Pull timer fixes from Borislav Petkov:

 - Detect a broken EL2 virtual timer in the bcm2712 SoC boards (RPi5)
   and fallback to the physical one instead

 - Fix a build error with ARM rpc_defconfig and function tracer enabled

* tag 'timers_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer
  tick: Include ktime.h and jiffies.h in linux/tick.h

Pull rseq fix from Borislav Petkov:

 - Prevent a lockup when rseq grants a timeslice extension

* tag 'core_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  rseq: Prevent hard lockup on granted time slice extension

Pull drm fixes from Dave Airlie:
 "While this is large for rc8 time but also AI driven fixes is a lot of
  it, we had a more traditional screw up, and a regression was just
  found in the fair scheduling patches that went in back in rc1. This
  reverts the fair scheduler back to an option and sets the default back
  to what it should have been. We might have been a bit overly zealous
  in switching over, but at least it feels more normal than the AI
  driven fixes.

  Apart from the scheduler, it's mostly amdgpu and xe fixes, with some
  misc fixes to the log code and connector code.

  scheduler:
   - revert fair scheduler patches due to regression
   - mark fair as experimental

  connector:
   - fix OOB read in hdmi audio infoframe

  log:
   - fix divide by 0 if module param is set to 0
   - fix OOB read on empty message
   - fix infinite loop for too large scale

  xe:
   - Fix DPT Allocation paths
   - Fixes around UM queue BO
   - Order ring writes before ring tail updates
   - Add termination on resume for PXP
   - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe
   - Fix sync entry leak on OA config emit failure
   - Check managed mutex initilization errors
   - Fix min frequency setting
   - Fix xe_device_probe error path

  amdgpu:
   - Bounds checking fix in CS IOCTL
   - Bounds checking fix in GEM IOCTL
   - Display fixes
   - GPUVM fix
   - ASPM fix
   - UVD bounds checking fixes
   - VCE 3 fix
   - BT.2020 fixes
   - NBIF 6.3.1 fix
   - IP discovery fix

  radeon:
   - Runtime pm fix

  amdxdna:
   - skip attempting to populate unmapped pages"

* tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel: (51 commits)
  drm/log: Fix infinite loop when scale is too large for display
  drm/log: Fix out-of-bounds read on empty message length
  drm/log: Fix division by zero when scale module parameter is 0
  drm/xe: Fix xe_device_probe() failure
  drm/xe: Fix a bug in pc_adjust_freq_bounds()
  drm/xe/oa: Check managed mutex initialization errors
  drm/xe/oa: Fix sync entry leak on OA config emit failure
  drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
  drm/xe/pxp: add termination on resume
  drm/xe: Order ring writes before ring tail updates
  drm/xe/guc_ads: use uncached mapping for UM queue BO
  drm/xe/guc_ads: allocate UM queues in VRAM on dGFX
  drm/xe/guc_ads: allocate UM queues in a separate BO
  drm/xe: Fix DPT allocation paths.
  accel/amdxdna: Skip unmapped range in aie2_populate_range()
  drm/amdgpu: Prefer default discovery offset
  drm/amdgpu: Reject UVD message with invalid number of h265 refs
  drm/amdgpu: fix nbif 6.3.1 l1 low power not functional
  drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE
  drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix
  ...

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  There is a known WiFi/mt76 regression, waiting for a complete fix that
  should land soonish.

  Previous releases - regressions:

   - tcp: fix icsk_ack.ato bitfield overflow

   - af_unix: Unlink scc_entry in unix_del_edge()

   - ipv4: fix use-after-free in fib_nhc_update_mtu()

   - netfilter:
      - ipset: fix refcount race between list:set GC and swap
      - nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
        path

   - sched: act_ct: fix sk_buff leak when the header checks reject a
     packet

   - sctp: clear new_transport when removing a peer

   - dibs: correct freeing of dmb_clientid_arr

   - ovpn: fix NULL dereference when killing missing key

   - eth:
      - veth: fix queue index used to wake the peer txq in veth_poll
      - ngbe: fix NULL pointer dereference in non-MSI-X interrupt
        enabling
      - gve: fix zero-length skb frag with header-split

  Previous releases - always broken:

   - core: fix skb length accounting after generic XDP frag adjustment

   - af_packet: don't send zero-byte data in tpacket_snd().

   - eth:
      - bnxt: avoid deadlock when canceling IRQ affinity notifier
      - ipvlan: inherit needed_headroom and needed_tailroom from
        phy_dev"

* tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits)
  l2tp: fix tunnel and session refcount leak on seq_file release
  net/sched: cls_bpf: reject dev-bound programs bound to a different device
  sctp: fix use-after-free of cached ASCONF chunk
  net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
  sctp: clear new_transport when removing a peer
  net/dibs: Correct freeing of dmb_clientid_arr
  net/sched: cls_u32: skip hash tables in u32_bind_class()
  gve: fix NULL dereference due to missing ptp adjfine
  gve: fix zero-length skb frag with header-split
  net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
  af_packet: Don't send zero-byte data in tpacket_snd().
  tipc: read le->link under the node lock in tipc_node_link_down()
  selftests: tls: cover splice after a failed decrypt
  net/tls: Fail tls_sw_splice_read() after a failed async decrypt
  net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
  net: tap: fix wrong transport_header when sending VLAN-tagged frame
  net: packet: fix wrong transport_header when sending VLAN-tagged frame
  vxlan: do not arm the ageing timer on a device that is down
  ipv4: fix use-after-free in fib_nhc_update_mtu()
  NTB: ntb_netdev: Preserve RX queue depth on allocation failure
  ...

Pull SCSI fixes from James Bottomley:
 "Two minor core fixes: one for power management issues in error
  handling and the other to fix a deadlock in door locking of SCSI
  devices with removable media; and a minor bug fix for the debug
  driver"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: scsi_debug: Negate wrapped memcmp() result
  scsi: core: Do not block on tag allocation in scsi_eh_lock_door()
  scsi: core: pair EH runtime PM get and put

Pablo Neira Ayuso says:

====================
Netfilter/IPVS fixes for net

The following patchset contains Netfilter/IPVS fixes for net. Still
large batch for this late -rc cycle but at least half of these fixes
in this batch have been cooking for several weeks before:

1) Fix race between ipset list:set GC and swap, use write_lock instead
   of rcu read lock section when accessing the index to ensure
   interference with ip_set_swap(), from Xiang Mei.

2) Release template conntrack in bridge conntrack when packet is
   neither IPv4 nor IPv6 before setting skb as untracked.
   From Zhiling Zou.

3) A series of 3 patches for IPVS to address sashiko reports:
   Schedulers read destination overload state while connection
   accounting and destination configuration can update it concurrently.
   The first patch adds a single total connection counter. The second
   patch uses it to identify threshold crossings precisely, and updates
   OVERLOAD at the crossings and on a threshold edit under dst_lock.
   The third patch moves configuration-controlled AVAILABLE to a
   separate cflags word, so it cannot clobber OVERLOAD through an
   unrelated read-modify-write update.

4) Log invalid packets in TCP and SCTP connection tracking to address
   a deadlock when nfnetlink_log is used as logging backend and the
   nfnetlink_log conntrack glue support is used. From Zihan Xi.

5) Wait for rcu grace period before releasing pernet state in
   nfnetlink_log, otherwise packets can end up access already released
   memory, triggering UaF. From Florian Westphal.

6) IPVS needs to reset IP information in control buffer in skbuff when
   encapsulating IP packets in ICMP, from Kyle Zeng.

7) IPVS needs to validate ihl field of inner headers in when handling
   ICMP response, from Julian Anastasov.

8) Remove a WARN_ON_ONCE reachable from the nf_tables hardware offload
   when triggering ENOMEM on GFP_KERNEL allocation,
   from Alexey Velichayshiy.

9) Publish reply tuple into the flowtable hashtable first, otherwise
   GC might walk over a released tuple when insertion of the original
   tuple fail. From Jeremy Jean.

10) Elide counter increment when replacing an ipset element,
    from Florian Westphal.

11) Remove unneeded ipset accounting resets on destruction/flush,
    from Florian Westphal.

* tag 'nf-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: ipset: let destroy callbacks adjust ext mem size
  netfilter: ipset: fix list type element drift bug
  netfilter: flowtable: publish GC-visible tuple last
  netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
  ipvs: revalidate ihl to prevent out-of-bounds access
  ipvs: clear IPv4 options after rebasing tunnel ICMP errors
  netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
  netfilter: nf_conntrack: defer invalid log until after unlock
  ipvs: separate destination availability state
  ipvs: properly update the overload flag on dest edit
  ipvs: add totalconns for dest
  netfilter: bridge: release template ct on non-IP path
  netfilter: ipset: fix refcount race between list:set GC and swap
====================

Link: https://patch.msgid.link/20260810190621.894119-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

This reverts commit 77a6809f1dc39376116f8d769a0d2630dc95ad79.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-18-tvrtko.ursulin@igalia.com

This reverts commit 16e7698bc04d3dd19d95a688e4b0297a0e28a93b.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-17-tvrtko.ursulin@igalia.com

This reverts commit d09339388b778f04dd9e638befa2594c9cb4290b.

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Luke.Wildhardt@proton.me
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Philipp Stanner <phasta@kernel.org>
Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260811163139.99746-2-tvrtko.ursulin@igalia.com

fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
RTNL does not serialize this walk with PMTU exception updates. The walk
uses rcu_dereference_protected() with a constant true condition without
holding fnhe_lock.

The following interleaving can therefore occur:

  CPU 0                              CPU 1
  fib_nhc_update_mtu()               update_or_create_fnhe()
    load fnhe                          spin_lock_bh(&fnhe_lock)
                                       fnhe_remove_oldest()
                                         unlink fnhe
                                         kfree_rcu(fnhe, rcu)
    <quiescent state>
    access fnhe after grace period

KASAN reported:

  BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410
  Read of size 8 at addr ffff888107d49000 by task poc/90
  Call Trace:
   fib_nhc_update_mtu+0x3df/0x410
   fib_sync_mtu+0x7a/0xd0
   fib_netdev_event+0x229/0x3f0
   netif_set_mtu_ext+0x33a/0x570
   dev_set_mtu+0x88/0x120

The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a
pair and other writers serialize them with fnhe_lock. RCU alone prevents
reclamation, but would still allow concurrent writers to leave a mixed
pair.

Walk the table under RCU and acquire fnhe_lock only while updating each
exception. RCU keeps the current entry alive while the short critical
section serializes its paired PMTU fields. This avoids holding the global
lock while scanning all 2048 buckets for every nexthop.

Fixes: af7d6cce5369 ("net: ipv4: update fnhe_pmtu when first hop's MTU changes")
Cc: stable@vger.kernel.org
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260807181710.1178747-1-nicoyip.dev@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>