Pull cgroup fixes from Tejun Heo:
 "An earlier commit to suppress a warning introduced a race condition
  where tasks can escape cgroup1 freezer. Revert the commit and simply
  remove the warning which was spurious to begin with"

* tag 'cgroup-for-6.16-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
  sched,freezer: Remove unnecessary warning in __thaw_task

Merge tag 'hwmon-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:

 - corsair-cpro: Validate the size of the received input buffer

 - ina238: Report energy in microjoules as expected by the ABI

 - pmbus/ucd9000: Fixed GPIO functionality

* tag 'hwmon-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (pmbus/ucd9000) Fix error in ucd9000_gpio_set
  hwmon: (ina238) Report energy in microjoules
  hwmon: (corsair-cpro) Validate the size of the received input buffer

Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Fix build and modpost confusion for the upcoming Rust 1.89.0
     release

   - Clean objtool warning for the upcoming Rust 1.89.0 release by
     adding one more noreturn function

  'kernel' crate:

   - Fix build error when using generics in the 'try_{,pin_}init!'
     macros"

* tag 'rust-fixes-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: use `#[used(compiler)]` to fix build and `modpost` with Rust >= 1.89.0
  objtool/rust: add one more `noreturn` Rust function for Rust 1.89.0
  rust: init: Fix generics in *_init! macros

Pull vfs fixes from Christian Brauner:

 - Fix a memory leak in fcntl_dirnotify()

 - Raise SB_I_NOEXEC on secrement superblock instead of messing with
   flags on the mount

 - Add fsdevel and block mailing lists to uio entry. We had a few
   instances were very questionable stuff was added without either block
   or the VFS being aware of it

 - Fix netfs copy-to-cache so that it performs collection with
   ceph+fscache

 - Fix netfs race between cache write completion and ALL_QUEUED being
   set

 - Verify the inode mode when loading entries from disk in isofs

 - Avoid state_lock in iomap_set_range_uptodate()

 - Fix PIDFD_INFO_COREDUMP check in PIDFD_GET_INFO ioctl

 - Fix the incorrect return value in __cachefiles_write()

* tag 'vfs-6.16-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  MAINTAINERS: add block and fsdevel lists to iov_iter
  netfs: Fix race between cache write completion and ALL_QUEUED being set
  netfs: Fix copy-to-cache so that it performs collection with ceph+fscache
  fix a leak in fcntl_dirnotify()
  iomap: avoid unnecessary ifs_set_range_uptodate() with locks
  isofs: Verify inode mode when loading from disk
  cachefiles: Fix the incorrect return value in __cachefiles_write()
  secretmem: use SB_I_NOEXEC
  coredump: fix PIDFD_INFO_COREDUMP ioctl check

Pull smb client fixes from Steve French:

 - fix creating special files to Samba when using SMB3.1.1 POSIX
   Extensions

 - fix incorrect caching on new file creation with directory leases
   enabled

 - two use after free fixes: one in oplock_break and one in async
   decryption

* tag 'v6.16-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  Fix SMB311 posix special file creation to servers which do not advertise reparse support
  smb: invalidate and close cached directory when creating child entries
  smb: client: fix use-after-free in crypt_message when using async crypto
  smb: client: fix use-after-free in cifs_oplock_break

Pull crypto fixes from Herbert Xu:
 "This fixes buffer overflows in qat and chelsio"

* tag 'v6.16-p7' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: qat - Use crypto_shash_export_core
  crypto: chelsio - Use crypto_shash_export_core

Pull RISC-V fixes from Palmer Dabbelt:

 - Three fixes for unnecessary spew: an ACPI CPPC boot-time debug
   message, the link-time warnings for R_RISCV_NONE in binaries, and
   some compile-time warnings in __put_user_nocheck

 - A fix for a race during text patching

 - Interrupts are no longer disabled during exception handling

 - A fix for a missing sign extension in the misaligned load handler

 - A fix to avoid static ftrace being selected in Kconfig, as we have
   moved to dynamic ftrace

* tag 'riscv-for-linus-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: uaccess: Fix -Wuninitialized and -Wshadow in __put_user_nocheck
  riscv: Stop supporting static ftrace
  riscv: traps_misaligned: properly sign extend value in misaligned load handler
  riscv: Enable interrupt during exception handling
  riscv: ftrace: Properly acquire text_mutex to fix a race condition
  ACPI: RISC-V: Remove unnecessary CPPC debug message
  riscv: Stop considering R_RISCV_NONE as bad relocations

We have observed kernel panics when using timerlat with stack saving,
with the following dmesg output:

memcpy: detected buffer overflow: 88 byte write of buffer size 0
WARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0
CPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy)
Call Trace:
 <TASK>
 ? trace_buffer_lock_reserve+0x2a/0x60
 __fortify_panic+0xd/0xf
 __timerlat_dump_stack.cold+0xd/0xd
 timerlat_dump_stack.part.0+0x47/0x80
 timerlat_fd_read+0x36d/0x390
 vfs_read+0xe2/0x390
 ? syscall_exit_to_user_mode+0x1d5/0x210
 ksys_read+0x73/0xe0
 do_syscall_64+0x7b/0x160
 ? exc_page_fault+0x7e/0x1a0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

__timerlat_dump_stack() constructs the ftrace stack entry like this:

struct stack_entry *entry;
...
memcpy(&entry->caller, fstack->calls, size);
entry->size = fstack->nr_entries;

Since commit e7186af7 ("tracing: Add back FORTIFY_SOURCE logic to
kernel_stack event structure"), struct stack_entry marks its caller
field with __counted_by(size). At the time of the memcpy, entry->size
contains garbage from the ringbuffer, which under some circumstances is
zero, triggering a kernel panic by buffer overflow.

Populate the size field before the memcpy so that the out-of-bounds
check knows the correct size. This is analogous to
__ftrace_trace_stack().

Cc: stable@vger.kernel.org
Cc: John Kacur <jkacur@redhat.com>
Cc: Luis Goncalves <lgoncalv@redhat.com>
Cc: Attila Fazekas <afazekas@redhat.com>
Link: https://lore.kernel.org/20250716143601.7313-1-tglozar@redhat.com


Fixes: e7186af7 ("tracing: Add back FORTIFY_SOURCE logic to kernel_stack event structure")
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Pull kvm fixes from Paolo Bonzini:
 "ARM:

   - Fix use of u64_replace_bits() in adjusting the guest's view of
     MDCR_EL2.HPMN

  RISC-V:

   - Fix an issue related to timer cleanup when exiting to user-space

   - Fix a race-condition in updating interrupts enabled for the guest
     when IMSIC is hardware-virtualized

  x86:

   - Reject KVM_SET_TSC_KHZ for guests with a protected TSC (currently
     only TDX)

   - Ensure struct kvm_tdx_capabilities fields that are not explicitly
     set by KVM are zeroed

  Documentation:

   - Explain how KVM contributions should be made testable

   - Fix a formatting goof in the TDX documentation"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: TDX: Don't report base TDVMCALLs
  KVM: VMX: Ensure unused kvm_tdx_capabilities fields are zeroed out
  KVM: Documentation: document how KVM is tested
  KVM: Documentation: minimal updates to review-checklist.rst
  KVM: x86: Reject KVM_SET_TSC_KHZ vCPU ioctl for TSC protected guest
  RISC-V: KVM: Move HGEI[E|P] CSR access to IMSIC virtualization
  RISC-V: KVM: Disable vstimecmp before exiting to user-space
  Documentation: KVM: Fix unexpected unindent warning
  KVM: arm64: Fix enforcement of upper bound on MDCR_EL2.HPMN

Pull io_uring fixes from Jens Axboe:

 - dmabug offset fix for zcrx

 - Fix for the POLLERR connect work around handling

* tag 'io_uring-6.16-20250718' of git://git.kernel.dk/linux:
  io_uring/poll: fix POLLERR handling
  io_uring/zcrx: disallow user selected dmabuf offset and size

Pull block fixes from Jens Axboe:

 - NVMe changes via Christoph:
     - revert the cross-controller atomic write size validation
       that caused regressions (Christoph Hellwig)
     - fix endianness of command word printout in
       nvme_log_err_passthru() (John Garry)
     - fix callback lock for TLS handshake (Maurizio Lombardi)
     - fix misaccounting of nvme-mpath inflight I/O (Yu Kuai)
     - fix inconsistent RCU list manipulation in
       nvme_ns_add_to_ctrl_list() (Zheng Qixing)

 - Fix for a kobject leak in queue unregistration

 - Fix for loop async file write start/end handling

* tag 'block-6.16-20250718' of git://git.kernel.dk/linux:
  loop: use kiocb helpers to fix lockdep warning
  nvmet-tcp: fix callback lock for TLS handshake
  nvme: fix misaccounting of nvme-mpath inflight I/O
  nvme: revert the cross-controller atomic write size validation
  nvme: fix endianness of command word prints in nvme_log_err_passthru()
  nvme: fix inconsistent RCU list manipulation in nvme_ns_add_to_ctrl_list()
  block: fix kobject leak in blk_unregister_queue

Pull pmdomain / cpuidle-psci fixes from Ulf Hansson:
 "pmdomain core:

   - Respect CPU latency QoS limit in the genpd governor for CPUs

  cpuidle-psci:

   - Fix cpuhotplug support for PREEMPT_RT"

* tag 'pmdomain-v6.16-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  cpuidle: psci: Fix cpuhotplug routine with PREEMPT_RT=y
  pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov

Pull gpio fixes from Bartosz Golaszewski:

 - fix the devres release callback for devm_gpiod_put_array()

 - add an ACPI quirk for Acer Nitro V15 suspend & wakeup

* tag 'gpio-fixes-for-v6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpiolib: devres: release GPIOs in devm_gpiod_put_array()
  gpiolib: acpi: Add a quirk for Acer Nitro V15

Pull bpf fixes from Alexei Starovoitov:

 - Fix handling of BPF arena relocations (Andrii Nakryiko)

 - Fix race in bpf_arch_text_poke() on s390 (Ilya Leoshkevich)

 - Fix use of virt_to_phys() on arm64 when mmapping BTF (Lorenz Bauer)

 - Reject %p% format string in bprintf-like BPF helpers (Paul Chaignon)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  libbpf: Fix handling of BPF arena relocations
  btf: Fix virt_to_phys() on arm64 when mmapping BTF
  selftests/bpf: Stress test attaching a BPF prog to another BPF prog
  s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
  selftests/bpf: Add negative test cases for snprintf
  bpf: Reject %p% format string in bprintf-like helpers

Pull drm fixes from Dave Airlie:
 "Seems like a quiet enough week, xe/amdgpu being the usual suspects,
  then mediatek with a few fixes, and otherwise just misc other bits.

  dp:
   - aux dpcd address fix

  xe:
   - SR-IOV fixes for GT reset and TLB invalidation
   - Fix memory copy direction during migration
   - Fix alignment check on migration
   - Fix MOCS and page fault init order to correctly account
     for topology

  amdgpu:
   - Fix a DC memory leak
   - DCN 4.0.1 degamma LUT fix
   - Fix reset counter handling for soft recovery
   - GC 8 fix

  radeon:
   - Drop console locks when suspending/resuming

  nouveau:
   - ioctl validation fix

  panfrost:
   - scheduler bug fix

  mediatek:
   - Add wait_event_timeout when disabling plane
   - only announce AFBC if really supported
   - mtk_dpi: Reorder output formats on MT8195/88"

* tag 'drm-fixes-2025-07-18-1' of https://gitlab.freedesktop.org/drm/kernel:
  drm/mediatek: mtk_dpi: Reorder output formats on MT8195/88
  drm/mediatek: only announce AFBC if really supported
  drm/mediatek: Add wait_event_timeout when disabling plane
  drm/xe/pf: Resend PF provisioning after GT reset
  drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
  drm/xe/migrate: Fix alignment check
  drm/xe: Move page fault init after topology init
  drm/xe/mocs: Initialize MOCS index early
  drm/xe/migrate: fix copy direction in access_memory
  drm/xe: Dont skip TLB invalidations on VF
  drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume
  drm/amdgpu: Increase reset counter only on success
  drm/radeon: Do not hold console lock during resume
  drm/radeon: Do not hold console lock while suspending clients
  drm/amd/display: Disable CRTC degamma LUT for DCN401
  drm/amd/display: Free memory allocation
  drm/dp: Change AUX DPCD probe address from LANE0_1_STATUS to TRAINING_PATTERN_SET
  drm/panfrost: Fix scheduler workqueue bug
  drm/nouveau: check ioctl command codes better

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes again. The only change in the core is
  about the handling of ALSA compress-offload ioctl numbers for avoiding
  potential abusing the API (if any).

  Other than that, all changes are device-specific small fixes and
  quirks, which should be safe to apply"

* tag 'sound-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: amd: yc: Add DMI quirk for HP Laptop 17 cp-2033dx
  ASoC: Intel: soc-acpi: add support for HP Omen14 ARL
  ASoC: amd: yc: Add DMI entries to support HP 15-fb1xxx
  ALSA: hda/realtek: Add quirk for ASUS ROG Strix G712LWS
  ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX
  ALSA: hda/realtek: Support mute LED for Yoga with ALC287
  ASoC: Intel: fix SND_SOC_SOF dependencies
  ASoC: rt5660: Fix the dmic data source from GPIO2
  ALSA: hda/realtek - Fix mute LED for HP Victus 16-r0xxx
  ALSA: compress_offload: tighten ioctl command number checks
  ASoC: Intel: avs: Fix NULL ptr deref on rmmod
  ASoC: amd: yc: add DMI quirk for ASUS M6501RM

Pull soundwire fixes from Vinod Koul:
 "This contains a couple of amd driver fixes to handle alerts when the
  link is down and the cmd status register clears up.

  Also a revert of the qualcomm driver channel map support due to a
  regression"

* tag 'soundwire-6.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: Revert "soundwire: qcom: Add set_channel_map api support"
  soundwire: amd: fix for clearing command status register
  soundwire: amd: fix for handling slave alerts after link is down

Pull dmaengine fixes from Vinod Koul:

 - Mediatek flag reuse error fix

 - Array overbound fix for nbpfaxi

 - Frame size warning in driver probe

* tag 'dmaengine-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dma: dw-edma: Fix build warning in dw_edma_pcie_probe()
  dmaengine: nbpfaxi: Fix memory corruption in probe()
  dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status()

Pull phy fixes from Vinod Koul:
 "Core:

   - use per-PHY lockdep keys, in order to fix a phy using internal phys

 Drivers:

   - tegra:
       - fixes for unbalanced regulator
       - decouple pad calibration fix
       - disable periodic updates

   - qualcomm:
       - error code fix for driver probe"

* tag 'phy-fix-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: qcom: fix error code in snps_eusb2_hsphy_probe()
  phy: use per-PHY lockdep keys
  phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode
  phy: tegra: xusb: Disable periodic tracking on Tegra234
  phy: tegra: xusb: Decouple CYA_TRK_CODE_UPDATE_ON_IDLE from trk_hw_mode

Pull MMC fixes from Ulf Hansson:
 "MMC host:

   - bcm2835: Fix dma_unmap_sg() nents value

   - sdhci_am654: Add workaround for maximum HW timeout

   - sdhci-pci: Disable broken CQE Intel GLK-based Positivo models

  MEMSTICK:

   - Zero initialize id_reg in h_memstick_read_dev_id()"

* tag 'mmc-v6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  memstick: core: Zero initialize id_reg in h_memstick_read_dev_id()
  mmc: bcm2835: Fix dma_unmap_sg() nents value
  mmc: sdhci_am654: Workaround for Errata i2312
  mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models

Some servers (including Samba), support the SMB3.1.1 POSIX Extensions (which use reparse
points for handling special files) but do not properly advertise file system attribute
FILE_SUPPORTS_REPARSE_POINTS.  Although we don't check for this attribute flag when
querying special file information, we do check it when creating special files which
causes them to fail unnecessarily.   If we have negotiated SMB3.1.1 POSIX Extensions
with the server we can expect the server to support creating special files via
reparse points, and even if the server fails the operation due to really forbidding
creating special files, then it should be no problem and is more likely to return a
more accurate rc in any case (e.g. EACCES instead of EOPNOTSUPP).

Allow creating special files as long as the server supports either reparse points
or the SMB3.1.1 POSIX Extensions (note that if the "sfu" mount option is specified
it uses a different way of storing special files that does not rely on reparse points).

Cc: <stable@vger.kernel.org>
Fixes: 6c06be90 ("cifs: Check if server supports reparse points before using them")
Acked-by: Ralph Boehme <slow@samba.org>
Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Steve French <stfrench@microsoft.com>

Pull xfs fixes from Carlos Maiolino:
 "This contains mostly code clean up, refactoring and comments
  modification.

  The most important patch in this series is the last one that removes
  an unnecessary data structure allocation of xfs busy extents which
  might lead to a memory leak on the zoned allocator code"

* tag 'xfs-fixes-6.16-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: don't allocate the xfs_extent_busy structure for zoned RTGs
  xfs: remove the bt_bdev_file buftarg field
  xfs: rename the bt_bdev_* buftarg fields
  xfs: refactor xfs_calc_atomic_write_unit_max
  xfs: add a xfs_group_type_buftarg helper
  xfs: remove the call to sync_blockdev in xfs_configure_buftarg
  xfs: clean up the initial read logic in xfs_readsb
  xfs: replace strncpy with memcpy in xattr listing