Pull RISC-V fixes from Paul Walmsley:

 - Fix swiotlb initialization on systems where DRAM is located above
   4GiB (such as the Tenstorrent Blackhole cards)

 - Fix an out-of-bounds access in the memory hot-remove code that can
   occur on Sv39 and Sv48 systems

 - Avoid oopsing during boot if the SBI component of the unaligned
   access performance checking code loses a race against __init function
   freeing

 - Avoid attempting to install the debug-enabled vDSO when it shouldn't
   be built due to !CONFIG_MMU

 - Avoid some sparse warnings by adding missing __iomem notations in
   get_cycles{,_hi}()

 - Drop an unnecessary runtime warning in the SiFive errata handler

* tag 'riscv-for-linus-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: vdso: Only try to install vDSO when present
  riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove
  riscv: drop __init from vec_check_unaligned_access_speed_all_cpus
  riscv: mm: fix SWIOTLB initialization for systems with DRAM above 4GB
  riscv/sifive: remove warning in errata
  riscv: time: Add missing __iomem in get_cycles() and get_cycles_hi()

Pull s390 updates from Vasily Gorbik:

 - Fix PCI MMIO write syscall falsely reporting success for mappings not
   valid for MMIO when MIO is unavailable by returning -EFAULT

 - Fix CPRB parameter buffer overflows in zcrypt CCA AES cipher and ECC
   private key conversion by rejecting oversized key tokens

 - Fix buffer overreads and length underflow in pkey and zcrypt CCA
   token validation by checking length fields against actual buffer
   sizes

 - Fix out of bounds permission bitmap access in zcrypt EP11 admin CPRB
   filtering on custom device nodes by using AP_DOMAINS as the limit

 - Fix speculative permission bitmap reads in zcrypt CCA and EP11 admin
   CPRB handling by sanitizing user controlled domain indexes

 - Fix sensitive key material left in zcrypt CCA clear key import
   buffers by scrubbing CPRB and temporary buffers after use

* tag 's390-7.2-6' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey()
  s390/zcrypt: Close speculative mem read possibility
  s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs
  s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
  s390/zcrypt: Validate length for CCA ECC private key requests
  s390/zcrypt: Validate length for CCA AES cipher key requests
  s390/pci: Fix s390_pci_mmio_write syscall error return without MIO

Pull misc x86 fixes from Ingo Molnar:

 - Fix the boot-time memcmp() asm implementation's constraints
   and optimization properties (Mauricio Faria de Oliveira)

 - Move the 0xd0...0xd7 AMD Zen5 model range from the Zen6
   range where it mistakenly ended up (Pratik Vishwakarma)

* tag 'x86-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/CPU/AMD: Carve out a Zen5 models range
  x86/boot: Add volatile, clobbers and zero-length test in memcmp()

Pull scheduler fix from Ingo Molnar:

 - Fix wakeups of deferred DL servers to be actually deferred (Gabriele
   Monaco)

* tag 'sched-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/deadline: Use revised wakeup rule only for running dl_server

Pull uprobes fix from Ingo Molnar:

 - Fix uretprobes race that can crash the kernel (Breno Leitao)

* tag 'perf-urgent-2026-08-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  uprobes: Fix NULL pointer dereference in hprobe_expire()

Pull vfs fixes from Christian Brauner:
 "binfmt_misc:

   - Don't let an 'F' entry pin its own instance.

     An entry registered with 'F' opens its interpreter at registration
     time and holds that file until the entry is freed, so an entry
     nobody removes by hand is only closed once the binfmt_misc
     superblock is shut down.

     If the interpreter lives on a mount that keeps that superblock
     alive the two pin each other and the file is never closed. That's
     reachable by pointing the interpreter at the instance itself or by
     using the instance as an overlayfs lower layer, and once the mount
     namespace is gone there's nothing left to unregister through
     either.

   - Restore write access when removing an entry.

     Registering with the MISC_FMT_OPEN_FILE flag opens the interpreter
     via open_exec() which denies write access for as long as the entry
     exists, but removal only did filp_close() and never restored it.
     The inode's i_writecount stayed permanently negative and opening
     the interpreter for writing kept failing with ETXTBSY long after
     the entry was gone.

   - Use exe_file_deny_write_access() for the interpreter clone so both
     sides base their decision on the same mode.

   - Reject a flag character as the field delimiter. create_entry() pads
     the buffer with the delimiter so the field parsers terminate even
     on a truncated string, but check_special_flags() consumes flag
     characters instead of scanning for the delimiter.

     If the delimiter is itself a flag character the padding stops
     acting as a terminator and the scan keeps reading past the end of
     the allocation. Such a registration was always rejected, just only
     after the out of bounds read has already happened.

   - Don't leak the user namespace when the mount fails.

     bm_get_tree() hands its reference to get_tree_keyed() and sget_fc()
     moves it into sb->s_fs_info, but generic_shutdown_super() only
     calls ->put_super() from inside the if (sb->s_root) branch and
     bm_fill_super() can fail before either s_root or s_op is in place.

     Drop the reference in ->kill_sb() instead, which runs
     unconditionally.

  netfs:

   - Clear PG_private_2 on a copy-to-cache append failure.

   - Handle a rolling buffer allocation failure in single-object
     writeback and drop the extra folio reference
     netfs_write_folio_single() took before the append.

   - Release the previously batched readahead folios when
     rolling_buffer_load_from_ra() fails in
     netfs_prepare_read_iterator()

   - Fix the folio_queue ENOMEM in writeback by adding a mempool and
     passing gfp flags into the rolling buffer helpers.

  iomap:

   - Add a separate bio_set for iomap_split_ioend(). It can split bios
     that already come from iomap_ioend_bioset and deadlock once that
     bioset is exhausted.

  afs:

   - Set call->async for an asynchronous afs_fs_fetch_data() the way
     afs_fs_fetch_data64() already does.

   - Subtract subreq->transferred from subreq->len in
     afs_fs_fetch_data() rather than adding it.

   - Fix a UAF when sending a message"

* tag 'vfs-7.2-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  iomap: add a separate bio_set for iomap_split_ioend
  binfmt_misc: don't leak the user namespace when the mount fails
  binfmt_misc: reject a flag character as the field delimiter
  binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
  binfmt_misc: restore write access when removing an entry
  binfmt_misc: don't let an 'F' entry pin its own instance
  netfs: Fix folio_queue ENOMEM in writeback by adding a mempool
  netfs: release readahead folios on iterator preparation failure
  netfs: handle single writeback rolling buffer allocation failure
  netfs: clear PG_private_2 on copy-to-cache append failure
  afs: Fix UAF when sending a message
  afs: Fix afs_fs_fetch_data() to subtract transferred from len
  afs: Fix afs_fs_fetch_data() to set call->async

Pull SCSI fixes from James Bottomley"
 "No core changes. The largest driver fix is the reversion of threaded
  interrupt handlers in UFS and the next is the resume deadlock fix in
  hisi_sas which extends into libsas"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
  scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
  scsi: target: Clear cmd_cnt when initial counter enrollment fails
  scsi: zfcp: Fix memory leak during adapter release by destroying gid_pn_req
  scsi: ufs: core: Revert "Delegate the interrupt service routine to a threaded IRQ handler"
  scsi: ufs: core: Cancel RTC work in active-active suspend
  scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write
  scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE
  scsi: ufs: dt-bindings: Add missing mcq reg for qcom,sa8255p-ufshc
  scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
  scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
  scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer

Pull dmaengine fixes from Vinod Koul:

 - switchtec fix for register programming

 - sun6i descriptor reclaim fix

 - Intel idxd fixes for double free in error and setup failure

 - Qualcomm bam dma command element fix

* tag 'dmaengine-fix-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine:
  dmaengine: qcom: bam_dma: Fix command element mask field for BAM v1.6.0+
  dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
  dmaengine: idxd: fix double free of wq, engine, and group structs
  dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA
  dmaengine: switchtec-dma: fix FIELD_GET misuse when programming SE threshold

Pull phy fixes from Vinod Koul:

 - fixes for zynqmp clock and pm error handling and SERDES scrambler
   register handling

 - Rockchip SSC spread fix

 - Qualcomm musb return call fix

* tag 'phy-fixes-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: zynqmp: keep SERDES scrambler and 8b/10b enabled for USB
  phy: zynqmp: use read-modify-write for SERDES scrambler bypass
  phy: zynqmp: fix L0_TM_DISABLE_SCRAMBLE_ENCODER mask
  phy: zynqmp: fix runtime PM leak on probe allocation failure
  phy: zynqmp: fix clock error handling in xpsgtr_phy_init()
  phy: rockchip: naneng-combphy: Always configure SSC spread direction
  phy: qcom: m31-eusb2: Fix return value of init call