Pull smp_call_function() torture-test updates from Paul McKenney:

 - Count single_rpc offline failures in statistics output

 - Make invoker threads actually wait for all threads to start

* tag 'scftorture.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:
  scftorture: Make invoker threads actually wait for all threads to start
  scftorture: Count single_rpc offline failures in statistics output

Pull RCU updates from Paul McKenney:
 "Make expedited grace periods expedite normal RCU callbacks

  Miscellaneous fixes:
   - Improve diagnostic output with character task states
   - Mark accesses to inform KCSAN of concurrency design
   - Move from kmalloc() to kmalloc_obj()
   - Documentation updates
   - Improve handling of RCU deferred quiescent states
   - Clean up unused function arguments and structure fields
   - Reduce show_rcu_gp_kthreads() stack space

  Tasks RCU updates:
   - Clean up after SRCU re-implementation of Tasks Trace RCU
   - Mark accesses to inform KCSAN of concurrency design
   - Add ->lazy_timer status to diagnostic output
   - Remove an unnecessary memory barrier
   - Fix a data race, courtesy of KCSAN
   - Documentation updates
   - Convert cond_resched_tasks_rcu_qs() from macro to static inline
     function

  SRCU updates:
   - Add Rust helpers for SRCU
   - Avoid losing queued work at cleanup_srcu_struct() time

  Torture-test updates:
   - Preparation work for immediate RCU priority deboosting
   - Test RCU readers from real interrupt handlers (as opposed to
     softirq)
   - Simplify code through use of cpumask_next_wrap()
   - Improve diagnostic output with character task states
   - Add rcutorture.nwriters parameter to allow lightweight stall
     testing, and rcutorture.stall_only to make doing so easier
   - Test an RCU Tasks Trace grace period implying an RCU grace period
   - Make RCU Tasks Trace torturing track reader batches
   - Fix a data race, courtesy of KCSAN
   - Plug a shuffle_tmp_mask memory leak on kthread spawn failure"

* tag 'rcu.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (59 commits)
  rcu: Add closing parenthesis in comment in rcu_read_unlock_strict()
  rcutorture: Make {,s}rcu_read_delay() better handle forward-progress testing
  rcutorture: Announce declining to forward-progress test
  torture: Don't leak shuffle_tmp_mask when shuffler kthread fails to start
  rcutorture: Use this_cpu_inc() for rcu_torture_count[] and rcu_torture_batch[]
  rcutorture: Make RCU Tasks Trace track Reader Batches
  rcutorture: Test RCU Tasks Trace GP implying RCU GP
  rcutorture: Add a stall_only module parameter
  rcutorture: Add nwriters module parameter
  rcutorture: Use task_state_to_char() for task-state reporting
  rcutorture: Use cpumask_next_wrap() in rcu_torture_preempt()
  rcutorture: Test RCU readers from hardware interrupt handlers
  rcutorture: Check for immediate deboosting at reader end
  srcu: Queue sdp->work when the delay timer is successfully deleted
  rcu-tasks: Convert cond_resched_tasks_rcu_qs() to static inline
  rcu-tasks: Fix some comments for call_rcu_tasks() and call_rcu_tasks_rude()
  rcu-tasks: Rename tasks_rcu_exit_srcu_stall_timer to tasks_rcu_exit_stall_timer
  rcu: Mark interrupts-enabled accesses to rdp->cpu_no_qs.s
  rcu: Reduce stack usage in show_rcu_gp_kthreads()
  rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
  ...

Pull s390 updates from Vasily Gorbik:

 - Add a cpuidle driver with polling and enabled wait states using the
   existing CPU idle infrastructure and idle governor to improve latency
   for frequent sleep/wakeup cycles. Remove the obsolete tick delay
   heuristic and generic arch_needs_cpu() hook. Add the corresponding
   driver entry to MAINTAINERS

 - Add kCFI support using the generic support provided by Clang

 - Enable Clang CONTEXT_ANALYSIS for various architecture code and for
   char, PCI, CIO and virtio drivers. Add required lock annotations,
   exclude unsupported mm helpers and remove conditional PCI locking

 - Fix secure storage access exception handling and reintroduce
   DCACHE_WORD_ACCESS previously removed as a workaround

 - Fix cpum_cf perf crashes when CPUs are brought online while per-task
   events are active. Allocate and remove per-CPU counter data from CPU
   hotplug callbacks

 - Fix a deadlock when an s390dbf debug area is unregistered while one
   of its debugfs files is being written to

 - Fix MVIY_PERCPU() with binutils older than 2.39, where an assembler
   macro silently omitted an instruction needed to repair interrupted
   operations after CPU migration

 - Remove/replace cond_resched() calls which are no-ops with the
   supported s390 preemption models

 - Fix AP queue depth and maximum message length decoding according to
   the architecture. Current hardware is not affected, but future
   hardware could report values which were handled incorrectly

 - Reflect the configured CPU state in cpu_enabled_mask so deconfigured
   CPUs are not presented as available for onlining

 - Restore the vDSO GNU_EH_FRAME program header which was lost when the
   build switched to direct linker invocation, and mark it read-only

 - Add SCLP action qualifiers used by Spyre for card initialization,
   recoverable error and telemetry reporting

 - Move KMSAN interrupt flag helpers out of line to fix
   -Wstatic-in-inline build warnings

 - Use level-specific page table entry accessors for hugetlb entries and
   ptep_get() when accessing crashed kernel memory in kdump

 - Make forced AP bus rescans killable so that a user process blocked
   behind an ongoing scan can still be terminated with SIGKILL

 - Rework pkey ioctl error paths to remove duplicated cleanup code and
   avoid freeing error pointers

 - Allow the protected guest SWIOTLB buffer to be allocated outside the
   first 2GB. Also enable dynamic SWIOTLB growth and the coherent atomic
   pool fallback to improve I/O behavior when the initial pool is
   exhausted

 - Add program check statistics and spinlock contention tracepoints.
   Increase the lockdep chain capacity to keep lockdep enabled for
   complex code paths such as btrfs

 - Simplify IPL, trap and syscall code and remove the obsolete
   unistd_32.h generation entry

* tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (59 commits)
  s390/percpu: Fix MVIY_PERCPU() with older binutils
  s390/debug: Fix deadlock during unregister
  s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
  s390: Enable CONTEXT_ANALYSIS for various directories
  s390/mm: Add __context_unsafe() attribute to gmap helper functions
  s390/mm: Add __context_unsafe() attribute to do_secure_storage_access()
  s390/sysinfo: Add context analysis attributes
  s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
  s390/virtio: Enable CONTEXT_ANALYSIS
  s390/cio: Enable CONTEXT_ANALYSIS
  s390/vfio_ccw: Add __must_hold() attribute to vfio_ccw_sch_quiesce()
  s390/pci: Enable CONTEXT_ANALYSIS
  s390/pci: Rework __zpci_event_availability() to remove conditional locking
  s390/pci: Rework __zpci_event_error() to remove conditional locking
  s390/char: Enable CONTEXT_ANALYSIS
  s390/con3215: Add __must_hold() attribute to raw3215_make_room()
  s390/ap: Fix MAPML computation
  s390/cio: Remove cond_resched() calls
  s390: Remove cond_resched() calls
  KVM: s390: Remove cond_resched() calls
  ...

Pull more liveupdate updates from Mike Rapoport:
 "Make boot time huge page allocation work nicely with kexec handover.

  Today allocation of gigantic pages in HugeTLB cannot work reliably
  with kexec handover (KHO):

   - HugeTLB allocates gigantic pages using memblock and autoscaling of
     KHO scratch accounts for these allocations. When gigantic pages
     occupy half of the memory of more, KHO fails to allocate its
     scratch memory.

   - After kexec handover, memblock allocations exclusively use KHO
     scratch that is not supposed to contain preserved memory. This
     essentially blocks preservation of HugeTLB with gigantic pages.

  Extend early memory pools available for KHO kernel with areas that are
  guaranteed not to contain preserved memory"

* tag 'liveupdate-v7.3-rc1-20260823' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: (21 commits)
  kho: exclude hugetlb memory from scratch size calculation
  memblock: add memblock_reserved_hugetlb_size()
  memblock: make HugeTLB bootmem allocation work with KHO
  memblock: always include KHO headers
  kho: extend scratch
  mm/mm_init: don't rely on memblock to get KHO scratch migratetype
  kho: initialize preserved memory map radix tree earlier
  kho: initialize kho_scratch pointer earlier in boot
  kho: expose kho_scratch_overlap() to kexec_handover.h
  kho: add kho_radix_init_tree()
  kho: allow destroying KHO radix tree
  kho: allow early-boot usage of the KHO radix tree
  kho: add data argument to radix walk callback
  kho: add callback for table pages
  kho: add a struct for radix callbacks
  kho: move all memory retrieval logic to kho_mem_retrieve()
  kho: store incoming radix tree in kho_in
  kho: disallow wide keys in radix tree
  kho: make radix max key width more obvious
  kho: generalize radix tree APIs
  ...

Pull non-MM updates from Andrew Morton:

 - "ocfs2/dlm: bound peer-controlled lengths in the o2dlm" (Bryam
   Vargas)

   Validate and bound all input lengths and count fields in the o2dlm
   migration and recovery receive handlers to prevent memory corruption
   and kernel panics from malformed cluster messages

 - "ocfs2: validate xattr entry bounds" (Cen Zhang)

   Validate OCFS2 extended attribute entry name and value bounds during
   metadata reads to prevent out-of-range memory accesses during
   retrieval or listing operations.

 - "taskstats: fix cgroupstats invalid fd handling and add selftests"
   (Yiyang Chen)

   Return -EBADF when cgroupstats receives an invalid file descriptor to
   prevent caller hangs and misleading success ACKs. Add a kselftest to
   validate valid cgroup v1 queries and verify proper error handling
   across different Netlink flag combinations.

 - "misc lib/raid/ improvements v2" (Christoph Hellwig)

   Improve benchmark-based algorithm selection for the XOR and RAID6
   libraries, add KUnit benchmark tests, and cleanup minor
   implementation details.

 - "ocfs2: cluster: o2hb_region_pin() fixes" (Joseph Qi)

   Fix sleeping-in-atomic, lock order inversion and error-path cleanup
   bugs in o2hb_region_pin() by releasing o2hb_live_lock across sleeping
   configfs_depend_item() calls and using unlocked variants from
   callback context. Ensure failed pin attempts properly decrement user
   counts and unpin partially initialized heartbeat regions to prevent
   memory leaks and unprotected states.

 - "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()"
   (Vincent Mailhol)

   Fix an off-by-one which could cause an out-of-bounds read.

 - "ocfs2: harden heartbeat teardown races" (Cen Zhang)

   Fix two OCFS2 heartbeat/o2net teardown races found by KASAN.

 - "taskstats: tidy up the cpumask command path" *Bradley Morgan)

   make two small cleanups in kernel/taskstats.c.

 - "ocfs2: validate active orphan slots during inode read" (ZhengYuan
   Huang)

   Validate active ordinary and append-DIO orphan slots read from OCFS2
   dinodes at the metadata boundary to prevent corrupted slot indices
   from causing out-of-bounds array accesses.

 - "ocfs2: bound-check both readdir re-validation scans" (Zhan Xusheng)

   Enforce strict boundary checks on directory entry record lengths and
   offset calculations during OCFS2 directory re-scans to prevent
   out-of-bounds memory reads and directory position corruption.

* tag 'mm-nonmm-stable-2026-08-22-16-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (95 commits)
  mailmap: fix bouncing address for Taniya Das
  ocfs2: bound-check dir entries in the inline-data re-validation scan
  ocfs2: bound-check dir entries in the readdir re-validation scan
  squashfs: avoid thundering-herd cache wakeups
  prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
  mailmap: update email address for Linfeng Sun
  lib/interval_tree: fix allocation warning messages
  checkpatch: add NOKPROBE_SYMBOL to the whitelist of lines that can occur immediately after functions
  Squashfs: check block offset is not negative
  signal: factor out the kernel reserved si_code check
  ocfs2: fix readdir position truncation on 32-bit kernels
  ocfs2: fix cached cluster count after suballocator reclaim
  ocfs2: fix circular locking dependency in ocfs2_init_acl()
  ocfs2: validate DIO orphan slot during inode read
  ocfs2: validate orphan slot during inode read
  selftests/prctl: fix non-anonymous VMA mapping in set-anon-vma-name test
  MAINTAINERS: add IRC and patchwork for LTP
  include/linux/list.h: mark list_add and __list_add as __always_inline
  tools/mm: prevent page_owner_sort from truncating input
  hung_task: update DETECT_HUNG_TASK_BLOCKER Kconfig help
  ...

Pull scheduler fixes from Ingo Molnar:

 - Add missing cpus_read_lock locking to rebuild_sched_domains()
   (Sebastian Andrzej Siewior)

 - Fix division by zero bug in tg_cpus() that can be triggered with
   empty cpusets (Jake Steinman)

* tag 'sched-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Floor tg_cpus() at 1
  sched/topology: Add a cpus_read_lock to rebuild_sched_domains()

Pull futex fixes from Ingo Molnar:

 - Enforce that the private futex owner shares the mm when attaching
   (Kyle Zeng, Thomas Gleixner)

 - Fix race on the initial mm->futex.phash.ref allocation (Hyunwoo Kim)

 - Fix might_sleep() warning in futex_pivot_pending() (Peter Zijlstra)

* tag 'locking-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Fix might_sleep() warning in futex_pivot_pending()
  futex: Fix race on the initial mm->futex.phash.ref allocation
  futex: Clean up the redundant exit/exec functions
  futex/pi: Plug private futex exec() race
  futex: Sanitize and document task_struct::futex::state transitions
  futex/pi: Reject cross-mm private futex owners

Pull timer fixes from Ingo Molnar:

 - Fix timer debugobjects state corruption on CPU offlining (Thomas
   Gleixner)

 - Fix ARM get_cycles() regression causing boot hangs on certain ARM
   configs (Nathan Chancellor)

* tag 'core-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timer: Keep debugobjects state consistent in migrate_timer_list()

* tag 'timers-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  ARM: Fix get_cycles() after delay_read_timer() conversion

Pull livepatching updates from Petr Mladek:

 - Move consistency checks to catch missing func->old_name before the
   first access

 - Allow to run livepatching selftests from top-level directory

* tag 'livepatching-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching:
  kbuild: unset sub_make_done before calling kselftest build system
  livepatch: Fix NULL pointer dereference in klp_find_func()

Pull module updates from Petr Pavlu:

 - Remove unnecessary module::args. Nowadays, no parameter-handling code
   points into the module::args buffer. The last user of module::args in
   xtensa/simdisk is updated and the data is then removed

 - Add Rust support for boolean parameters. This will initially be used
   by the Rust null block driver

 - Fix clearing the current charp parameter value when setting a new one
   fails due to an allocation failure

 - Improve the debugging code for kmod (request_module()) duplicates.
   Fix a potential use-after-free when waiting on a duplicate request
   and make several general improvements to the code

 - Fix the symbol size returned when looking up a data symbol through
   kallsyms

 - Smaller fixes and cleanups

* tag 'modules-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
  params: fix charp corruption on allocation failure
  module: validate string table section types
  module/dups: Clean up includes
  module/dups: Use strcmp() to compare module names
  module/dups: Use scope-based cleanup helpers
  module/dups: Avoid unnecessary kmod_dup_req allocations
  module/dups: Fix use-after-free in kmod_dup_req lifetime handling
  module/dups: Inform duplicate requests about the result directly
  rust: module_param: support bool parameters
  rust: module_param: return value by copy from `value`
  module: Remove unnecessary module::args
  xtensa/simdisk: Avoid referring to module::args
  module: Remove unused DISCARD_EH_FRAME definition from module.lds.S
  module: procfs: use matching type for accumulator in module_total_size()
  module: use strscpy() to copy module names in stats and dup tracking
  params: fix path of /sys/module/XYZ/parameters/ in comment
  module/kallsyms: fix nextval for data symbol lookup