Pull scheduler fix from Ingo Molnar:

 - Fix wakeups of deferred DL servers to be actually deferred (Gabriele
   Monaco)

* tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/deadline: Use revised wakeup rule only for running dl_server

Pull uprobes fix from Ingo Molnar:

 - Fix uretprobes race that can crash the kernel (Breno Leitao)

* tag 'perf-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  uprobes: Fix NULL pointer dereference in hprobe_expire()

Pull tracing fixes from Steven Rostedt:

 - Reset dropped_count in mmio_reset_data()

   When mmio_reset_data() is called, it does not reset the dropped_count
   so that subsequent runs will have incorrect reporting.

 - Add NULL check for mmio_trace_array in logging functions

   The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map() may
   have the 'tr' variable passed to it as NULL. But they both
   dereference it without checking if it is NULL first.

 - Check return value of __register_event() in trace_module_add_events()

   If __register_event() fails, the __add_event_to_tracers() call after
   it will create a file for it. If the module fails to load and its
   memory is freed, the file will still point to it and it will not be
   removed as the registering of the event did not complete.

   Only call __add_event_to_tracers() if the __register_event() was
   successful.

 - Fix false positive match in regex_match_full()

   The regex full matching uses a strncmp() to test against the match
   string and the value. It should not match if value is a prefix of the
   string to match. Check to make sure the length of the strings match
   before comparing.

 - Fix reader page read offset for remote buffers

   A page swapped in by __rb_get_reader_page_from_remote() retains its
   stale read offset, causing subsequent reads to skip events or read
   past valid data.

 - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer()

   Remote buffers allocate a subbuf_ids array. If the allocator function
   fails after it is allocated, it does not free it, resulting in a
   memory leak.

* tag 'trace-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
  ring-buffer: Fix reader page read offset for remote buffers
  tracing/filters: Fix false positive match in regex_match_full()
  tracing: Check return value of __register_event() in trace_module_add_events()
  tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
  tracing/mmiotrace: Reset dropped_count in mmio_reset_data()

In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using
kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation
fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages()
fails), execution jumps to fail_free_reader.

While __free(kfree) automatically frees the outer cpu_buffer structure
at scope exit, kfree(cpu_buffer) does not recursively free nested heap
pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak.

Fix this by explicitly freeing cpu_buffer->subbuf_ids in the
fail_free_reader error unwinding path when cpu_buffer->remote is set.

Link: https://patch.msgid.link/178550740672.380917.6067449683620196150.stgit@devnote2
Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

Forking a task that has a pending uretprobe can oops the kernel with a
NULL pointer dereference in the clone() path:

  BUG: kernel NULL pointer dereference, address: 0000000000000018
  Oops: 0002 [#1] SMP NOPTI
  RIP: 0010:hprobe_expire
  CR2: 0000000000000018
  Call Trace:
   uprobe_copy_process
   copy_process
   kernel_clone
   __x64_sys_clone
   do_syscall_64
   entry_SYSCALL_64_after_hwframe

This was found on real hosts on Meta fleet.

I've got the impression that this is what is happening:

  CPU 1                          CPU 2 (traced task)
  -----                          -------------------
                                 hit uprobe, prepare_uretprobe():
                                   hprobe LEASED, refcount >= 1
  uprobe_unregister()
    put_uprobe(): refcount -> 0
                                 fork() -> dup_utask()
                                   hprobe_expire(hprobe, true)
                                     try_get_uprobe() -> NULL
                                     get_uprobe(NULL)   <-- Oops

Only take the extra reference when the uprobe is non-NULL; a NULL means
it is gone and is the correct value to return.

Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260729-uprobe-v1-1-61896b87c867@debian.org

Pull audit fixes from Paul Moore:

 - Fix potential integer overflows in audit_log_n_string()

   Similar to the earlier fix to audit_log_n_hex() that you merged
   earlier in July. Expect a cleaner, and generally better fix for these
   functions in an upcoming merge window, but this addresses the problem
   in a small patch that should be easy for people to backport.

 - Fix potential use-after-free in audit_del_rule()

* tag 'audit-pr-20260730' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
  audit: fix potential use-after-free in audit_del_rule()
  audit: fix potential integer overflow in audit_log_n_string()

Pull power management fixes from Rafael Wysocki:
 "These fix issues related to cpufreq, in the ACPI CPPC library and the
  generic CPPC cpufreq driver, in the powernow-k8 and amd-pstate
  drivers, and in the schedutil governor:

   - Allow fast frequency switching in the ACPI CPPC library only when
     every supported control used by the driver callback has an address
     space already accepted for fast access (Christian Loehle)

   - Skip writes to unsupported performance controls in the ACPI CPPC
     library (Christian Loehle)

   - Update cppc_cpufreq_update_perf_limits() to read policy->min and
     policy->max once and, if the lockless snapshot is inconsistent,
     reduce the minimum to the observed maximum, along the lines of
     cpufreq_driver_resolve_freq() (Christian Loehle)

   - Fix a possible memory leak in the powernowk8_cpu_init() error paths
     (Abdun Nihaal)

   - Loosen the requirement on lowest nonlinear frequency != min freq in
     the amd-pstate driver that is too tight for new systems some of
     which actually have the lowest nonlinear frequency identical to the
     minimum frequency (Mario Limonciello)

   - Prevent amd-pstate from loading on unsupported hardware (Rong
     Zhang)

   - Address an initialization race in the schedutil governor when it
     runs on multi-CPU cpufreq policies, by making it initialize all
     per-CPU structures first and only then publish the per-CPU
     utilization update hooks (Zhongqiu Han)"

* tag 'pm-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: powernow-k8: Fix possible memory leak in powernowk8_cpu_init()
  ACPI: CPPC: Skip writes to unsupported performance controls
  cpufreq/amd-pstate: Prevent the driver from loading on unsupported hardware
  cpufreq/amd-pstate: Loosen requirement on lowest nonlinear frequency != min freq
  cpufreq: schedutil: Publish util hooks only after all sg_cpu are initialized
  cpufreq: cppc: Sanitize lockless policy limit snapshots
  ACPI: CPPC: Check all controls for fast switching

Commit 14a857056466 ("sched/deadline: Use revised wakeup rule for
dl_server") applies the revised wakeup rule to any server, as a result
servers that are not running (dl_defer_running == 0) and start with a
deadline overflow get enqueued and can boost tasks as if they were
running, invalidating the defer rule and the documented state model.

Apply the revised wakeup rule only for deferrable servers that are
marked as running.

Fixes: 14a857056466 ("sched/deadline: Use revised wakeup rule for dl_server")
Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Tested-by: Andrea Righi <arighi@nvidia.com>
Link: https://patch.msgid.link/20260522125833.264145-1-gmonaco@redhat.com

A page swapped in by __rb_get_reader_page_from_remote() retains its
stale read offset, causing subsequent reads to skip events or read
past valid data. Fix it.

Link: https://patch.msgid.link/20260729133609.4022734-1-vdonnefort@google.com
Fixes: fbd1743ecba1 ("ring-buffer: Add non-consuming read for ring-buffer remotes")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Keir Fraser <keirf@google.com>
Tested-by: Keir Fraser <keirf@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()`
before unlinking the rule from RCU-visible filter lists and waiting for a
grace period. Concurrent readers in `audit_filter()` and
`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify
mark can be freed on an independent lifetime path. This creates a
use-after-free window during rule deletion.

Fix this by unlinking the rule from the RCU-visible lists and invoking
`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other
rule removal helpers). This ensures that all existing RCU readers have
exited the critical section before any underlying resources are destroyed.

Cc: stable@vger.kernel.org
Fixes: 34d99af52ad4 ("audit: implement audit by executable")
Reported-by: Vega <vega@nebusec.ai>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
Signed-off-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>