Pull i2c fixes from Andi Shyti:
 "Fixes mainly for teardown and resource handling, runtime PM and
  hardware-specific controller issues:

   - fix debugfs use-after-free when removing the adapter

   - designware: apply interrupt mask quirk for HJMC3001

   - imx-lpi2c: avoid target accesses on master-only controllers

   - mux: release channel node when adapter registration fails

   - qcom-cci: fix autosuspend and runtime PM cleanup on removal

   - qcom-geni: fix timing parameters for 32 MHz clock"

* tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
  i2c: core: fix debugfs UAF on adapter removal
  i2c: imx-lpi2c: avoid accessing target registers on master-only controllers
  i2c: qcom-cci: fix autosuspend cleanup
  i2c: designware: Enable interrupt mask workaround for HJMC3001
  i2c: qcom-geni: update frequency table to fix timing parameters
  i2c: mux: Fix channel node leak on adapter add failure

Pull Coccinelle updates from Julia Lawall:

 - Clean up a number of the semantic patches in the scripts/coccinelle
   directory, particularly with respect to functions that no longer
   exist in the kernel (Sang-Heon Jeon)

   He and I have also done some reorganizations that improve
   performance.

 - Eliminate some false positives (me)

 - Fix an out of date URL (相浦彰)

* tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
  coccinelle: ifnulldev_put: update error message
  coccinelle: ifnulldev_put: update outdated helper names
  coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
  coccinelle: kfree_mismatch: drop vmalloc_exec
  coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
  coccinelle: zalloc-simple: drop the kmem_alloc rules
  coccinelle: alloc_cast: drop removed allocators
  coccinelle: remove obsolete pci_free_consistent.cocci
  scripts: coccinelle: devm_free: reduce false positives
  coccinelle: misc: struct_size: drop unneeded parentheses
  coccinelle: mini_lock: improve performance when searching loops
  coccinelle: api: check for macro context
  coccinelle: update Coccinelle website URL
  coccinelle: misc: minmax: avoid unhelpful isomorphisms
  coccinelle: misc: minmax: check for the presence of if cases
  coccinelle: misc: minmax: drop unneeded parentheses
  coccinelle: misc: minmax: improve performance when no candidate exists
  coccinelle: double_lock: improve performance when no double lock exists

Add myself to CREDITS because apparently I've never done that; and
update mailmap so that all my old email addresses get remapped to the
kernel.org redirector.

Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull timer fix from Ingo Molnar:

 - Fix UM build regression caused by the removal of the UM
   specific timex.h header (Thomas Weißschuh)

* tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  um: Use asm-generic/timex.h over the host architecture one

Pull locking fix from Ingo Molnar:

 - Revert a commit to spinlock cleanup guards that got caught up
   in the subtle limitations & fragility of guards (again...) and
   caused a regression (Peter Zijlstra)

* tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking: Revert switching guards to _irq_{disable,enable}()

Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Fix KCFI failures, such as in Rust doctests, by disabling function
     merging when CFI is enabled. Gary reported the LLVM bug to upstream
     and it is now fixed in their mainline.

   - Fix 'objtool' fallthrough warnings under the experimental
     'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
     helpers code) the LLVM options needed to preserve the unreachable
     traps that 'rustc' normally emits.

     In addition, fix 'objtool' errors when LTO is enabled on top, by
     also filtering out the LTO flags (for the combined Rust and helpers
     code) so that the traps are kept in place.

   - Fix 'objtool' warnings by adding one more 'noreturn' function.

   - Fix 'make rusttest' target when the 'rustc-dev' component is
     installed and Rust >= 1.82.0, <= 1.87.0 is used.

  'kernel' crate:

   - 'num' module: fix soundness issue in the 'Bounded' conversion from
     'bool' by restricting the conversions to unsigned 'Bounded'.

   - 'jump_label' module: fix future 'make rusttest' target failures
     when 'ARCH=' is set to an arch different than the host's.

   - 'list' module: fix incorrect 'pop_back()' comment"

* tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
  rust: num: restrict bool conversion to unsigned Bounded
  kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
  kbuild: rust: preserve unreachable traps with inline helpers
  rust: cfi: disable function merging if CFI is enabled
  rust: jump_label: skip arch-specific asm in `testlib` builds
  objtool/rust: add one more `noreturn` Rust function
  rust: kernel: list: fix incorrect pop_back example comment

Pull arm updates from Russell King:
 "Updates for 7.3:

   - add module description for kprobes testing module

   - remove references to CONFIG_CPU_ARM92x_CPU_IDLE options

   - expand comment in ARM's __switch_to()

  Also a number of fixes that missed 7.2:

   - disable broken eBPF on RiscPC

   - more BKPT fixes (guys, it's a *very* bad idea when everyone uses
     the BKPT instruction for their own differing purposes)

   - another preempt-rt fix, this time for siglock / CPU timers

   - fix another path where we try to send signals to processes with
     interrupts disabled

   - acquire mmap write lock for show_pte() with user faults"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
  ARM: 9480/1: entry: expand comment in __switch_to
  ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options
  ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
  ARM: 9484/1: enable interrupts when unhandled user faults are triggered
  ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
  ARM: 9481/2: breakpoint: CFI breakpoints only on demand
  ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
  ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION

Pull OpenRISC updates from Stafford Horne:
 "One small trivial macro cleanup and one bug fix.

  The bug fix is to fix an unchecked access in our or1k_atomic syscall,
  I am debating if we should just deprecate this as there is minimal
  need for it"

* tag 'for-linus' of https://github.com/openrisc/linux:
  openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
  openrisc: drop unneeded semicolon

Pull tracing fixes from Steven Rostedt:

 - Fix error output of boot instance creation failure

   Currently if a boot instance creation fails, instead of printing out
   the name of the instance that failed, it prints "(null)". That is
   because it prints "cur_str" that had already been processed by
   strsep(). Print the saved name instead.

   While at it, print the error code of the failure.

 - Fix use-after-free for same named historgrams

   Histograms can be named so that they can be used in multiple events.
   But if the named histogram has a variable attached, the second event
   that uses the named histogram which duplicates it and needs to free
   the original after duplication leaves the old variable in place and
   still visible. If another histogram uses than variable, it will use
   the stale one which will try to reference the freed duplicate
   histogram and crash the kernel.

   Free the duplicate variables along with the duplicated histogram
   data.

 - Check return value of kthread_run() in event self test

   The events self tests uses a kthread for testing but does not check
   if it succeeded in creating a kthread. If the kthread creation were
   to fail, the code will still try to call kthread_stop() on the error
   returned.

 - Fix race between reading trace_pipe and updating subbuffer size

   If a user is reading the trace_pipe file at the same time they update
   the ring buffer sub-buffer size, can cause the trace_pipe read to
   read stale data. Add trace_access_lock() around updating the ring
   buffer sub-buffer size.

 - Fix eventfs_inode on failure path in creation of the events directory

   In the creation of the "events" directory, if after allocating the
   eventfs_inode a failure is detected, it calls cleanup_ei() which
   calls free_ei(). The free_ei() will test if eventfs_inode being freed
   has no children. It is a bug if it does. But on the failure case of
   the creation of the "events" directory, the children lists have not
   yet been initialized and the free will trigger a warning because
   list_empty() on an uninitialized list returns false.

   Move the initialization into init_ei() where it makes more sense and
   makes sure that a created eventfs_inode has its lists initialized
   upon creation.

 - Check return value of kthread_run() in ftrace direct sample code

   The sample code that shows how to use the ftrace direct calls does
   not test the return of kthread_run() to see if it succeeds. Return a
   failure if the kthread_run() doesn't succeed.

 - Clear user events state on fork in case of alloc failure

   On fork, the child gets a pointer to the parent's user events state.
   It makes a copy of it then updates the child's pointer to it. But if
   the allocation fails, the duplication function leaves the child with
   a pointer to its parent's descriptor. When the child cleans up its
   data, it will free the parent's descriptor while the parent is still
   using it.

   In the duplication function, set the child's user_event_mm to NULL
   before testing if the allocation succeeded, and when it exits it will
   not free the parent's descriptor.

 - Fix retry exhaustion in simple ring buffer reader swap

   simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
   post-decrements it only after a failed link replacement. On the final
   attempt, a successful replacement leaves retry at zero, while a
   failed replacement leaves it at -1.

   But the check for success expects the retry value to be non-zero and
   exits with an error on zero. This is the opposite result. Fix it.

 - Fail nicely when the remote swap_reader_page() returns an error

   Currently, if the swap_reader_page() of a remote buffer fails, it
   triggers a WARN_ON_ONCE() and continues normally. Instead, have it
   exit with an error and a pr_warn() print instead of a full WARNING.

* tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Stop remote reader update when page swap fails
  tracing: Fix retry exhaustion in simple ring buffer reader swap
  tracing/user_events: Clear copied tracing state before fork duplication
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
  samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
  eventfs: Initialize ei->children and ei->list in init_ei()
  tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
  tracing: Fix crash passing ERR_PTR to kthread_stop()
  tracing: Fix use-after-free with same-name named triggers
  tracing: Fix logged instance name on creation failure