Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter.

  Current release - regressions:

   - ipmr: free mr_table after RCU grace period.

  Previous releases - regressions:

   - core: add net_iov_init() and use it to initialize ->page_type

   - sched: taprio: fix NULL pointer dereference in class dump

   - netfilter: nf_tables:
      - use list_del_rcu for netlink hooks
      - fix strict mode inbound policy matching

   - tcp: make probe0 timer handle expired user timeout

   - vrf: fix a potential NPD when removing a port from a VRF

   - eth: ice:
      - fix NULL pointer dereference in ice_reset_all_vfs()
      - fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw

  Previous releases - always broken:

   - page_pool: fix memory-provider leak in error path

   - sched: sch_cake: annotate data-races in cake_dump_stats()

   - mptcp: fix scheduling with atomic in timestamp sockopt

   - psp: check for device unregister when creating assoc

   - tls: fix strparser anchor skb leak on offload RX setup failure

   - eth:
      - stmmac: prevent NULL deref when RX memory exhausted
      - airoha: do not read uninitialized fragment address
      - rtl8150: fix use-after-free in rtl8150_start_xmit()

  Misc:

   - add Ido Schimmel as IPv4/IPv6 maintainer

   - add David Heidelberg as NFC subsystem maintainer"

* tag 'net-7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits)
  net/sched: cls_flower: revert unintended changes
  sfc: fix error code in efx_devlink_info_running_versions()
  net: tls: fix strparser anchor skb leak on offload RX setup failure
  ice: add dpll peer notification for paired SMA and U.FL pins
  ice: fix missing dpll notifications for SW pins
  dpll: export __dpll_pin_change_ntf() for use under dpll_lock
  ice: fix SMA and U.FL pin state changes affecting paired pin
  ice: fix missing SMA pin initialization in DPLL subsystem
  ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw
  ice: fix NULL pointer dereference in ice_reset_all_vfs()
  iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler
  iavf: wait for PF confirmation before removing VLAN filters
  iavf: stop removing VLAN filters from PF on interface down
  iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING
  page_pool: fix memory-provider leak in page_pool_create_percpu() error path
  bonding: 3ad: implement proper RCU rules for port->aggregator
  net: airoha: Do not return err in ndo_stop() callback
  hv_sock: fix ARM64 support
  MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel
  selftests: drv-net: clarify linters and frameworks in README
  ...

The dev-set and key-rotate netlink operations modify shared device
state (PSP version configuration and cryptographic key material,
respectively) but do not require CAP_NET_ADMIN. The only access
control is psp_dev_check_access() which merely verifies netns
membership.

Fixes: 00c94ca2b99e ("psp: base PSP device support")
Reviewed-by: Daniel Zahka <daniel.zahka@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260427195856.401223-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Pull cgroup fixes from Tejun Heo:

 - Fix UAF race in psi pressure_write() against cgroup file release by
   extending cgroup_mutex coverage and ordering of->priv access after
   cgroup_kn_lock_live()

 - Fix integer overflow in rdmacg_try_charge() when usage equals INT_MAX
   by performing the increment in s64

 - Fix asymmetric DL bandwidth accounting on cpuset attach rollback by
   recording the CPU used by dl_bw_alloc() so cancel_attach() returns
   the reservation to the same root domain

 - Fix nr_dying_subsys_* race that briefly showed 0 in cgroup.stat after
   rmdir by incrementing from kill_css() instead of offline_css()

 - Typo fix in cgroup-v2 documentation

* tag 'cgroup-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  docs: cgroup: fix typo 'protetion' -> 'protection'
  cgroup: Increment nr_dying_subsys_* from rmdir context
  cgroup/cpuset: record DL BW alloc CPU for attach rollback
  cgroup/rdma: fix integer overflow in rdmacg_try_charge()
  sched/psi: fix race between file release and pressure write

Pull isofs and udf fixes from Jan Kara:
 "Several isofs and udf fixes"

* tag 'fs_for_v7.1-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  docs: isofs: replace dead ECMA-119 FTP link
  udf: reject descriptors with oversized CRC length
  isofs: use QSTR_LEN() in isofs_cmp
  isofs: validate block number from NFS file handle in isofs_export_iget
  isofs: validate Rock Ridge CE continuation extent against volume size

Pull mailbox updates from Jassi Brar:

 - core: fix NULL message handling and add API to query TX queue slots

 - test: resolve concurrency bugs, dangling IRQs, and memory leaks

 - dt-bindings: qcom: add Eliza IPCC

 - mtk: fix address calculation and pointer handling bugs

 - cix: resolve SCMI suspend timeouts

 - misc memory allocation optimizations and cleanups

* tag 'mailbox-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:
  mailbox: mailbox-test: make data_ready a per-instance variable
  mailbox: mailbox-test: initialize struct earlier
  mailbox: mailbox-test: don't free the reused channel
  mailbox: mailbox-test: handle channel errors consistently
  mailbox: update kdoc for struct mbox_controller
  mailbox: add sanity check for channel array
  mailbox: mailbox-test: free channels on probe error
  mailbox: prefix new constants with MBOX_
  dt-bindings: mailbox: qcom-ipcc: Document the Eliza Inter-Processor Communication Controller
  mailbox: cix: Add IRQF_NO_SUSPEND to mailbox interrupt
  mailbox: Fix NULL message support in mbox_send_message()
  mailbox: remove superfluous internal header
  mailbox: correct kdoc title for mbox_bind_client
  mailbox: test: really ignore optional memory resources
  mailbox: exynos: drop superfluous mbox setting per channel
  mailbox: mtk-cmdq: Fix CURR and END addr for task insert case
  mailbox: mtk-vcp-mailbox: Fix the return value in mtk_vcp_mbox_xlate()
  mailbox: hi6220: kzalloc + kcalloc to kzalloc
  mailbox: rockchip: kzalloc + kcalloc to kzalloc
  mailbox: add API to query available TX queue slots

Fix a small typo in the description of the memory_hugetlb_accounting
mount option.

Signed-off-by: Petr Vaněk <arkamar@atlas.cz>
Signed-off-by: Tejun Heo <tj@kernel.org>

The original link is no longer valid. Replace it with the official
PDF of the 2nd edition. The new link points to the exact 2nd edition
that the existing comment in isofs.rst refers to.

Signed-off-by: Ziran Zhang <zhangcoder@yeah.net>
Link: https://patch.msgid.link/20260425142943.6809-1-zhangcoder@yeah.net
Signed-off-by: Jan Kara <jack@suse.cz>

Pull RTC updates from Alexandre Belloni:
 "Subsystem:
   - add data_race() in rtc_dev_poll()

  Drivers:
   - remove i2c_match_id usage
   - abx80x: Disable alarm feature if no interrupt attached
   - ti-k3: support resuming from IO DDR low power mode"

* tag 'rtc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:
  rtc: abx80x: Disable alarm feature if no interrupt attached
  rtc: ntxec: fix OF node reference imbalance
  rtc: pic32: allow driver to be compiled with COMPILE_TEST
  rtc: ti-k3: Add support to resume from IO DDR low power mode
  rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe()
  dt-bindings: rtc: add olpc,xo1-rtc to trivial-rtc
  dt-bindings: rtc: sc2731: Add compatible for SC2730
  rtc: add data_race() in rtc_dev_poll()
  rtc: armada38x: zalloc + calloc to single allocation
  dt-bindings: rtc: isl12026: convert to YAML schema
  dt-bindings: rtc: microcrystal,rv3028: Allow to specify vdd-supply
  rtc: max77686: convert to i2c_new_ancillary_device
  dt-bindings: rtc: mpfs-rtc: permit resets
  rtc: rx8025: Remove use of i2c_match_id()
  rtc: rv8803: Remove use of i2c_match_id()
  rtc: rs5c372: Remove use of i2c_match_id()
  rtc: pcf2127: Remove use of i2c_match_id()
  rtc: m41t80: Remove use of i2c_match_id()
  rtc: abx80x: Remove use of i2c_match_id()

Pull SPDX update from Greg KH:
 "Here is a single SPDX-like change for 7.1-rc1. It explicitly allows
  the use of SPDX-FileCopyrightText which has been used already in many
  files.

  At the same time, update checkpatch to catch any "non allowed" spdx
  identifiers as we don't want to go overboard here.

  This has been in linux-next for a long time with no reported problems"

* tag 'spdx-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx:
  LICENSES: Explicitly allow SPDX-FileCopyrightText

Pull char / misc / IIO / and others driver updates from Greg KH:
 "Here is the char/misc/iio and other smaller driver subsystem updates
  for 7.1-rc1. Lots of stuff in here, all tiny, but relevant for the
  different drivers they touch. Major points in here is:

   - the usual large set of new IIO drivers and updates for that
     subsystem (the large majority of this diffstat)

   - lots of comedi driver updates and bugfixes

   - coresight driver updates

   - interconnect driver updates and additions

   - mei driver updates

   - binder (both rust and C versions) updates and fixes

   - lots of other smaller driver subsystem updates and additions

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (405 commits)
  coresight: tpdm: fix invalid MMIO access issue
  mei: me: add nova lake point H DID
  mei: lb: add late binding version 2
  mei: bus: add mei_cldev_uuid
  w1: ds2490: drop redundant device reference
  bus: mhi: host: pci_generic: Add Telit FE912C04 modem support
  mei: csc: wake device while reading firmware status
  mei: csc: support controller with separate PCI device
  mei: convert PCI error to common errno
  mei: trace: print return value of pci_cfg_read
  mei: me: move trace into firmware status read
  mei: fix idle print specifiers
  mei: me: use PCI_DEVICE_DATA macro
  sonypi: Convert ACPI driver to a platform one
  misc: apds990x: fix all kernel-doc warnings
  most: usb: Use kzalloc_objs for endpoint address array
  hpet: Convert ACPI driver to a platform one
  misc: vmw_vmci: Fix spelling mistakes in comments
  parport: Remove completed item from to-do list
  char: remove unnecessary module_init/exit functions
  ...