cifs_read_iter_from_socket() copies the iterator that's passed in for the
socket to modify as and if it will, and then advances the original iterator
by the amount sent.  However, both callers revert the advancement (although
receive_encrypted_read() zeros beyond the iterator first).  The problem is,
though, that cifs_readv_receive() reverts by the original length, not the
amount transmitted which can cause an oops in iov_iter_revert().

Fix this by:

 (1) Remove the iov_iter_advance() from cifs_read_iter_from_socket().

 (2) Remove the iov_iter_revert() from both callers.  This fixes the bug in
     cifs_readv_receive().

 (3) In receive_encrypted_read(), if we didn't get back as much data as the
     buffer will hold, copy the iterator, advance the copy and use the copy
     to drive iov_iter_zero().

As a bonus, this gets rid of some unnecessary work.

This was triggered by generic/074 with the "-o sign" mount option.

Fixes: 3ee1a1fc ("cifs: Cut over to using netfslib")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Steve French <sfrench@samba.org>
cc: Paulo Alcantara <pc@manguebit.com>
cc: Shyam Prasad N <nspmangalore@gmail.com>
cc: Rohith Surabattula <rohiths.msft@gmail.com>
cc: Jeff Layton <jlayton@kernel.org>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>

Commands like "chmod 0444" mark a file readonly via the attribute flag
(when mapping of mode bits into the ACL are not set, or POSIX extensions
are not negotiated), but they were not reported correctly for stat of
directories (they were reported ok for files and for "ls").  See example
below:

    root:~# ls /mnt2 -l
    total 12
    drwxr-xr-x 2 root root         0 Sep 21 18:03 normaldir
    -rwxr-xr-x 1 root root         0 Sep 21 23:24 normalfile
    dr-xr-xr-x 2 root root         0 Sep 21 17:55 readonly-dir
    -r-xr-xr-x 1 root root 209716224 Sep 21 18:15 readonly-file
    root:~# stat -c %a /mnt2/readonly-dir
    755
    root:~# stat -c %a /mnt2/readonly-file
    555

This fixes the stat of directories when ATTR_READONLY is set
(in cases where the mode can not be obtained other ways).

    root:~# stat -c %a /mnt2/readonly-dir
    555

Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>

Report correct major and minor numbers from special files created with
NFS reparse points.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

Fix major and minor numbers set on special files created with NFS
reparse points.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

Propagate error from cifs_construct_tcon() in cifs_sb_tlink() instead of
always returning -EACCES.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

For sessions and tcons created on behalf of new users accessing a
multiuser mount, matching their sessions in tcon_super_cb() with
master tcon will always lead to false as every new user will have its
own session and tcon.

All multiuser sessions, however, will inherit ->dfs_root_ses from
master tcon, so match it instead.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

Make the write RPC tracepoints use the same trace macro complexes as the
read tracepoints and display the netfs request and subrequest IDs where
available (see commit 519be989 "cifs: Add a tracepoint to track credits
involved in R/W requests").
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Steve French <stfrench@microsoft.com>
cc: Paulo Alcantara (Red Hat) <pc@manguebit.com>
cc: Jeff Layton <jlayton@kernel.org>
cc: linux-cifs@vger.kernel.org
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>

The DFS interlinks point to different DFS namespaces so make sure to
use the correct DFS root server to chase any DFS links under it by
storing the SMB session in dfs_ref_walk structure and then using it on
every referral walk.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

Purge cached referrals that have a single target when reaching maximum
of cache size as the client won't need them to failover.  Otherwise
remove oldest cache entry.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

Do not mark tcons for reconnect when current connection matches any of
the targets returned by new referral even when there is no cached
entry.
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>

Pull smb client updates from Steve French:

 - cleanups (moving duplicated code, removing unused code etc)

 - fixes relating to "sfu" mount options (for better handling special
   file types)

 - SMB3.1.1 compression fixes/improvements

* tag 'v6.12-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6: (24 commits)
  smb: client: fix compression heuristic functions
  cifs: Update SFU comments about fifos and sockets
  cifs: Add support for creating SFU symlinks
  smb: use LIST_HEAD() to simplify code
  cifs: Recognize SFU socket type
  cifs: Show debug message when SFU Fifo type was detected
  cifs: Put explicit zero byte into SFU block/char types
  cifs: Add support for reading SFU symlink location
  cifs: Fix recognizing SFU symlinks
  smb: client: compress: fix an "illegal accesses" issue
  smb: client: compress: fix a potential issue of freeing an invalid pointer
  smb: client: compress: LZ77 code improvements cleanup
  smb: client: insert compression check/call on write requests
  smb3: mark compression as CONFIG_EXPERIMENTAL and fix missing compression operation
  cifs: Remove obsoleted declaration for cifs_dir_open
  smb: client: Use min() macro
  cifs: convert to use ERR_CAST()
  smb: add comment to STATUS_MCA_OCCURED
  smb: move SMB2 Status code to common header file
  smb: move some duplicate definitions to common/smbacl.h
  ...

Pull smb server updates from Steve French:
 "Four ksmbd server fixes, three for stable:

   - Fix an issue where the directory can't be deleted if the share is
     on a file system that does not provide dot and dotdot entries

   - Fix file creation failure if the parent name of pathname is case
     sensitive

   - Fix write failure with FILE_APPEND_DATA flags

   - Add reference count to connection struct to protect UAF of oplocks
     on multichannel"

* tag '6.12-rc-ksmbd-server-fixes-part1' of git://git.samba.org/ksmbd:
  ksmbd: handle caseless file creation
  ksmbd: make __dir_empty() compatible with POSIX
  ksmbd: add refcnt to ksmbd_conn struct
  ksmbd: allow write with FILE_APPEND_DATA

Pull jfs updates from David Kleikamp:
 "A few fixes for jfs"

* tag 'jfs-6.12' of github.com:kleikamp/linux-shaggy:
  jfs: Fix uninit-value access of new_ea in ea_buffer
  jfs: check if leafidx greater than num leaves per dmap tree
  jfs: Fix uaf in dbFreeBits
  jfs: fix out-of-bounds in dbNextAG() and diAlloc()
  jfs: UBSAN: shift-out-of-bounds in dbFindBits

Pull overlayfs updates from Amir Goldstein:

 - Increase robustness of overlayfs to crashes in the case of underlying
   filesystems that to not guarantee metadata ordering to persistent
   storage (problem was reported with ubifs).

 - Deny mount inside container with features that require root
   privileges to work properly, instead of failing operations later.

 - Some clarifications to overlayfs documentation.

* tag 'ovl-update-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
  ovl: fail if trusted xattrs are needed but caller lacks permission
  overlayfs.rst: update metacopy section in overlayfs documentation
  ovl: fsync after metadata copy-up
  ovl: don't set the superblock's errseq_t manually

Pull random number generator updates from Jason Donenfeld:
 "Originally I'd planned on sending each of the vDSO getrandom()
  architecture ports to their respective arch trees. But as we started
  to work on this, we found lots of interesting issues in the shared
  code and infrastructure, the fixes for which the various archs needed
  to base their work.

  So in the end, this turned into a nice collaborative effort fixing up
  issues and porting to 5 new architectures -- arm64, powerpc64,
  powerpc32, s390x, and loongarch64 -- with everybody pitching in and
  commenting on each other's code. It was a fun development cycle.

  This contains:

   - Numerous fixups to the vDSO selftest infrastructure, getting it
     running successfully on more platforms, and fixing bugs in it.

   - Additions to the vDSO getrandom & chacha selftests. Basically every
     time manual review unearthed a bug in a revision of an arch patch,
     or an ambiguity, the tests were augmented.

     By the time the last arch was submitted for review, s390x, v1 of
     the series was essentially fine right out of the gate.

   - Fixes to the the generic C implementation of vDSO getrandom, to
     build and run successfully on all archs, decoupling it from
     assumptions we had (unintentionally) made on x86_64 that didn't
     carry through to the other architectures.

   - Port of vDSO getrandom to LoongArch64, from Xi Ruoyao and acked by
     Huacai Chen.

   - Port of vDSO getrandom to ARM64, from Adhemerval Zanella and acked
     by Will Deacon.

   - Port of vDSO getrandom to PowerPC, in both 32-bit and 64-bit
     varieties, from Christophe Leroy and acked by Michael Ellerman.

   - Port of vDSO getrandom to S390X from Heiko Carstens, the arch
     maintainer.

  While it'd be natural for there to be things to fix up over the course
  of the development cycle, these patches got a decent amount of review
  from a fairly diverse crew of folks on the mailing lists, and, for the
  most part, they've been cooking in linux-next, which has been helpful
  for ironing out build issues.

  In terms of architectures, I think that mostly takes care of the
  important 64-bit archs with hardware still being produced and running
  production loads in settings where vDSO getrandom is likely to help.

  Arguably there's still RISC-V left, and we'll see for 6.13 whether
  they find it useful and submit a port"

* tag 'random-6.12-rc1-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: (47 commits)
  selftests: vDSO: check cpu caps before running chacha test
  s390/vdso: Wire up getrandom() vdso implementation
  s390/vdso: Move vdso symbol handling to separate header file
  s390/vdso: Allow alternatives in vdso code
  s390/module: Provide find_section() helper
  s390/facility: Let test_facility() generate static branch if possible
  s390/alternatives: Remove ALT_FACILITY_EARLY
  s390/facility: Disable compile time optimization for decompressor code
  selftests: vDSO: fix vdso_config for s390
  selftests: vDSO: fix ELF hash table entry size for s390x
  powerpc/vdso: Wire up getrandom() vDSO implementation on VDSO64
  powerpc/vdso: Wire up getrandom() vDSO implementation on VDSO32
  powerpc/vdso: Refactor CFLAGS for CVDSO build
  powerpc/vdso32: Add crtsavres
  mm: Define VM_DROPPABLE for powerpc/32
  powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
  selftests: vDSO: don't include generated headers for chacha test
  arm64: vDSO: Wire up getrandom() vDSO implementation
  arm64: alternative: make alternative_has_cap_likely() VDSO compatible
  selftests: vDSO: also test counter in vdso_test_chacha
  ...

Merge tag 'livepatching-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching

Pull livepatching update from Petr Mladek:

 - Small documentation improvement

* tag 'livepatching-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching:
  Documentation: livepatch: Correct release locks antonym

Pull perf events updates from Ingo Molnar:

 - Implement per-PMU context rescheduling to significantly improve
   single-PMU performance, and related cleanups/fixes (Peter Zijlstra
   and Namhyung Kim)

 - Fix ancient bug resulting in a lot of events being dropped
   erroneously at higher sampling frequencies (Luo Gengkun)

 - uprobes enhancements:

     - Implement RCU-protected hot path optimizations for better
       performance:

         "For baseline vs SRCU, peak througput increased from 3.7 M/s
          (million uprobe triggerings per second) up to about 8 M/s. For
          uretprobes it's a bit more modest with bump from 2.4 M/s to
          5 M/s.

          For SRCU vs RCU Tasks Trace, peak throughput for uprobes
          increases further from 8 M/s to 10.3 M/s (+28%!), and for
          uretprobes from 5.3 M/s to 5.8 M/s (+11%), as we have more
          work to do on uretprobes side.

          Even single-thread (no contention) performance is slightly
          better: 3.276 M/s to 3.396 M/s (+3.5%) for uprobes, and 2.055
          M/s to 2.174 M/s (+5.8%) for uretprobes."

          (Andrii Nakryiko et al)

     - Document mmap_lock, don't abuse get_user_pages_remote() (Oleg
       Nesterov)

     - Cleanups & fixes to prepare for future work:
        - Remove uprobe_register_refctr()
	- Simplify error handling for alloc_uprobe()
        - Make uprobe_register() return struct uprobe *
        - Fold __uprobe_unregister() into uprobe_unregister()
        - Shift put_uprobe() from delete_uprobe() to uprobe_unregister()
        - BPF: Fix use-after-free in bpf_uprobe_multi_link_attach()
          (Oleg Nesterov)

 - New feature & ABI extension: allow events to use PERF_SAMPLE READ
   with inheritance, enabling sample based profiling of a group of
   counters over a hierarchy of processes or threads (Ben Gainey)

 - Intel uncore & power events updates:

      - Add Arrow Lake and Lunar Lake support
      - Add PERF_EV_CAP_READ_SCOPE
      - Clean up and enhance cpumask and hotplug support
        (Kan Liang)

      - Add LNL uncore iMC freerunning support
      - Use D0:F0 as a default device
        (Zhenyu Wang)

 - Intel PT: fix AUX snapshot handling race (Adrian Hunter)

 - Misc fixes and cleanups (James Clark, Jiri Olsa, Oleg Nesterov and
   Peter Zijlstra)

* tag 'perf-core-2024-09-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (40 commits)
  dmaengine: idxd: Clean up cpumask and hotplug for perfmon
  iommu/vt-d: Clean up cpumask and hotplug for perfmon
  perf/x86/intel/cstate: Clean up cpumask and hotplug
  perf: Add PERF_EV_CAP_READ_SCOPE
  perf: Generic hotplug support for a PMU with a scope
  uprobes: perform lockless SRCU-protected uprobes_tree lookup
  rbtree: provide rb_find_rcu() / rb_find_add_rcu()
  perf/uprobe: split uprobe_unregister()
  uprobes: travers uprobe's consumer list locklessly under SRCU protection
  uprobes: get rid of enum uprobe_filter_ctx in uprobe filter callbacks
  uprobes: protected uprobe lifetime with SRCU
  uprobes: revamp uprobe refcounting and lifetime management
  bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()
  perf/core: Fix small negative period being ignored
  perf: Really fix event_function_call() locking
  perf: Optimize __pmu_ctx_sched_out()
  perf: Add context time freeze
  perf: Fix event_function_call() locking
  perf: Extract a few helpers
  perf: Optimize context reschedule for single PMU cases
  ...

Pull perf event fixes from Ingo Molnar:
 "Left over from the v6.11 cycle:

   - Fix energy-pkg event enumeration on certain AMD CPUs

   - Set up the LBR branch stack for BPF counting events too"

* tag 'perf-urgent-2024-09-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/intel: Allow to setup LBR for counting event for BPF
  perf/x86/rapl: Fix the energy-pkg event for AMD CPUs

Merge tag 'chrome-platform-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

Pull chrome platform updates from Tzung-Bi Shih:

 - Adjust DMI match table for Framework Laptop for improving
   maintainabilities for both legacy and new models

 - Add .remove driver callback for cros_ec_typec in order to allow the
   driver to be rebound

 - Use kmemdup_array() for taking care possible overflows

* tag 'chrome-platform-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  platform/chrome: chromeos_laptop: Use kmemdup_array
  platform/chrome: cros_ec_typec: add remove driver hook
  platform/chrome: cros_ec_lpc: switch primary DMI data for Framework Laptop

Pull fbdev updates from Helge Deller:
 - video: Reduce code when CONFIG_HAS_IOPORT=n
 - xenfb: Fix crash by assigning fb_info->device
 - pxafb: Fix possible use after free in pxafb_task()
 - efifb: Introduce and use new devm_register_framebuffer() function
 - mmpfb: Utilize devm_clk_get_enabled() helpers
 - various typo fixes and code cleanups

* tag 'fbdev-for-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: omapfb: Fix typo in comment
  fbdev: pxafb: Fix possible use after free in pxafb_task()
  fbdev: xen-fbfront: Assign fb_info->device
  fbdev: hyperv_fb: Convert comma to semicolon
  fbdev: imsttfb: convert comma to semicolon
  fbdev: pxa3xx-gcu: Convert comma to semicolon
  fbdev: efifb: Use driver-private screen_info for sysfs
  fbdev: efifb: Use devm_register_framebuffer()
  fbdev: efifb: Register sysfs groups through driver core
  fbdev: Introduce devm_register_framebuffer()
  fbdev: omapfb: Use sysfs_emit_at() to simplify code
  fbdev: omapfb: panel-sony-acx565akm: Simplify show_cabc_available_modes()
  fbdev: mmp: Use devm_clk_get_enabled() helpers
  fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
  video: Handle HAS_IOPORT dependencies

Pull iommu updates from Joerg Roedel:
 "Core changes:
   - Allow ATS on VF when parent device is identity mapped
   - Optimize unmap path on ARM io-pagetable implementation
   - Use of_property_present()

  ARM-SMMU changes:
   - SMMUv2:
       - Devicetree binding updates for Qualcomm MMU-500 implementations
       - Extend workarounds for broken Qualcomm hypervisor to avoid
         touching features that are not available (e.g. 16KiB page
         support, reserved context banks)
   - SMMUv3:
       - Support for NVIDIA's custom virtual command queue hardware
       - Fix Stage-2 stall configuration and extend tests to cover this
         area
       - A bunch of driver cleanups, including simplification of the
         master rbtree code
   - Minor cleanups and fixes across both drivers

  Intel VT-d changes:
   - Retire si_domain and convert to use static identity domain
   - Batched IOTLB/dev-IOTLB invalidation
   - Small code refactoring and cleanups

  AMD-Vi changes:
   - Cleanup and refactoring of io-pagetable code
   - Add parameter to limit the used io-pagesizes
   - Other cleanups and fixes"

* tag 'iommu-updates-v6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (77 commits)
  dt-bindings: arm-smmu: Add compatible for QCS8300 SoC
  iommu/amd: Test for PAGING domains before freeing a domain
  iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all()
  iommu/amd: Add kernel parameters to limit V1 page-sizes
  iommu/arm-smmu-v3: Reorganize struct arm_smmu_ctx_desc_cfg
  iommu/arm-smmu-v3: Add types for each level of the CD table
  iommu/arm-smmu-v3: Shrink the cdtab l1_desc array
  iommu/arm-smmu-v3: Do not use devm for the cd table allocations
  iommu/arm-smmu-v3: Remove strtab_base/cfg
  iommu/arm-smmu-v3: Reorganize struct arm_smmu_strtab_cfg
  iommu/arm-smmu-v3: Add types for each level of the 2 level stream table
  iommu/arm-smmu-v3: Add arm_smmu_strtab_l1/2_idx()
  iommu/arm-smmu-qcom: apply num_context_bank fixes for SDM630 / SDM660
  iommu/arm-smmu-v3: Use the new rb tree helpers
  dt-bindings: arm-smmu: document the support on SA8255p
  iommu/tegra241-cmdqv: Do not allocate vcmdq until dma_set_mask_and_coherent
  iommu/tegra241-cmdqv: Drop static at local variable
  iommu/tegra241-cmdqv: Fix ioremap() error handling in probe()
  iommu/amd: Do not set the D bit on AMD v2 table entries
  iommu/amd: Correct the reported page sizes from the V1 table
  ...

Pull hwmon updates from Guenter Roeck:
 "New drivers:
   - driver for Sophgo SG2042 external hardware monitor
   - thermal sensor driver for Surface Aggregator Module

  Added support to existing drivers:
   - oxp-sensors: Support for multiple new devices.
   - nct6775: Added G15CF to ASUS WMI monitoring list

  Modernizations:
   - driver cleanup and update to use with_info API: ina2xx, lm92,
     lm95234, max1619, max1668, and max6697.

  API updates:
   - removed unused devm_hwmon_device_unregister() API function

  Other notable changes
   - implement and use generic bus access delay for pmbus drivers
   - use with scoped for each OF child loop in several drivers
   - module unloading fixes for gsc-hwmon and ntc_thermistor drivers
   - converted various drivers to use multi-byte regmap operations
   - adt7475: Improved devicetree based configuration
   - ltc2947: Move to firmware agnostic API
   - ltc2978: Converted devicetree description to yaml
   - max16065: Addressed overflows when writing limit attributes

  Various other minor cleanups, fixes and improvements"

* tag 'hwmon-for-v6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (96 commits)
  hwmon: Remove devm_hwmon_device_unregister() API function
  hwmon: (sch5636) Print unknown ID in error string via %*pE
  hwmon: (sht21) Use %*ph to print small buffer
  hwmon: (pmbus/mpq7932) Constify struct regulator_desc
  hwmon: pmbus: pli12096bc: Add write delay
  hwmon: pmbus: zl6100: Use generic code
  hwmon: pmbus: ucd9000: Use generic code
  hwmon: pmbus: max15301: Use generic code
  hwmon: pmbus: Implement generic bus access delay
  hwmon: (ina2xx) Use shunt voltage to calculate current
  hwmon: (ina2xx) Add support for current limits
  hwmon: (ina2xx) Pass register to alert limit write functions
  hwmon: (ina2xx) Convert to use with_info hwmon API
  hwmon: (ina2xx) Move ina2xx_get_value()
  hwmon: (ina2xx) Set alert latch
  hwmon: (ina2xx) Consolidate chip initialization code
  hwmon: (ina2xx) Fix various overflow issues
  hwmon: (ina2xx) Re-initialize chip using regmap functions
  hwmon: (ina2xx) Use local regmap pointer if used more than once
  hwmon: (ina2xx) Mark regmap_config as const
  ...

Pull hardening updates from Kees Cook:

 - lib/string_choices:
    - Add str_up_down() helper (Michal Wajdeczko)
    - Add str_true_false()/str_false_true() helper  (Hongbo Li)
    - Introduce several opposite string choice helpers  (Hongbo Li)

 - lib/string_helpers:
    - rework overflow-dependent code (Justin Stitt)

 - fortify: refactor test_fortify Makefile to fix some build problems
   (Masahiro Yamada)

 - string: Check for "nonstring" attribute on strscpy() arguments

 - virt: vbox: Replace 1-element arrays with flexible arrays

 - media: venus: hfi_cmds: Replace 1-element arrays with flexible arrays

* tag 'hardening-v6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  lib/string_choices: Add some comments to make more clear for string choices helpers.
  lib/string_choices: Introduce several opposite string choice helpers
  lib/string_choices: Add str_true_false()/str_false_true() helper
  string: Check for "nonstring" attribute on strscpy() arguments
  media: venus: hfi_cmds: struct hfi_session_release_buffer_pkt: Add __counted_by annotation
  media: venus: hfi_cmds: struct hfi_session_release_buffer_pkt: Replace 1-element array with flexible array
  virt: vbox: struct vmmdev_hgcm_pagelist: Replace 1-element array with flexible array
  lib/string_helpers: rework overflow-dependent code
  coccinelle: Add rules to find str_down_up() replacements
  string_choices: Add wrapper for str_down_up()
  coccinelle: Add rules to find str_up_down() replacements
  lib/string_choices: Add str_up_down() helper
  fortify: use if_changed_dep to record header dependency in *.cmd files
  fortify: move test_fortify.sh to lib/test_fortify/
  fortify: refactor test_fortify Makefile to fix some build problems

Pull execve updates from Kees Cook:

 - binfmt_elf: Dump smaller VMAs first in ELF cores (Brian Mak)

 - binfmt_elf: mseal address zero (Jeff Xu)

 - binfmt_elf, coredump: Log the reason of the failed core dumps (Roman
   Kisel)

* tag 'execve-v6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  binfmt_elf: mseal address zero
  binfmt_elf: Dump smaller VMAs first in ELF cores
  binfmt_elf, coredump: Log the reason of the failed core dumps
  coredump: Standartize and fix logging

Pull pstore updates from Kees Cook:

 - ramoops: Fix .rst typo (Steven Rostedt)

 - pstore: replace spinlock_t by raw_spinlock_t (Wen Yang)

* tag 'pstore-v6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  pstore: replace spinlock_t by raw_spinlock_t
  pstore/ramoops: Fix typo as there is no "reserver"

Pull pmdomain updates from Ulf Hansson:
 "pmdomain core:
   - Add support for s2idle for CPU PM domains on PREEMPT_RT
   - Add device managed version of dev_pm_domain_attach|detach_list()
   - Improve layout of the debugfs summary table

  pmdomain providers:
   - amlogic: Remove obsolete vpu domain driver
   - bcm: raspberrypi: Add support for devices used as wakeup-sources
   - imx: Fixup clock handling for imx93 at driver remove
   - rockchip: Add gating support for RK3576
   - rockchip: Add support for RK3576 SoC
   - Some OF parsing simplifications
   - Some simplifications by using dev_err_probe() and guard()

  pmdomain consumers:
   - qcom/media/venus: Convert to the device managed APIs for PM domains

  cpuidle-psci:
   - Add support for s2idle/s2ram for the hierarchical topology on
     PREEMPT_RT
   - Some OF parsing simplifications"

* tag 'pmdomain-v6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (39 commits)
  pmdomain: core: Reduce debug summary table width
  pmdomain: core: Move mode_status_str()
  pmdomain: core: Fix "managed by" alignment in debug summary
  pmdomain: core: Harden inter-column space in debug summary
  pmdomain: rockchip: Add gating masks for rk3576
  pmdomain: rockchip: Add gating support
  pmdomain: rockchip: Simplify dropping OF node reference
  pmdomain: mediatek: make use of dev_err_cast_probe()
  pmdomain: imx93-pd: drop the context variable "init_off"
  pmdomain: imx93-pd: don't unprepare clocks on driver remove
  pmdomain: imx93-pd: replace dev_err() with dev_err_probe()
  pmdomain: qcom: rpmpd: Simplify locking with guard()
  pmdomain: qcom: rpmhpd: Simplify locking with guard()
  pmdomain: qcom: cpr: Simplify locking with guard()
  pmdomain: qcom: cpr: Simplify with dev_err_probe()
  pmdomain: imx: gpcv2: Simplify with scoped for each OF child loop
  pmdomain: imx: gpc: Simplify with scoped for each OF child loop
  pmdomain: rockchip: SimplUlf Hanssonify locking with guard()
  pmdomain: rockchip: Simplify with scoped for each OF child loop
  pmdomain: qcom-cpr: Use scope based of_node_put() to simplify code.
  ...

Merge tag 'pwrseq-updates-for-v6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull power sequencing updates from Bartosz Golaszewski:
 "There's one change adding support for a new PMU model and another
  adding documentation for the subsystem which probably should have been
  part of the initial commit but better late than never:

   - add support for the new PMU variant inside the WCN6855 chipset

   - add documentation for the subsystem"

* tag 'pwrseq-updates-for-v6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  Documentation: add a driver API doc for the power sequencing subsystem
  power: sequencing: qcom-wcn: add support for the WCN6855 PMU

Pull gpio updates from Bartosz Golaszewski:
 "Core GPIOLIB:
   - provide and add users for a macro allowing to iterate over accepted
     GPIO property names of consumer device nodes
   - remove legacy definitions that are no longer used
   - put legacy GPIO devres helpers together with the rest of the
     deprecated code
   - implement and use swnode_gpio_get_reference(): a wrapper
     simplifying the underlying calls to
     fwnode_property_get_reference_args()
   - use IS_ERR_OR_NULL() where it makes sense
   - replace of_find_property() with of_property_present()
   - simplify code with the scoped variant of OF-node children iterator

  Documentation:
   - update GPIO kerneldocs with Return sections
   - fix "Excess struct member description" warnings now being triggered
     with W=1

  New drivers:
   - add support for Analog Devices ADP5585

  Driver improvements:
   - add support for wake-on-GPIO to gpio-mpc8xxx
   - use GPIO_LOOKUP_IDX() in gpio-virtuser
   - use devm_clk_get_[optional_]enabled() where applicable in several
     drivers
   - replace OF-specific functions with provider-agnostic alternatives
     where possible
   - drop support for legacy platform data from gpio-ath79 and
     gpio-davinci
   - refactor gpio-stmpe
   - improve error reporting in gpio-pca953x
   - add support for reading the direction of pins for some models to
     gpio-vf610

  DT bindings:
   - convert the bindings for nxp,lpc3220 to YAML
   - add gpio-reserved-ranges to gpio-davinci
   - simplify the GPIO hog schema
   - fix a GPIO hog issue in bindings for fcs,fxl6408

  Other:
   - fix format specifiers in user-space tools
   - remove leftover files on make clean in tools/gpio/"

* tag 'gpio-updates-for-v6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (54 commits)
  gpio: mpc8xxx: switch to using DEFINE_RUNTIME_DEV_PM_OPS()
  gpio: xilinx: Use helper function devm_clk_get_optional_enabled()
  gpio: mb86s7x: Use helper function devm_clk_get_optional_enabled()
  gpio: lpc18xx: Use helper function devm_clk_get_enabled()
  gpio: cadence: Use helper function devm_clk_get_enabled()
  gpio: sama5d2-piobu: convert comma to semicolon
  gpio: mpc8xxx: order headers alphabetically
  gpio: davinci: use devm_clk_get_enabled()
  gpio: davinci: drop platform data support
  gpio: stmpe: Sort headers
  gpio: stmpe: Make use of device properties
  gpio: stmpe: Utilise temporary variable for struct device
  gpio: stmpe: Remove unused 'dev' member of struct stmpe_gpio
  gpio: stmpe: Fix IRQ related error messages
  gpio: pch: kerneldoc fixes for excess members
  gpio: zynq: Simplify using devm_clk_get_enabled()
  gpio: mpc8xxx: Add wake on GPIO support
  gpio: syscon: fix excess struct member build warning
  gpio: stp-xway: Simplify using devm_clk_get_enabled()
  gpiolib: legacy: Consolidate devm_gpio_*() with other legacy APIs
  ...

Pull pwm updates from Uwe Kleine-König:
 "This contains some cleanups to the core and some mostly minor updates
  to a bunch of drivers and device tree bindings. One thing worth
  pointing out is that it contains an immutable branch containing
  support for a new mfd chip (Analog Devices ADP5585) with several sub
  drivers.

  Thanks go to Andrew Kreimer, Clark Wang, Conor Dooley, David Lechner,
  Dmitry Rokosov, Frank Li, Geert Uytterhoeven, George Stark, Jiapeng
  Chong, Krzysztof Kozlowski, Laurent Pinchart, Liao Chen, Liu Ying, Rob
  Herring and Wolfram Sang for code contributions and reviews and to Lee
  Jones for preparing the above mentioned immutable branch"

* tag 'pwm/for-6.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (21 commits)
  pwm: stm32: Fix a typo
  dt-bindings: pwm: amlogic: Add new bindings for meson A1 PWM
  dt-bindings: pwm: amlogic: Add optional power-domains
  pwm: Switch back to struct platform_driver::remove()
  dt-bindings: pwm: allwinner,sun4i-a10-pwm: add top-level constraints
  pwm: axi-pwmgen: use shared macro for version reg
  pwm: atmel-hlcdc: Drop trailing comma
  pwm: atmel-hlcdc: Enable module autoloading
  pwm: omap-dmtimer: Use of_property_read_bool()
  pwm: adp5585: Set OSC_EN bit to 1 when PWM state is enabled
  pwm: lp3943: Fix an incorrect type in lp3943_pwm_parse_dt()
  pwm: Simplify pwm_capture()
  pwm: lp3943: Use of_property_count_u32_elems() to get property length
  pwm: Don't export pwm_capture()
  pwm: Make info in traces about affected pwm more useful
  dt-bindings: pwm: renesas,tpu: Add r8a779h0 support
  dt-bindings: pwm: renesas,pwm-rcar: Add r8a779h0 support
  pwm: adp5585: Add Analog Devices ADP5585 support
  gpio: adp5585: Add Analog Devices ADP5585 support
  mfd: adp5585: Add Analog Devices ADP5585 core support
  ...

Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Add documentation for the mmc-test driver
   - Register the eMMC RPMB partition with the RPMB subsystem
   - Some various cleanups

  MMC host:
   - dw_mmc-rockchip: Add support for the RK3576 variant
   - renesas_sdhi: Add support for the RZ/V2H(P) variant
   - sdhci_am654: Add a retry mechanism for tuning
   - sdhci-atmel: Convert DT bindings to json schema
   - sdhci-of-dwcmshc:
       - Add eMMC HW reset support for BlueField-3 SoC
       - Add support for the RK3576 variant
       - Add support for the Sophgo SG2042 variant
   - sdhci-of-ma35d1: Add new driver for the Nuvoton MA35D1 SDHCI

  Misc/Tee:
   - Add Replay Protected Memory Block (RPMB) subsystem
   - Let optee probe RPMB device using RPMB subsystem"

* tag 'mmc-v6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (41 commits)
  mmc: core: Use dev_err_probe for deferred regulators
  optee: Fix a NULL vs IS_ERR() check
  mmc: sdhci_am654: Add prints to tuning algorithm
  mmc: sdhci_am654: Add retry tuning
  dt-bindings: mmc: Add support for rk3576 eMMC
  Documentation: mmc: Add mmc-test doc
  rpmb: fix error path in rpmb_dev_register()
  optee: add RPMB dependency
  mmc: block: add RPMB dependency
  mmc: core Convert UNSTUFF_BITS macro to inline function
  dt-bindings: mmc: sdhci-atmel: Convert to json schema
  mmc: core: Convert simple_stroul to kstroul
  mmc: core: Calculate size from pointer
  mmc: cqhci: Make use of cqhci_halted() routine
  mmc: core: Replace the argument of mmc_sd_switch() with defines
  mmc: dw_mmc-rockchip: Add support for rk3576 SoCs
  mmc: dw_mmc-rockchip: Add internal phase support
  dt-bindings: mmc: Add support for rk3576 dw-mshc
  mmc: sdhci-of-dwcmshc: Add hw_reset() support for BlueField-3 SoC
  mmc: core: remove left-over data structure declarations
  ...

Pull MTD updates from Miquel Raynal:
 "MTD changes:

   - No particularly important patchset this cycle, but we have a few
     usual improvements: like using a better/more recent helper or
     checking a return value.

  Raw NAND changes:

   - The use of for_each_child_of_node_scoped() has been spread into the
     subsystem drivers

   - a couple of exit path have been fixed (mtk, denali)

   - TI GPMC bindings have been enhanced to comply with up-to-date
     partition descriptions

   - a load of small and misc fixes

  SPI-NAND changes:

   - The most impacting series this cycle is bringing support for
     continuous reads in the SPI-NAND subsystem.

     This is a feature already merged in the raw NAND subsystem which
     allows optimizing the internal fetch times in the chip while
     reading sequential pages within an eraseblock.

     For now only Macronix NANDs benefit from this feature. While we are
     talking about Macronix, some of their chip need an explicit action
     for selecting a different plane, and support for it has also been
     brought.

   - The bitflip threshold has also been set to the same arbitrary level
     as in the raw NAND subsystem to optimize wear leveling decisions

   - Add upport for a new Winbond chip

  SPI NOR changes:

   - Add Write Protect support for N25Q064A.

   - New flash support for Zetta ZD25Q128C and Spansion S28HS256T.

   - Fix a NULL dereference in probe path for flashes without a name.

     The probe path tries to access the name without checking its
     existence first. S28HS256T is the first flash to define its entry
     without a name, uncovering this issue"

* tag 'mtd/for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (41 commits)
  mtd: spi-nor: fix flash probing
  mtd: spi-nor: spansion: Add support for S28HS256T
  mtd: spi-nor: winbond: add Zetta ZD25Q128C support
  mtd: spi-nor: micron-st: Add n25q064a WP support
  mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`
  mtd: spinand: macronix: Flag parts needing explicit plane select
  mtd: spinand: Add support for setting plane select bits
  dt-bindings: mtd: ti, gpmc-nand: support partitions node
  mtd: rawnand: mtk: Fix init error path
  mtd: powernv: Add check devm_kasprintf() returned value
  mtd: rawnand: mtk: Factorize out the logic cleaning mtk chips
  mtd: rawnand: atmel: Add message on DMA usage
  mtd: rawnand: meson: Fix typo in function name
  mtd: spi-nand: macronix: Continuous read support
  mtd: spi-nand: macronix: Add a possible bitflip status flag
  mtd: spi-nand: macronix: Extract the bitflip retrieval logic
  mtd: spi-nand: macronix: Fix helper name
  mtd: spi-nand: Expose spinand_write_reg_op()
  mtd: spi-nand: Add continuous read support
  mtd: spi-nand: Isolate the MTD read logic in a helper
  ...

Pull power supply and reset updates from Sebastian Reichel:
 "Power-supply core:
   - introduce power_supply_show_enum_with_available() helper
   - change usb_types from an array into a bitmask
   - fix early usage of power_supply_property_is_writeable() resulting
     in sysfs files not being writable
   - fix missing temp1_max_alarm attribute in power-supply's hwmon
     devices

  Drivers:
   - max1720x: expose nvmem device
   - brcmstb: cleanup driver to use latest APIs
   - max77693: expose input and charging current limit
   - max17042_battery: fix state of charge reading for devices without
     current sensing
   - axp20x_battery: add AXP717 support
   - axp20x_battery: fix min/max voltage properties
   - axp20x_usb_power: add AXP717 support
   - axp20x_usb_power: add DT based input current limit

  Documentation updates

  Misc minor cleanups and fixes"

* tag 'for-v6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (38 commits)
  power: supply: hwmon: Fix missing temp1_max_alarm attribute
  power: supply: Drop use_cnt check from power_supply_property_is_writeable()
  power: supply: ab8500: Constify struct kobj_type
  power: supply: max1720x: fix a double free on error in probe()
  power: supply: axp20x_battery: add support for AXP717
  power: supply: axp20x_usb_power: Add support for AXP717
  dt-bindings: power: supply: axp20x: Add AXP717 compatible
  dt-bindings: power: supply: axp20x: Add AXP717 compatible
  power: supply: axp20x_usb_power: Fix spelling mistake "reqested" -> "requested"
  power: supply: Change usb_types from an array into a bitmask
  power: supply: sysfs: Move power_supply_show_enum_with_available() up
  power: supply: sysfs: Add power_supply_show_enum_with_available() helper
  power: supply: rt9467-charger: Remove "usb_type" property write support
  power: supply: ucs1002: Adjust ucs1002_set_usb_type() to accept string values
  power: supply: "usb_type" property may be written to
  power: supply: max1720x: add read support for nvmem
  mfd: axp20x: Add ADC, BAT, and USB cells for AXP717
  power: supply: core: constify psy_tzd_ops
  power: reset: brcmstb: Do not go into infinite loop if reset fails
  power: reset: brcmstb: Use devm_register_sys_off_handler()
  ...

Pull HSI update from Sebastian Reichel:

 - omap-ssi: remove unnecessary debugfs_create_dir() error check

* tag 'hsi-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi:
  HSI: omap-ssi: Remove unnecessary debugfs_create_dir() error check

Pull slab updates from Vlastimil Babka:
 "This time it's mostly refactoring and improving APIs for slab users in
  the kernel, along with some debugging improvements.

   - kmem_cache_create() refactoring (Christian Brauner)

     Over the years have been growing new parameters to
     kmem_cache_create() where most of them are needed only for a small
     number of caches - most recently the rcu_freeptr_offset parameter.

     To avoid adding new parameters to kmem_cache_create() and adjusting
     all its callers, or creating new wrappers such as
     kmem_cache_create_rcu(), we can now pass extra parameters using the
     new struct kmem_cache_args. Not explicitly initialized fields
     default to values interpreted as unused.

     kmem_cache_create() is for now a wrapper that works both with the
     new form: kmem_cache_create(name, object_size, args, flags) and the
     legacy form: kmem_cache_create(name, object_size, align, flags,
     ctor)

   - kmem_cache_destroy() waits for kfree_rcu()'s in flight (Vlastimil
     Babka, Uladislau Rezki)

     Since SLOB removal, kfree() is allowed for freeing objects
     allocated by kmem_cache_create(). By extension kfree_rcu() as
     allowed as well, which can allow converting simple call_rcu()
     callbacks that only do kmem_cache_free(), as there was never a
     kmem_cache_free_rcu() variant. However, for caches that can be
     destroyed e.g. on module removal, the cache owners knew to issue
     rcu_barrier() first to wait for the pending call_rcu()'s, and this
     is not sufficient for pending kfree_rcu()'s due to its internal
     batching optimizations. Ulad has provided a new
     kvfree_rcu_barrier() and to make the usage less error-prone,
     kmem_cache_destroy() calls it. Additionally, destroying
     SLAB_TYPESAFE_BY_RCU caches now again issues rcu_barrier()
     synchronously instead of using an async work, because the past
     motivation for async work no longer applies. Users of custom
     call_rcu() callbacks should however keep calling rcu_barrier()
     before cache destruction.

   - Debugging use-after-free in SLAB_TYPESAFE_BY_RCU caches (Jann Horn)

     Currently, KASAN cannot catch UAFs in such caches as it is legal to
     access them within a grace period, and we only track the grace
     period when trying to free the underlying slab page. The new
     CONFIG_SLUB_RCU_DEBUG option changes the freeing of individual
     object to be RCU-delayed, after which KASAN can poison them.

   - Delayed memcg charging (Shakeel Butt)

     In some cases, the memcg is uknown at allocation time, such as
     receiving network packets in softirq context. With
     kmem_cache_charge() these may be now charged later when the user
     and its memcg is known.

   - Misc fixes and improvements (Pedro Falcato, Axel Rasmussen,
     Christoph Lameter, Yan Zhen, Peng Fan, Xavier)"

* tag 'slab-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: (34 commits)
  mm, slab: restore kerneldoc for kmem_cache_create()
  io_uring: port to struct kmem_cache_args
  slab: make __kmem_cache_create() static inline
  slab: make kmem_cache_create_usercopy() static inline
  slab: remove kmem_cache_create_rcu()
  file: port to struct kmem_cache_args
  slab: create kmem_cache_create() compatibility layer
  slab: port KMEM_CACHE_USERCOPY() to struct kmem_cache_args
  slab: port KMEM_CACHE() to struct kmem_cache_args
  slab: remove rcu_freeptr_offset from struct kmem_cache
  slab: pass struct kmem_cache_args to do_kmem_cache_create()
  slab: pull kmem_cache_open() into do_kmem_cache_create()
  slab: pass struct kmem_cache_args to create_cache()
  slab: port kmem_cache_create_usercopy() to struct kmem_cache_args
  slab: port kmem_cache_create_rcu() to struct kmem_cache_args
  slab: port kmem_cache_create() to struct kmem_cache_args
  slab: add struct kmem_cache_args
  slab: s/__kmem_cache_create/do_kmem_cache_create/g
  memcg: add charging of already allocated slab objects
  mm/slab: Optimize the code logic in find_mergeable()
  ...

Pull memory model doc updates from Paul McKenney:
 "lkmm: Add documentation and mailing list

  This contains documentation updates from Andrea Parri and Akira
  Yokosawa. Also, there is now an lkmm@lists.linux.dev, and Boqun Feng's
  update adds this to the LKMM MAINTAINERS entry.

  Not included are a couple of more commits from Puranjay Mohan adding
  more atomic operations to LKMM, but these await a herdtools7 release
  that includes tool-side support for this functionality. With luck, I
  will send a separate pull request for these later in the merge window"

* tag 'lkmm.2024.09.14b' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  MAINTAINERS: Add the dedicated maillist info for LKMM
  docs/memory-barriers.txt: Remove left-over references to "CACHE COHERENCY"
  tools/memory-model: simple.txt: Fix stale reference to recipes-pairs.txt
  tools/memory-model: Add locking.txt and glossary.txt to README
  tools/memory-model: Document herd7 (abstract) representation

Pull core dump update from Paul McKenney:
 "Sleep at TASK_IDLE when waiting for application core dump

  This causes the coredump_task_exit() function to sleep at TASK_IDLE,
  thus preventing task-blocked splats in case of large core dumps to
  slow devices"

* tag 'misc.2024.09.14a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  exit: Sleep at TASK_IDLE when waiting for application core dump

Pull kcsan update from Paul McKenney:
 "Use min() to fix Coccinelle warning.

  Courtesy of Thorsten Blum"

* tag 'kcsan.2024.09.14a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  kcsan: Use min() to fix Coccinelle warning

Pull RCU updates from Neeraj Upadhyay:
 "Context tracking:
   - rename context tracking state related symbols and remove references
     to "dynticks" in various context tracking state variables and
     related helpers
   - force context_tracking_enabled_this_cpu() to be inlined to avoid
     leaving a noinstr section

  CSD lock:
   - enhance CSD-lock diagnostic reports
   - add an API to provide an indication of ongoing CSD-lock stall

  nocb:
   - update and simplify RCU nocb code to handle (de-)offloading of
     callbacks only for offline CPUs
   - fix RT throttling hrtimer being armed from offline CPU

  rcutorture:
   - remove redundant rcu_torture_ops get_gp_completed fields
   - add SRCU ->same_gp_state and ->get_comp_state functions
   - add generic test for NUM_ACTIVE_*RCU_POLL* for testing RCU and SRCU
     polled grace periods
   - add CFcommon.arch for arch-specific Kconfig options
   - print number of update types in rcu_torture_write_types()
   - add rcutree.nohz_full_patience_delay testing to the TREE07 scenario
   - add a stall_cpu_repeat module parameter to test repeated CPU stalls
   - add argument to limit number of CPUs a guest OS can use in
     torture.sh

  rcustall:
   - abbreviate RCU CPU stall warnings during CSD-lock stalls
   - Allow dump_cpu_task() to be called without disabling preemption
   - defer printing stall-warning backtrace when holding rcu_node lock

  srcu:
   - make SRCU gp seq wrap-around faster
   - add KCSAN checks for concurrent updates to ->srcu_n_exp_nodelay and
     ->reschedule_count which are used in heuristics governing
     auto-expediting of normal SRCU grace periods and
     grace-period-state-machine delays
   - mark idle SRCU-barrier callbacks to help identify stuck
     SRCU-barrier callback

  rcu tasks:
   - remove RCU Tasks Rude asynchronous APIs as they are no longer used
   - stop testing RCU Tasks Rude asynchronous APIs
   - fix access to non-existent percpu regions
   - check processor-ID assumptions during chosen CPU calculation for
     callback enqueuing
   - update description of rtp->tasks_gp_seq grace-period sequence
     number
   - add rcu_barrier_cb_is_done() to identify whether a given
     rcu_barrier callback is stuck
   - mark idle Tasks-RCU-barrier callbacks
   - add *torture_stats_print() functions to print detailed diagnostics
     for Tasks-RCU variants
   - capture start time of rcu_barrier_tasks*() operation to help
     distinguish a hung barrier operation from a long series of barrier
     operations

  refscale:
   - add a TINY scenario to support tests of Tiny RCU and Tiny
     SRCU
   - optimize process_durations() operation

  rcuscale:
   - dump stacks of stalled rcu_scale_writer() instances and
     grace-period statistics when rcu_scale_writer() stalls
   - mark idle RCU-barrier callbacks to identify stuck RCU-barrier
     callbacks
   - print detailed grace-period and barrier diagnostics on
     rcu_scale_writer() hangs for Tasks-RCU variants
   - warn if async module parameter is specified for RCU implementations
     that do not have async primitives such as RCU Tasks Rude
   - make all writer tasks report upon hang
   - tolerate repeated GFP_KERNEL failure in rcu_scale_writer()
   - use special allocator for rcu_scale_writer()
   - NULL out top-level pointers to heap memory to avoid double-free
     bugs on modprobe failures
   - maintain per-task instead of per-CPU callbacks count to avoid any
     issues with migration of either tasks or callbacks
   - constify struct ref_scale_ops

  Fixes:
   - use system_unbound_wq for kfree_rcu work to avoid disturbing
     isolated CPUs

  Misc:
   - warn on unexpected rcu_state.srs_done_tail state
   - better define "atomic" for list_replace_rcu() and
     hlist_replace_rcu() routines
   - annotate struct kvfree_rcu_bulk_data with __counted_by()"

* tag 'rcu.release.v6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (90 commits)
  rcu: Defer printing stall-warning backtrace when holding rcu_node lock
  rcu/nocb: Remove superfluous memory barrier after bypass enqueue
  rcu/nocb: Conditionally wake up rcuo if not already waiting on GP
  rcu/nocb: Fix RT throttling hrtimer armed from offline CPU
  rcu/nocb: Simplify (de-)offloading state machine
  context_tracking: Tag context_tracking_enabled_this_cpu() __always_inline
  context_tracking, rcu: Rename rcu_dyntick trace event into rcu_watching
  rcu: Update stray documentation references to rcu_dynticks_eqs_{enter, exit}()
  rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs()
  rcu: Rename rcu_implicit_dynticks_qs() into rcu_watching_snap_recheck()
  rcu: Rename dyntick_save_progress_counter() into rcu_watching_snap_save()
  rcu: Rename struct rcu_data .exp_dynticks_snap into .exp_watching_snap
  rcu: Rename struct rcu_data .dynticks_snap into .watching_snap
  rcu: Rename rcu_dynticks_zero_in_eqs() into rcu_watching_zero_in_eqs()
  rcu: Rename rcu_dynticks_in_eqs_since() into rcu_watching_snap_stopped_since()
  rcu: Rename rcu_dynticks_in_eqs() into rcu_watching_snap_in_eqs()
  rcu: Rename rcu_dynticks_eqs_online() into rcu_watching_online()
  context_tracking, rcu: Rename rcu_dynticks_curr_cpu_in_eqs() into rcu_is_watching_curr_cpu()
  context_tracking, rcu: Rename rcu_dynticks_task*() into rcu_task*()
  refscale: Constify struct ref_scale_ops
  ...

Pull workqueue updates from Tejun Heo:
 "Nothing major:

   - workqueue.panic_on_stall boot param added

   - alloc_workqueue_lockdep_map() added (used by DRM)

   - Other cleanusp and doc updates"

* tag 'wq-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  kernel/workqueue.c: fix DEFINE_PER_CPU_SHARED_ALIGNED expansion
  workqueue: Fix another htmldocs build warning
  workqueue: fix null-ptr-deref on __alloc_workqueue() error
  workqueue: Don't call va_start / va_end twice
  workqueue: Fix htmldocs build warning
  workqueue: Add interface for user-defined workqueue lockdep map
  workqueue: Change workqueue lockdep map to pointer
  workqueue: Split alloc_workqueue into internal function and lockdep init
  Documentation: kernel-parameters: add workqueue.panic_on_stall
  workqueue: add cmdline parameter workqueue.panic_on_stall

Pull cgroup updates from Tejun Heo:

 - cpuset isolation improvements

 - cpuset cgroup1 support is split into its own file behind the new
   config option CONFIG_CPUSET_V1. This makes it the second controller
   which makes cgroup1 support optional after memcg

 - Handling of unavailable v1 controller handling improved during
   cgroup1 mount operations

 - union_find applied to cpuset. It makes code simpler and more
   efficient

 - Reduce spurious events in pids.events

 - Cleanups and other misc changes

 - Contains a merge of cgroup/for-6.11-fixes to receive cpuset fixes
   that further changes build upon

* tag 'cgroup-for-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (34 commits)
  cgroup: Do not report unavailable v1 controllers in /proc/cgroups
  cgroup: Disallow mounting v1 hierarchies without controller implementation
  cgroup/cpuset: Expose cpuset filesystem with cpuset v1 only
  cgroup/cpuset: Move cpu.h include to cpuset-internal.h
  cgroup/cpuset: add sefltest for cpuset v1
  cgroup/cpuset: guard cpuset-v1 code under CONFIG_CPUSETS_V1
  cgroup/cpuset: rename functions shared between v1 and v2
  cgroup/cpuset: move v1 interfaces to cpuset-v1.c
  cgroup/cpuset: move validate_change_legacy to cpuset-v1.c
  cgroup/cpuset: move legacy hotplug update to cpuset-v1.c
  cgroup/cpuset: add callback_lock helper
  cgroup/cpuset: move memory_spread to cpuset-v1.c
  cgroup/cpuset: move relax_domain_level to cpuset-v1.c
  cgroup/cpuset: move memory_pressure to cpuset-v1.c
  cgroup/cpuset: move common code to cpuset-internal.h
  cgroup/cpuset: introduce cpuset-v1.c
  selftest/cgroup: Make test_cpuset_prs.sh deal with pre-isolated CPUs
  cgroup/cpuset: Account for boot time isolated CPUs
  cgroup/cpuset: remove use_parent_ecpus of cpuset
  cgroup/cpuset: remove fetch_xcpus
  ...