Pull vfs fixes from Christian Brauner:
 "binfmt_misc:

   - Don't let an 'F' entry pin its own instance.

     An entry registered with 'F' opens its interpreter at registration
     time and holds that file until the entry is freed, so an entry
     nobody removes by hand is only closed once the binfmt_misc
     superblock is shut down.

     If the interpreter lives on a mount that keeps that superblock
     alive the two pin each other and the file is never closed. That's
     reachable by pointing the interpreter at the instance itself or by
     using the instance as an overlayfs lower layer, and once the mount
     namespace is gone there's nothing left to unregister through
     either.

   - Restore write access when removing an entry.

     Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter
     via open_exec() which denies write access for as long as the entry
     exists, but removal only did filp_close() and never restored it.
     The inode's i_writecount stayed permanently negative and opening
     the interpreter for writing kept failing with ETXTBSY long after
     the entry was gone.

   - Use exe_file_deny_write_access() for the interpreter clone so both
     sides base their decision on the same mode.

   - Reject a flag character as the field delimiter. create_entry() pads
     the buffer with the delimiter so the field parsers terminate even
     on a truncated string, but check_special_flags() consumes flag
     characters instead of scanning for the delimiter.

     If the delimiter is itself a flag character the padding stops
     acting as a terminator and the scan keeps reading past the end of
     the allocation. Such a registration was always rejected, just only
     after the out of bounds read has already happened.

   - Don't leak the user namespace when the mount fails.

     bm_get_tree() hands its reference to get_tree_keyed() and sget_fc()
     moves it into sb->s_fs_info, but generic_shutdown_super() only
     calls ->put_super() from inside the if (sb->s_root) branch and
     bm_fill_super() can fail before either s_root or s_op is in place.

     Drop the reference in ->kill_sb() instead, which runs
     unconditionally.

  netfs:

   - Clear PG_private_2 on a copy-to-cache append failure.

   - Handle a rolling buffer allocation failure in single-object
     writeback and drop the extra folio reference
     netfs_write_folio_single() took before the append.

   - Release the previously batched readahead folios when
     rolling_buffer_load_from_ra() fails in
     netfs_prepare_read_iterator()

   - Fix the folio_queue ENOMEM in writeback by adding a mempool and
     passing gfp flags into the rolling buffer helpers.

  iomap:

   - Add a separate bio_set for iomap_split_ioend(). It can split bios
     that already come from iomap_ioend_bioset and deadlock once that
     bioset is exhausted.

  afs:

   - Set call->async for an asynchronous afs_fs_fetch_data() the way
     afs_fs_fetch_data64() already does.

   - Subtract subreq->transferred from subreq->len in
     afs_fs_fetch_data() rather than adding it.

   - Fix a UAF when sending a message"

* tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  iomap: add a separate bio_set for iomap_split_ioend
  binfmt_misc: don't leak the user namespace when the mount fails
  binfmt_misc: reject a flag character as the field delimiter
  binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
  binfmt_misc: restore write access when removing an entry
  binfmt_misc: don't let an 'F' entry pin its own instance
  netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
  netfs: release readahead folios on iterator preparation failure
  netfs: handle single writeback rolling buffer allocation failure
  netfs: clear PG_private_2 on copy-to-cache append failure
  afs: Fix UAF when sending a message
  afs: Fix afs_fs_fetch_data() to subtract transferred from len
  afs: Fix afs_fs_fetch_data() to set call->async

Pull dmaengine fixes from Vinod Koul:

 - switchtec fix for register programming

 - sun6i descriptor reclaim fix

 - Intel idxd fixes for double free in error and setup failure

 - Qualcomm bam dma command element fix

* tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
  dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
  dmaengine: idxd: fix double free of wq, engine, and group structs
  dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
  dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold

Pull ata fixes from Damien Le Moal:

 - Fix PCI resource initialization in the sata_mv driver to keep legacy
   Marvell boards functional (Rosen)

 - Fix ahci_ceva driver initialization error path (Radhey)

 - Fix libata header file to remove a kernel doc compilation warning
   (Randy)

 - Increase the timeout for the STANDBY IMMEDIATE command to avoid
   suspend failures with drives that are slow to respond to this command
   (Matt)

 - Fixes for the handling of timed out commands in the presence of
   deferred non-NCQ commands, to avoid excessive delays in executing the
   error handler (me)

 - Disable link power management for a couple of WD drives that have
   been identified as not functioning properly when power management is
   used (Niklas)

 - Fix the device iteration loop when checking for link power management
   support to correctly handle port multiplier setups (Niklas)

* tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-sata: fix ata_scsi_lpm_supported() iteration
  ata: libata-core: Disable LPM on WD Green 2.5 480GB
  ata: libata-core: Disable LPM on some WD drives
  scsi: libsas: terminate deferred commands on time out
  ata: libata-scsi: schedule deferred atapi command
  ata: libata-scsi: terminate deferred commands on time out
  ata: libata-eh: Increase STANDBY IMMEDIATE timeout
  ata: libata: avoid kernel-doc warnings
  ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources()
  ata: sata_mv: accept 1 or 2 resources in platform probe

Pull iommufd fixes from Jason Gunthorpe:
 "Several bug fixes found by tools and fuzzing:

   - Incorrect domain passed during replace to ack faults

   - Block the access API from using dmabuf

   - Missing unlock on error unwind

   - Race seeing a partially setup vdevice in the xarray

   - Do not allow vdevices to have multiple stream ids in SMMUv3

   - Possible UAF if racing faults with domain changes"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommu/iommufd: Fix IOPF group ownership UAF
  iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE
  iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds
  iommufd/viommu: Release the igroup lock on the vdevice_size error path
  iommufd: Reject DMABUF pages from the access pin path
  iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace

Pull networking fixes from Paolo Abeni:
 "This is again larger than usual: the backlog accumulated in the past weeks
  is not done yet. I'm not aware of any known pending regression.

  Including fixes from netfilter, Bluetooth, WiFi and CAN.

  Current release - regressions:

   - bluetooth: remove unnecessary hci_conn_get in create_conn_sync

   - can: isotp: fix timer drain order, wakeup handling and tx_gen
     ordering

   - eth:
       - tun/vhost: revert avoid ptr_ring tail-drop when a qdisc is
         present

  Previous releases - regressions:

   - core: do not send ICMP/NDISC Redirects when peer allocation fails

   - ipv6: take nexthop lock for f6i_list walks in replace check and
     notify

   - wifi: fix an ath12k MLO regression impacting WCN7850/QCC2072.

   - netfilter: nf_tables: make nft_object rhltable per table

   - af_unix: fix listen() succeeding on sockets in the wrong state

   - openvswitch: fix potential UAF on meter attach failure

   - bluetooth:
       - fix advertising data UAFs
       - avoid deadlocks in iso_sock_timeout

   - smc: fix socket use-after-free during link group termination

   - dpll: use pin owner's dpll ref for pin-level attribute reporting

   - eth:
       - veth: convert frag_list skbs before running XDP
       - ice: wait for reset completion in ice_resume()
       - igc: remove napi_synchronize() in igc_down()
       - vxlan: use pskb_network_may_pull() for transmit path header pulls

  Previous releases - always broken:

   - xsk: fix AF_XDP multi-buffer Tx descriptor reclaim

   - psp: fix NULL genl_sock deref race with concurrent netns teardown

   - netfilter: widen NAT rewrite delta to s32 in sip_help_tcp()

   - can: peak_usb: fix double free of transfer buffer on URB submit error

   - dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

   - sctp: prevent peer transport count overflow

   - dsa: mt7530: error out on failed reads in MT7531 PHY polling

   - eth:
       - idpf: bound interrupt-vector register fill to the allocated array"

* tag 'net-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (156 commits)
  qede: sync udp_tunnel ports outside qede_lock in the recovery path
  net: openvswitch: fix potential UAF on meter attach failure
  octeontx2-pf: Set correct sequence for carrier off and tx queue stop
  net: libwx: fix FDIR ATR queue mismatch for software VLAN packets
  net: dsa: realtek: use devm_mutex_init for l2_lock
  net: dsa: realtek: use devm_mutex_init for vlan_lock
  net: dsa: realtek: use devm_mutex_init for regmap lock
  net: dsa: realtek: rtl8365mb: use devm_mutex_init for mib_lock
  ptp: netc: fix potential interrupt storm caused by incorrect unbind order
  net: mana: Return error code from mana_create_rxq()
  net: openvswitch: fix skb leak on flow key update failure during ct
  net: openvswitch: fix skb leak on flow key update failure during recirculation
  net: stmmac: Fix E2E delay mechanism
  net: dsa: mt7530: error out on failed reads in MT7531 PHY polling
  net: dsa: mt7530: error out on failed reads in ATC/VTCR command polling
  net: dsa: mt7530: check bus->read() errors in the MDIO regmap backend
  Revert "tun/tap: add ptr_ring consume helper with netdev queue wakeup"
  Revert "vhost-net: wake queue of tun/tap after ptr_ring consume"
  Revert "ptr_ring: move free-space check into separate helper"
  Revert "tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present"
  ...

This reverts commit baf808fe4fcd35767ab732b4ab2ea80dabfd97a6.

There is no netdev queue left to wake after reverting
commit 1d6e569b7d0c ("tun/tap & vhost-net: avoid ptr_ring tail-drop
when a qdisc is present").

Signed-off-by: Simon Schippers <simon.schippers@tu-dortmund.de>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20260728092240.250257-4-simon.schippers@tu-dortmund.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

This reverts commit fba362c17d9d9211fc51f272156bb84fc23bdf98.

__ptr_ring_check_produce() has no users left after reverting
commit 1d6e569b7d0c ("tun/tap & vhost-net: avoid ptr_ring tail-drop
when a qdisc is present").

Signed-off-by: Simon Schippers <simon.schippers@tu-dortmund.de>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20260728092240.250257-3-simon.schippers@tu-dortmund.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

If a command times out while we have deferred non-NCQ commands waiting to
be issued, the SCSI EH task is not immediately woken up as the waiting
deferred commands are never issued nor completed, thus leaving the SCSI
host in a busy state (shost->host_failed != scsi_host_busy(shost)) which
prevents the SCSI EH task from being woken up. Eventually, when the
deferred commands also time out, the SCSI EH task is woken up and the
timeout processing occurs.

Avoid this unnecessary additional SCSI EH wake up time with the same
method as implemented in libata-scsi, using the eh_timed_out SCSI host
template operation. The function sas_eh_timed_out() implements this
operation and executes the function ata_scsi_retry_deferred_qc()
for SATA devices.

Co-developed-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Tested-by: Igor Pylypiv <ipylypiv@google.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

If a command times out while we have deferred non-NCQ commands waiting to
be issued, the SCSI EH task is not immediately woken up as the waiting
deferred commands are never issued nor completed, thus leaving the SCSI
host in a busy state (shost->host_failed != scsi_host_busy(shost)) which
prevents the SCSI EH task from being woken up. Eventually, when the
deferred commands also time out, the SCSI EH task is woken up and the
timeout processing occurs.

Avoid this unnecessary SCSI EH task wake-up additional time by scheduling
a retry of all waiting deferred QCs, using the eh_timed_out SCSI host
template operation. The function ata_scsi_eh_timed_out() is introduced to
implement this operation.

However, terminating deferred commands with DID_REQUEUE to force a retry
by calling the function ata_scsi_requeue_deferred_qc() may still keep the
SCSI host in a busy state because the block layer may immediately re-issue
these commands. The solution to this is to schedule libata EH for the
port which suffered the command timeout to prevent accepting any new
command. ata_scsi_requeue_deferred_qc() is modified to add a call to
ata_port_schedule_eh() for this purpose.

In addition to this change, ata_scsi_requeue_deferred_qc() is also
modified to take a new timedout_scmd scsi command argument which indicates
the SCSI command that timed out. With this additional argument,
ata_scsi_requeue_deferred_qc() can now also terminate with DID_TIME_OUT
any timed out deferred qc, which simplifies ata_scsi_cmd_error_handler().
In this case, ata_scsi_requeue_deferred_qc() returns SCSI_EH_DONE, with
this return value propagated back to the ata_scsi_eh_timed_out() operation
to indicate to scsi_timeout() that the timed out command was handled and
no further processing is needed.

For non-timed out deferred qc that need to be retried,
ata_scsi_requeue_deferred_qc() returns SCSI_EH_NOT_HANDLED, thus
indicating to scsi_timeout() that the timed out command needs to go
through the SCSI EH (and libata EH) processing by adding it to the EH work
queue with scsi_eh_scmd_add().

One side effect of these changes is that the function atapi_qc_complete()
needs to be modified to ensure that a deferred ATAPI command that needs
to be retried is completed with DID_REQUEUE instead of the default
SAM_STAT_GOOD status, and a command that timed out is completed with
DID_TIME_OUT instead of SAM_STAT_CHECK_CONDITION.

Fixes: 0ea84089dbf6 ("ata: libata-scsi: avoid Non-NCQ command starvation")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Igor Pylypiv <ipylypiv@google.com>
Tested-by: Igor Pylypiv <ipylypiv@google.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

Fix the handling of folio_queue allocation failure in writeback by adding a
mempool and passing in gfp_t flags to the rolling buffer functions that
allocate memory, using the mempool if gfp != GFP_KERNEL.

This is then extended upwards and the gfp to be used for a request is stored
in the netfs_io_request struct and is then used for both requests and
subrequests, eliminating the sleeping loops there.

The failure caused:

    folio != NULL
    WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919

Fixes: cd0277ed0c18 ("netfs: Use new folio_queue data type and iterator instead of xarray iter")
Reported-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0da43efa72f88bd3a8af
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260727130716.1099906-5-dhowells@redhat.com
Tested-by: syzbot+0da43efa72f88bd3a8af@syzkaller.appspotmail.com
cc: Paulo Alcantara <pc@manguebit.org>
cc: Yun Zhou <yun.zhou@windriver.com>
cc: Matthew Wilcox <willy@infradead.org>
cc: Christoph Hellwig <hch@infradead.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>